A method for measuring sender anonymity in rerouting anonymous communication systems

Abstract

The present invention discloses a sender anonymity measurement method for a rerouting anonymous communication system. The method includes: constructing a controllable node set inside the rerouting anonymous communication system, including an autonomously deployed internal controllable node set and a vulnerable node set; for vulnerable nodes, using a controllability calculation method to evaluate the controllability of the nodes inside the system; dividing the link topology strategy rules and the path length selection strategy of the rerouting anonymous communication system according to the configuration information of the rerouting anonymous communication system; generating a potential sender node set using the link topology strategy information of the rerouting anonymous communication system; selecting a corresponding sender anonymity measurement algorithm according to the path length selection strategy of the rerouting anonymous communication system, and generating a sender anonymity score to measure the sender anonymity of the system.

Description

Technical Field

[0001] The invention belongs to the field of network security, and specifically designs a sender anonymity measurement method for a re-routing anonymous communication system. Background Art

[0002] In the current network environment, user data is often monitored from different sources. Faced with the significant privacy risks in communication networks, the content confidentiality provided by message encryption alone cannot protect the communication relationship between the traffic receiver and the sender. In order to realize the beautiful vision of protecting privacy in cyberspace, the research on anonymous communication systems is constantly advancing. These systems are designed to help users hide sensitive information such as their identity and communication relationship when using Internet services.

[0003] In recent years, anonymous communication systems have evolved from small-scale deployments to mass-market software used by millions of people. Tor, I2P, Freenet, ZeroNet, etc. are all widely used anonymous communication systems. Different anonymous communication systems provide different levels of anonymity protection. By designing a method to quantify the degree of anonymity of anonymous communication systems, users can understand the level of protection provided by anonymous communication systems, and developers can provide an objective and scientific basis when designing and improving anonymous communication systems. Summary of the invention

[0004] In view of this, the present invention provides a sender anonymity measurement method for a rerouting anonymous communication system. By considering the controllability of nodes, path selection strategy and path topology within the communication system, combined with external prior knowledge, the sender disclosure probability is quantified, providing a scientific and objective security assessment standard for rerouting anonymous communication systems for network security practitioners.

[0005] A method for measuring sender anonymity in a rerouting anonymous communication system, the method comprising:

[0006] Step 1: Construct an internal controllable node set M of the rerouting anonymous communication system. The internal controllable node set M includes three node sets: receiving node M1, internal deployment node M2 ​​and vulnerable node M3;

[0007] Step 2: According to the configuration information of the rerouting anonymous communication system, the link topology strategy rules and the path length selection strategy of the rerouting anonymous communication system are divided;

[0008] Step 3: Generate a set of potential sender nodes based on the link topology strategy information of the rerouting anonymous communication system;

[0009] Step 4: Select the corresponding sender anonymity measurement algorithm according to the path length selection strategy of the rerouting anonymous communication system to generate the final sender anonymity score.

[0010] Preferably, the process of constructing controllable nodes within the rerouting anonymous communication system includes:

[0011] The rerouting anonymous communication system to be evaluated can be regarded as a set of N nodes. At the same time, it must be satisfied that only one communication path will be established between any pair of nodes, and any host can communicate with any other host. The rerouting anonymous communication system can be further regarded as a connected graph G;

[0012] All the edges in the graph are all the paths from the source host to the target host through routing. In the rerouting anonymous communication system, in order to hide the true identity of the sender, the communication message will pass through multiple intermediate nodes before being sent to the target node;

[0013] The internal controllable node set M consists of three node sets: receiving node M1, internal deployment node M2, and vulnerable node M3:

[0014] The receiving node M1 is the target host node of a single communication process of the rerouting anonymous communication system;

[0015] The internally deployed nodes M2 are a set of known nodes autonomously deployed by the evaluator in the rerouting anonymous communication system;

[0016] According to the controllability calculation method, the other nodes N of the rerouting anonymous communication system are o To evaluate, where N o =N-M1-M2, and we get the vulnerable node set M3.

