0

I have multiple clients sending data to a central server. Is there a way I can ensure that the server get the data but in no way it can associate sender with the data.

Satyam
  • 75
  • 1
  • 9
  • Please be more detailed. What sort of data is the server using to associate the same with any user? – Penguine Nov 28 '17 at 10:59
  • @Penguine data could be anything. Suppose it is text data, say the name of the owner of the client, XYZ for example. Now when server receives this data, it can easily figure out that XYZ owns the machine which sent this data. What I want is server should never be able to associate the data with the sender machine. – Satyam Nov 28 '17 at 11:33
  • Are you acting as a proxy in between the clients and server? – Penguine Nov 28 '17 at 11:45
  • no, what I am asking is that no adversary present on the server side can associate which message come from which client – Satyam Nov 28 '17 at 11:53
  • Then you encrypt the data and send to the server. Unless you give a more detailed scenario, we can only think of encrypting it as an only option.\ – Penguine Nov 28 '17 at 12:03
  • simple encryption won't work. I can provide an example: let there be two clients A, B. A sends message X to the server, B sends message Y to the server. Now what I want is to store X and Y in the server but server should never be able to identify that X is sent by A and Y is sent by B. Is the problem clear now? – Satyam Nov 28 '17 at 12:10
  • Which parameter is the server using to identify the clients? Ip address? or the message X and Y? OR something else? Whatever it is using to identify, if we change the content, will the system work? Please answer these questions – Penguine Nov 28 '17 at 12:13
  • Clients are identified using ip addresses. Changing the ip address will work if we are still able to get X and Y on the server – Satyam Nov 28 '17 at 12:18

1 Answers1

0

If the clients are identified using IP address, then spoofing is a way to make sure that they are not traceable. To spoof, you need to identify the packets the client is sending to the server. In Network layer, you shall find the IP bits, which you need to replace(or remove, if it works). (Use wireshark tool, it might be helpful)

Although, it shall still be considered a malpractice in the society. I sincerely advice you to contact the server administration, to discuss and put in place other security measures instead of spoofing.

Penguine
  • 519
  • 6
  • 19
  • could this be done using any cryptography method instead of spoofing? Is there a way we can somehow encrypt the data, combine data from multiple users and then decrypt it such that we do not know which decrypted data belong to which encrypted packet, or something along those lines? – Satyam Nov 28 '17 at 15:17
  • Does not make any sense my friend. At max, what you can do is mix numerous packets and send to the server, so that the server actually does not know, where exactly the packet is coming from. But, then again, uve to spoof the address. Secondly, by encrypting the data, the server itself wont understand it, then it wont be able to send any response. If u share the key with server, then there is no point in encrypting it. If u encrypt the IP, you cannot send it, because no. of bits will increase. – Penguine Nov 28 '17 at 17:10