A Survey of Anonymous Blacklisting Systems

Anonymous communications networks, such as Tor, help to solve the real and important problem of enabling users to communicate privately over the Internet. However, by doing so, they also introduce an entirely new problem: How can service providers on the Internet allow anonymous access while protecting themselves against abuse by misbehaving anonymous users? Recent research efforts have proposed anonymous blacklisting systems (which are sometimes called anonymous revocation systems) to solve this problem. As opposed to revocable anonymity systems, which enable some trusted third party to deanonymize users, anonymous blacklisting systems provide users with a way to authenticate anonymously with a service provider (such as a website), while enabling the service provider to revoke access from any users that misbehave without revealing their identities. Unfortunately, although the various anonymous blacklisting systems are designed to solve similar problems, each operates under different assumptions and no unified security definitions exist. This paper proposes a formal definition for anonymous blacklisting systems, and a set of security and privacy properties that they should possess to protect: 1) users’ privacy against malicious service providers and third parties (including other malicious users), and 2) service providers against abuse by malicious users. We then propose a set of new performance requirements that should be satisfied to maximize any anonymous blacklisting system’s potential for real-world adoption, and provide formal definitions of some optional features already found in the literature on anonymous blacklisting systems. With especially close attention paid to the category we call Nymble-like systems, we give an overview of the anonymous blacklisting systems found in the literature.