[0017] Preferably, the controllability calculation method includes:

[0018] Calculate the set N separately o The vulnerability level of each node i in i ;

[0019] Taking the receiving node M1 and the internal deployment node M2 ​​as the starting point, other hosts as intermediate nodes, and node i as the target node, all reachable paths are searched through the depth-first search algorithm;

[0020] Calculate the controllability set CS of node i under all reachable paths, and obtain the node controllability CS under a single path according to the controllability calculation formula j , the calculation formula of the node controllability is:

[0021]

[0022] Said Represents the node vulnerability W generated by the node set on a single path i product;

[0023] Select the maximum value in the controllability set CS as the controllability of node i;

[0024] The node set M3 with controllability higher than the threshold value 0.8 is selected as the vulnerable node.

[0025] Preferably, the vulnerability level W of the computing node is i include:

[0026] Collect all vulnerability information on node i, single vulnerability information V k Including attack vector AV k , Attack Complexity AC k and vulnerability disclosure time t k , node information includes identity authentication method AU i ;

[0027] According to the node vulnerability calculation formula, the node vulnerability W is obtained i , the node vulnerability calculation formula is:

[0028] W i =max(VE k ×TE k ×EE i )

[0029] Among them, VE k ,TE k and EE k They represent vulnerability exploitability, vulnerability time exploitability, and environmental exploitability, respectively;

[0030] The vulnerability exploitability VE is obtained according to the vulnerability exploitability calculation formula. k , the vulnerability exploitability calculation formula is:

[0031] VE k =2AV k AC k AU i

[0032] Among them, AV k It is divided into three levels according to local, neighboring topology and network, with values ​​of 0.395, 0.646 and 1 respectively; AC k It is divided into three levels: high, medium and low, with values ​​of 0.35, 0.61 and 0.71 respectively; AU i It is divided into three levels according to multiple, single and no certification required, with values ​​of 0.45, 0.56 and 0.704 respectively;

[0033] According to the vulnerability time exploitability calculation formula, the vulnerability time exploitability TE is obtained k , the vulnerability time exploitability TE k The calculation formula is:

[0034]

[0035] Among them, l and x represent Pareto distribution coefficients, with values ​​of 0.26 and 0.00161 respectively; q and y represent Weibull distribution coefficients, with values ​​of 0.209 and 4.04 respectively;

[0036] The host defense measures are divided into five levels: high, relatively high, medium, relatively low and low. The environmental exploitability EE i The corresponding value intervals are set to 0-0.2, 0.2-0.4, 0.4-0.6, 0.6-0.8 and 0.8-1. The specific values ​​within the interval can be assigned by the evaluator according to the actual situation of the host.

[0037] Preferably, the dividing of the link topology strategy rules and the path length selection strategy of the rerouting anonymous communication system according to the configuration information of the rerouting anonymous communication system comprises:

[0038] According to the configuration file and description document of the rerouting anonymous communication system, confirm the link topology strategy rules and path length selection strategy of the rerouting anonymous communication system;

[0039] According to the link topology strategy information of the rerouting anonymous communication system, the constraints on the ring routing can be divided into simple paths and complex paths, including the following three categories:

[0040] Simple path: There is no loop in the rerouting path, that is, each relay node can only appear once in a rerouting path;

[0041] Complex path 1: Disjoint loops are allowed in the rerouting path, that is, there are no cross nodes between the loops, and only the ring nodes of the start and end nodes can appear twice;

[0042] Complex path 2: The rerouting path has no constraints on relay nodes, that is, any relay node is allowed to appear at any time and any location;

[0043] According to the path length selection strategy information of the rerouting anonymous communication system, the path length control strategy in the rerouting anonymous communication system is divided into fixed-length path selection strategy and variable-length path selection strategy:

[0044] Fixed-length path selection strategy, that is, if the sender sends a message to the target node, the rerouting anonymous communication system selects a fixed number of intermediate communication nodes to form a rerouting path to transmit the message;

[0045] The variable-length path selection strategy is that if the sender sends a message to the target node, the rerouting path length is variable and is a discrete variable that obeys a certain probability distribution. The relay node on the path is randomly selected from the N nodes in the rerouting anonymous communication system. When the rerouting path length is l, its probability distribution satisfies the following formula:

[0046]

[0047] where x f is the forwarding probability.

