Anonymous Indexing Problem
If Alice is looking for a resource that Bob can provide, how can Bob know that Alice needs it and provide it without either revealing their IP.
Challenges
- DDOS
- Overhead
The Request
There are two ways for Alice to make the request
- Anonymously broadcast that she is looking for the resource
- Check a common index
Broadcasting
If Alice broadcasts the request, it must reach a large number of recipients before any of them can respond. If only a few people see the request, we can narrow down the responder to that set, compromising Bobs anonymity. But this means that sending a single message into the network results in high replication. So Eve can send many requests into the network to maliciously flood the network at high leverage.
DDOS Prevention
Specific Entry
Requests propagate through SwitchBoard, each node queueing up and passing along requests about once a second. If each node maintains 8 'neighbors', that would propagate the request to 16M nodes in 8 seconds.
Strictly speaking, this doesn't prevent DDOS, but it distributes it evenly over the network and forces Eve to do a lot more work per request.
However, Eve could inject those requests as a SwitchBoard node. I'm a little less concerned about this because a user would need to modify the code (not just script kiddy to repeat send), it exposes the malicious node (SwitchBoard nodes are IP exposed) and they could potentially be tracked.
Rate Limit
The requests are anonymous, so we can't actually rate limit a user. But we could do something like BitCoin and require a hash puzzle. The goal here is to make the work required to post a request equal to the the total work done by the network.
A more interesting, but vastly more complex idea would be to have a sort of network-maintenance queue holding things like EigenTrust problems. In order to post, the requester needs to do some amount of work.
Indexing
I cannot even begin to find a way to make indexing work. Resource aren't necessarily static, so it's not actually possible to index them. If it were, even a short form list could be huge. But that's not possible because each resource needs at least one return route to make the request. So, this just does not seem feasible and I'm going to stop thinking about it.
The Response
This part is actually pretty easy. If Bob gets the request and a return route, he can simply respond. But it can be even easier. If Bob only gets the request and not a return route, he can post a return route in SwitchBoard which Alice can check for a few seconds after the request has gone out.
Balancing
If we can group users so that each user is a member of a small number of groups, and a request can be given to a small number of groups with high probability that one of those groups contains the person holding the file without the groups betraying information about their members, we can increase the efficiency. I don't think anonymous groups are worthwhile, the overhead of maintaining the connection is expensive.
Groups seriously threaten anonymity. Group membership can provide a finger print. We need to constantly monitor that all groups are large enough to provide anonymity.