[0048] Preferably, the step of selecting and generating a set of potential sender nodes according to the link topology policy information of the rerouting anonymous communication system includes:

[0049] Collect predecessor and successor nodes in controllable node communication messages;

[0050] The collected information and rules are used to construct the non-sender node set NS. The specific rules include:

[0051] If the rerouting path is a simple path, add the target node, the target node predecessor, the non-sender controllable node, the controllable node successor and all subsequent nodes of the first controllable node to the non-sender node set NS;

[0052] If the rerouting path is complex path 1, and the ring length and the ring start and end nodes are known, it is simplified to a simple path rule; when the ring length is unknown but the ring start and end nodes are known, the target node, the target node predecessor, the non-sender controllable node and the controllable node successor are added to the non-sender node set NS; when the ring length, the ring start and end nodes are all unknown, the target node and the controllable node are added to the non-sender node set NS;

[0053] If the rerouting path is complex path 2, add the target node and the controllable node to the non-sender node set NS;

[0054] The potential sender node set PS is determined according to the following formula:

[0055] PS=N-NS

[0056] Where N is the set of all nodes in the anonymous communication system.

[0057] Preferably, the selecting a corresponding sender anonymity measurement algorithm according to the path length selection strategy of the rerouting anonymous communication system to generate a sender anonymity score comprises:

[0058] If the evaluated rerouting anonymous communication system selects a fixed number of relay nodes to form a rerouting path, the sender anonymity score of the rerouting anonymous communication system is generated according to the sender anonymity measurement algorithm of the rerouting anonymous communication system under the fixed-length path selection;

[0059] If the evaluated rerouting anonymous communication system selects a random number of relay nodes to form a rerouting path, the sender anonymity score of the rerouting anonymous communication system is generated according to the sender anonymity measurement algorithm of the rerouting anonymous communication system under variable-length path selection.

[0060] Preferably, the sender anonymity measurement algorithm of the rerouting anonymous communication system under the fixed-length path selection includes:

[0061] Without external knowledge, the sender anonymity score is generated according to the following formula:

[0062]

[0063] Optionally, when the evaluator knows some external knowledge such as the sender's geographic location, the sender's anonymity score is generated according to the following formula:

[0064]

[0065] where p i is the prior probability assigned to the potential sender node.

[0066] Preferably, the sender anonymity measurement algorithm of the rerouting anonymous communication system under the variable-length path selection includes:

[0067] The sender anonymity score is generated according to the following formula:

[0068]

[0069] Among them, the rerouting path length of the rerouting anonymous communication system follows the distribution P(L=l) on the interval [a,b]. At the same time, the evaluator can further reduce the path length to [c,d] based on the collected information of the controllable nodes, that is, a≤c≤d≤b.

[0070] The present application provides a sender anonymity measurement method for a rerouting anonymous communication system. Compared with the prior art, the present invention has the following beneficial effects: for various anonymous communication systems designed based on a rerouting mechanism, a unified quantitative comparison of the internal security of the system can be made from the controllability of nodes within the communication system, path selection strategy, path topology, and external prior knowledge, thereby providing an objective and scientific evaluation standard. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0072] Figure 1 A schematic diagram of a rerouting anonymous communication system provided in an embodiment of the present application.

[0073] Figure 2 A schematic diagram of a framework of a sender anonymity measurement method for a rerouting anonymous communication system provided in an embodiment of the present application.

[0074] Figure 3 A flowchart of a method for calculating the degree of controllability provided in an embodiment of the present application. DETAILED DESCRIPTION

[0075] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementations. The following examples or drawings are used to illustrate the present invention, but are not used to limit the scope of the present invention.

[0076] This embodiment uses Figure 1 The method of the present invention is described in detail by taking the rerouting anonymous communication system as an example.

[0077] See also Figure 2 , Figure 2 A method flow chart of a method for measuring sender anonymity in a rerouting anonymous communication system provided in an embodiment of the present application includes:

[0078] Step A: Construct an internal controllable node set M of the rerouting anonymous communication system, where the internal controllable node set M includes three node sets: receiving node M1, internal deployment node M2, and vulnerable node M3;

[0079] Step B: dividing the link topology strategy rules and the path length selection strategy of the rerouting anonymous communication system according to the configuration information of the rerouting anonymous communication system;

[0080] Step C: Select and generate a set of potential sender nodes based on the link topology strategy information of the rerouting anonymous communication system;

[0081] Step D: Select the corresponding sender anonymity measurement algorithm according to the path length selection strategy of the rerouting anonymous communication system to generate the final sender anonymity score.

[0082] The specific steps for constructing a controllable node set within a rerouting anonymous communication system include:

[0083] Step A1: Determine the target host node M1 of a single communication process of the rerouting anonymous communication system, corresponding to Figure 1 The receiver node in

[0084] Step A2: Determine the known node set M2 that the evaluator autonomously deploys in the rerouting communication system, corresponding to Figure 1 The node set in {2, 4, 11, 12, 13};

[0085] Step A3: Determine other nodes N in the rerouting anonymous communication system o =N-M1-M2, and the vulnerable node set M3 is obtained by evaluating the controllability calculation method, corresponding to Figure 1 The node set in {7, 8}.

[0086] See also Figure 3 , Figure 3 The flowchart of obtaining the vulnerable node set M3 by evaluating the controllability calculation method for this application is shown in the following specific steps:

[0087] Step A31: For the node set N o For each node i in the , calculate the vulnerability level W of i respectively i ;

[0088] Step A32: Taking the receiving node M1 and the internal deployment node set M2 as starting points, other hosts as intermediate nodes, and node i as the target node, all reachable paths are searched through a depth-first search algorithm;

[0089] Step A33: Calculate the controllability set CS of node i under all reachable paths, according to the controllability calculation formula Get the node controllability CS under a single path j , The node vulnerability W generated for the set of nodes on a single path i product;

[0090] Step A34: Select the maximum value in the controllability set CS as the controllability of node i;

[0091] Step A35: Select the node set M3 whose controllability is higher than the threshold value 0.8 as the vulnerable nodes;

[0092] Optionally, during the final vulnerable node selection process, the implementer may adjust the threshold according to actual conditions.

[0093] The specific steps for calculating the vulnerability of node i include:

[0094] Step A311: Collect all vulnerability information on node i, and single vulnerability information V k Should include attack path AV k , attack complexity AC k , vulnerability disclosure time t k , node information includes identity authentication method AU i ;

[0095] Step A312: Calculate formula W based on node vulnerability i =max(VE k ×TE k ×EE i ) to get the node vulnerability degree W i , VE k Indicates the exploitability of the vulnerability, TE k Indicates the exploitability of the vulnerability, EE k Indicates environmental availability;

[0096] Step A313: Calculate the vulnerability exploitability formula VE k =2AV k AC k AU i Get the vulnerability exploitability VE k , AV k It is divided into three levels according to local, neighboring topology and network, with values ​​of 0.395, 0.646 and 1 respectively; AC k It is divided into three levels: high, medium and low, with values ​​of 0.35, 0.61 and 0.71 respectively; AU i It is divided into three levels according to multiple, single and no certification required, with values ​​of 0.45, 0.56 and 0.704 respectively;

[0097] Step A314: Calculate the vulnerability time exploitability formula Get the vulnerability time exploitability TE k , l and x represent Pareto distribution coefficients, with values ​​of 0.26 and 0.00161 respectively; q and y represent Weibull distribution coefficients, with values ​​of 0.209 and 4.04 respectively;

[0098] Step A315: Classify the host defense measures into five levels: high, relatively high, medium, relatively low, and low. The environmental exploitability EE i The corresponding value intervals are set to 0-0.2, 0.2-0.4, 0.4-0.6, 0.6-0.8 and 0.8-1.

[0099] Optionally, the specific value within the interval can be assigned by the implementer according to the actual situation of the host.

[0100] According to the configuration information of the rerouting anonymous communication system, the link topology strategy rules and the path length selection strategy of the rerouting anonymous communication system are divided, and the specific steps include:

[0101] Step B1: confirm the link topology strategy rules and path length selection strategy of the rerouting anonymous communication system according to the rerouting anonymous communication system configuration file and description document;

[0102] Step B2: According to the link topology strategy information of the rerouting anonymous communication system, the constraints on the loop routing can be divided into simple paths and complex paths, including the following three categories: simple path, there is no loop in the rerouting path, and each relay node can only appear once in a rerouting path; complex path one, disjoint loops are allowed in the rerouting path, that is, there are no cross nodes between the rings, and only the ring nodes of the start and end nodes can appear twice; complex path two, the rerouting path has no constraints on the relay nodes, that is, any relay node is allowed to appear at any time and any location;

[0103] Step B3: Based on the path length selection strategy information of the rerouting anonymous communication system, the path length control strategy in the rerouting anonymous communication system is divided into a fixed-length path selection strategy and a variable-length path selection strategy: the fixed-length path selection strategy, that is, if the sender sends a message to the target node, the rerouting anonymous communication system selects a fixed number of intermediate communication nodes to form a rerouting path to transmit the message; the variable-length path selection strategy, that is, if the sender sends a message to the target node, the rerouting path length is variable and is a discrete variable that obeys a certain probability distribution. The relay nodes on the path are randomly selected from the N nodes in the rerouting anonymous communication system. When the rerouting path length is l, its probability distribution satisfies the formula where x f is the forwarding probability.

[0104] Figure 1 The path link topology strategy of the rerouting anonymous communication system shown is a simple path, and the path length selection strategy is a fixed-length path selection strategy.

[0105] The specific steps of selecting and generating a potential sender node set based on the link topology strategy information of the rerouting anonymous communication system include:

[0106] Step C1: Collect the predecessor and successor nodes in the controllable node communication message;

[0107] The non-sender node set NS is constructed using the collected node information, fixed-length path selection strategy, simple path topology rules and rules. The specific rules include:

[0108] Add the target node, target node predecessor, non-sender controllable node, controllable node successor and all subsequent nodes of the first controllable node to the non-sender node set NS, corresponding to Figure 1 The nodes are {receiver, 2, 4, 12, 13, 11, 7, 8, 5};

[0109] Step C2: Determine the potential sender node set PS according to the formula PS = N-NS, corresponding to Figure 1 The nodes are {0, 1, 3, 6, 9, 10}.

[0110] The specific steps of selecting a corresponding sender anonymity measurement algorithm based on the path length selection strategy of the rerouting anonymous communication system and generating the final sender anonymity score include:

[0111] Step D1: The evaluated rerouting anonymous communication system selects a fixed number of relay communication nodes to form a rerouting path, and generates an anonymity score of the sender of the rerouting anonymous communication system according to the anonymity measurement algorithm of the sender of the rerouting anonymous communication system under the fixed-length path selection.

[0112] The specific steps of the sender anonymity measurement algorithm for the rerouting anonymous communication system under fixed-length path selection include:

[0113] Step D11: Without external prior knowledge, according to the formula Generate the sender anonymity score, and the final sender anonymity score is

[0114] Optionally, when the evaluator knows some external prior knowledge, such as the sender's geographic location, the potential sender node can be given a prior probability p i , and according to the formula Generate a sender anonymity score.

[0115] It should be noted that, for the above method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and processes involved are not necessarily required by the present application.

[0116] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of complete software embodiments or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0117] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent replacements for some of the technical features therein.

[0118] Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for measuring sender anonymity in a rerouting anonymous communication system, characterized in that: include: Step 1: Construct an internal controllable node set of the rerouting anonymous communication system. The internal controllable node set M includes three node sets: receiving node M1, internal deployment node M2 ​​and vulnerable node M3; Step 2: According to the configuration information of the rerouting anonymous communication system, the link topology strategy rules and path length selection strategy of the rerouting anonymous communication system are divided. The path length selection strategy can be divided into a fixed-length path selection strategy and a variable-length path selection strategy: Fixed-length path selection strategy, that is, if the sender sends a message to the target node, the rerouting anonymous communication system selects a fixed number of intermediate communication nodes to form a rerouting path to transmit the message; The variable-length path selection strategy is that if the sender sends a message to the target node, the rerouting path length is variable and is a discrete variable that obeys a certain probability distribution. The relay node on the path is randomly selected from the N nodes in the rerouting anonymous communication system. When the rerouting path length is l, its probability distribution satisfies the following formula: where x f is the forwarding probability; Step 3: Generate a set of potential sender nodes based on the link topology strategy information of the rerouting anonymous communication system; Step 4: Select the corresponding sender anonymity measurement algorithm based on the path length selection strategy of the rerouting anonymous communication system to generate the sender anonymity score: If the path length selection strategy of the evaluated rerouting anonymous communication system is to select a fixed number of relay nodes to form a rerouting path, the sender anonymity score of the rerouting anonymous communication system is generated according to the sender anonymity measurement algorithm of the rerouting anonymous communication system under the fixed-length path selection. In the absence of external knowledge, the sender anonymity score is generated according to the following formula: Where N is the set of all nodes in the rerouting anonymous communication system, and NS is the set of non-sender nodes; When the evaluator knows some external knowledge, the final sender anonymity score is generated according to the following formula: where p i is the prior probability assigned to the potential sender node, PS is the set of potential sender nodes; If the path length selection strategy of the evaluated rerouting anonymous communication system is to select a random number of relay nodes to form a rerouting path, the sender anonymity score of the rerouting anonymous communication system is generated according to the sender anonymity measurement algorithm of the rerouting anonymous communication system under variable length path selection, and the sender anonymity score is generated according to the following formula: Among them, the rerouting path length of the rerouting anonymous communication system follows the distribution P(L=l) on the interval [a,b]. At the same time, the evaluator can further reduce the path length to [c,d] based on the collected information of the controllable nodes, that is, a≤c≤d≤b.

2. A method for measuring sender anonymity in a rerouting anonymous communication system according to claim 1, characterized in that: In step 1: The evaluated rerouting anonymous communication system can be regarded as a set of N nodes. At the same time, it is required that the communication between any pair of nodes will only establish one communication path, and any host can communicate with any other host. The rerouting anonymous communication system can be further regarded as a connected graph G; All the edges in graph G are all the paths from the source host to the target host through routing. In the rerouting anonymous communication system, in order to hide the true identity of the sender, the communication message will pass through multiple intermediate nodes before being sent to the target node; The internal controllable node set M consists of three node sets: receiving node M1, internal deployment node M2, and vulnerable node M3: The receiving node M1 is the target host node of a single communication process of the rerouting anonymous communication system; The internally deployed nodes M2 are a set of known nodes autonomously deployed by the evaluator in the rerouting anonymous communication system; According to the controllability calculation method, the other nodes N of the rerouting anonymous communication system are o To evaluate, where N o =N-M1-M2, and we get the vulnerable node set M3.

3. The method according to claim 2, characterized in that The controllability calculation method comprises: According to claim 2, N o , calculate the vulnerability level W of each node i respectively i , where i∈N o ; Taking the receiving node M1 and the internal deployment node M2 ​​as the starting point, other hosts as intermediate nodes, and node i as the target node, all reachable paths are searched through the depth-first search algorithm; Calculate the controllability set CS of node i under all reachable paths, and obtain the node controllability CS under a single path according to the controllability calculation formula j , the calculation formula of the node controllability is: Said Represents the node vulnerability W generated by the node set on a single path i product; Select the maximum value in the controllability set CS as the controllability of node i; The node set M3 with controllability higher than the threshold value 0.8 is selected as the vulnerable node.

4. The method according to claim 3, characterized in that The vulnerability level of the computing node is W i include: Collect all vulnerability information on node i, single vulnerability information V k Including attack vector AV k , Attack Complexity AC k and vulnerability disclosure time t k , node information includes identity authentication method AU i ; According to the node vulnerability calculation formula, the node vulnerability degree W is obtained i , the node vulnerability calculation formula is: W i =max(VE k ×TE k ×EE i ) Among them, VE k ,TE k and EE k They represent vulnerability exploitability, vulnerability time exploitability, and environmental exploitability, respectively; The vulnerability exploitability VE is obtained according to the vulnerability exploitability calculation formula. k , the vulnerability exploitability calculation formula is: VE k =2AV k AC k AU i Among them, AV k It is divided into three levels according to local, neighboring topology and network, with values ​​of 0.395, 0.646 and 1 respectively; AC k It is divided into three levels: high, medium and low, with values ​​of 0.35, 0.61 and 0.71 respectively; AU i It is divided into three levels according to multiple, single and no certification required, with values ​​of 0.45, 0.56 and 0.704 respectively; According to the vulnerability time exploitability calculation formula, the vulnerability time exploitability TE is obtained k , the vulnerability time exploitability TE k The calculation formula is: Among them, l and x represent Pareto distribution coefficients, with values ​​of 0.26 and 0.00161 respectively; q and y represent Weibull distribution coefficients, with values ​​of 0.209 and 4.04 respectively; The host defense measures are divided into five levels: high, relatively high, medium, relatively low and low. The environmental exploitability EE i The corresponding value intervals are set to 0-0.2, 0.2-0.4, 0.4-0.6, 0.6-0.8 and 0.8-1. The specific values ​​within the interval can be assigned by the evaluator according to the actual situation of the host.

5. A method for measuring sender anonymity in a rerouting anonymous communication system according to claim 1, characterized in that: In step 2: According to the configuration file and description document of the rerouting anonymous communication system, confirm the link topology strategy rules and path length selection strategy of the rerouting anonymous communication system; According to the link topology strategy information of the rerouting anonymous communication system, the constraints on the ring routing can be divided into simple paths and complex paths, including the following three categories: Simple path: There is no loop in the rerouting path, that is, each relay node can only appear once in a rerouting path; Complex path 1: Disjoint loops are allowed in the rerouting path, that is, there are no cross nodes between the loops, and only the ring nodes of the start and end nodes can appear twice; Complex path 2: The rerouting path has no constraints on relay nodes, that is, any relay node is allowed to appear at any time and any location; According to the path length selection strategy information of the rerouting anonymous communication system, the path length control strategy in the rerouting anonymous communication system is divided into fixed-length path selection strategy and variable-length path selection strategy.

6. A method for measuring sender anonymity in a rerouting anonymous communication system according to claim 5, characterized in that: In step 3: Collect predecessor and successor nodes in controllable node communication messages; The collected information and rules are used to construct the non-sender node set NS. The specific rules include: If the rerouting path is a simple path, add the target node, the target node predecessor, the non-sender controllable node, the controllable node successor and all subsequent nodes of the first controllable node to the non-sender node set NS; If the rerouting path is complex path 1, and the ring length and the ring start and end nodes are known, it is simplified to a simple path rule; when the ring length is unknown but the ring start and end nodes are known, the target node, the target node predecessor, the non-sender controllable node, and the controllable node successor are added to the non-sender node set NS; when the ring length, the ring start and end nodes are all unknown, the target node and the controllable node are added to the non-sender node set NS; If the rerouting path is complex path 2, add the target node and controllable node to the non-sender node set NS; The potential sender node set PS is determined according to the following formula: PS=N-NS Where N is the set of all nodes in the anonymous communication system.

Images