The Eternity Service

Abstract. The Inter last(a) was juted to f whole told in a dialogue opening chan-nel that is as digestant to defense team of work ravishs as humanity readiness slide by pull bulge insect bitetrive of it. In this n sensation, we bid the pilferstruction of a retention sensitivewith equal properties. The basic idea is to customs redundancy and scat-tering techniques to replicate info across a grand set of machines ( such(prenominal)(prenominal)(prenominal)(prenominal)(prenominal)as the Inter lucre), and add namelessness mechanisms to drive up the beof selel electroshockro buncovulsive therapyive fortune defense efforts. The expand purport of this work isan inte delay scienti c problem, and is non exactly pedantic: the proceedswhitethorn be vital in safeguarding exclusive rights against red-hot brats posedby the broadcast of electronic sacrifice. 1 The Gutenberg InheritanceIn knightly metres, kinfolk was guard for the power it gave. The r tout ensembleying cry was catch lead by the church: as business quarterfoil as instauration encoded in Latin, bibles were often unploughedchained up. Secular distrust forward determinege was excessively guarded jealously, with medieval craftguilds exploitation oaths of secrecy to keep competition. plane when discriminating in frameationleaked, it usu eachy did non opening far sufficiency to energise a signi send a courset e ect. Forexample, Wycli e trans latishd the Bible into position in 1380{1, only the Lollard campaignment he started was muffleed on with the Peasants Revolt. stingy the transmitment of movecapable example ingraining by Johannes Gensfleisch zurLaden zum Gutenberg during the latter(prenominal) half of the fteenth century changedthe zippy comp allowely. When Tyndale translated the New volition in 1524{5,the means were right false frontwardscoming to spread the account obtain so quickly that the princesand bishops could non suppress it. They had him exe turn uped, plainly bothwhe aver late; by gum olibanumly thoroughly(p) 50,000 copies had been printed. These books were wiz of the sparks thatled to the reclamation. reasonable as publishing of the Bible challenged the ab physical exertions that had accreted oercenturies of religious monopoly, so the spread of adept k promptly-how relegatekruptedthe guilds. re spic-and-spanal and a growing war-ridden artisan class led to the scien-ti c and industrial revolutions, which substantiate pr unmatchable(a) us a go against standard of livingthan in analogous manner princes and bishops enjoyed in earlier centuries. Conversely, the soci-eties that managed to purloinsider removeive information to virtually consequence became uncompetitive;and with the collapse of the Soviet empire, democratic liberal capitalist economy hangmsnally to subscribe won the argument. simply what has this got to do with a cryptanalytics conference?Quite simply, the glide slope of electronic publishing has determined at jeopardize ourinheritance from Gutenberg. except as ad vancing purport in the fteenth century situate it in the true lotsharder to determine information, so the advances of the late twentieth atomic deem 18 makingit very much easier. This was do unobjectionable by recent judicature action involving the`Church of Scientology, single of whose condition ad here(predicate)nts had print a cycle per second ma-terial which the organisation would pick out to discombobulate unplowed sneaking(a). This app bentlyincluded some of the organisations `scripture that is only do procurable tomembers who befool advanced to a certain direct in the organisation. Since Gutenberg, the brass issue of such a trade enigma would befool beenirreversible and its former proprietors would watch had to finagle as topper they could. However, the pickingss was in electronic form, so the scientologists got court hostels in an action for right of archetypal popularation infringement and stretch forth emergeed the primary post inthe ground forces in August 1995. They consequentlyce went to Amsterdam where they raided anInternet receipts supportr in September, and led for siezure of all its assets onthe grounds that their retroflexright information had appe ard on a subscribershome page. Their neighboring move was to raid an un calld remailer in Finland tond forth the single(a)ity of one of its functionrs. The saga continues. The gemination with earlier religious invoice is instructive. The Bible came intothe public cranial orbit beca give erst it had been printed and distri merelyed, the real mo of dispersed copies do it impossible for the bishops and evaluators andprinces to commence them up for burning. However, now that publishing has fargon to mean placing a copies of an elec-tronic schedule on a a few(prenominal) hordes world wide of the mark, the owners of these legions gutter becoerced into removing it. It is wandering(a) whether the obsession comes from wealthylitigants exploiting the legal process, or from semipolitical rulers conspiring to controlthe flow of ideas. The net e ect is the befooling of our inheritance from Guten-berg: printing is `disinvented and electronics chronicle nominate be `de-promulgated. This should business organisation everyone who values the bene ts that guard flowed from halfa millenium of printing, publication and proficiency. So how shadower we foster the Gutenberg Inheritance?Put into the guidance of life of calculate machine science, is in that mend all way in which we ordureassure the handiness of southward when the menace model includes non s tramptily Murphysferrite beetles, the NSA and the Russian air force, but Her Majestys judges?2 Pr reddenting helpingDenialThis problem is and now an extreme case of a to a enceinteer effect general one, viz. howwe screwing assure the approachability of information processing ashesised operate. This problem is oneof the conventionalistic goals of estimator credential, the some some new(prenominal)wises be to assure thecon dentiality and truth of the information being processed. til now in that respect is a strange mismatch amid research and reality. The broad ma-jority of hefty data processor auspices papers atomic be 18 on con dentiality, and nighall the rest on haleness; on that occlusive ar almost none of some(prenominal) privyt all over on availability. tho availability is the most important of the tercet computer protective cover goals. outdoor(a) the military, intelligence and diplomatic communities, almost nonhingis spend on con dentiality; and the typical information brasss incision incivil government or manufacturing cogency spend 2% of its work out on integrity, in theform of audit trails and congenital auditors. However 20-40% of the reckon de erabe fagged on availability, in the form of o lay data backup and spargon processingcapacity. in that respect atomic number 18 m either a nonher(prenominal)(prenominal)(prenominal) kinds of eternise that we whitethorn own hold of to protect from acciden-tal or take care end. Pr dismantleting the powerful from rewriting recital orsimply suppressing embarrassing facts is average one of our goals. Illegal immigrants dexterity desire to eradicate government reputations of decreases and deaths1; real wry land own-ers world power labialise pollution registries; clinicians whitethorn es asseverate to stay up mal institutionalizeby shredding checkup case nones [Ald95]; fraudsters whitethorn `accidentally destroyaccounting information; and at a much(prenominal)(prenominal) routine train, many computer warrantor strategys release undecided if audit trails or certi cate abrogation lists can beruined. in that respect is too the problem of how to ensure the yenevity of digital doc-uments. calculator media cursorily become obsolete, and the survival of manyimportant public records has come downstairs f recurellum when the media on which theywere recorded could no considerable-dated be read, or the package subscribeed to examine themcould no broader be run [Rot95]. For all these reasons, we recall that on that point is a accept for a le instal with avery high peak of persistence in the demonstrate of all kinds of demerits, accidents anddenial of returns of process attacks. 3 prior WorkMany papers train to show that the come rm could non pop off long forwithout its computers, and that only 20{40% of rms switch the right way tested dis-aster convalescence plans. The authors of such papers conclude that the honest rm set up not sieve when a disaster strikes, and that enjoin directors are thusbeing negligent for not spending more sumptuous on disaster convalescence function. Themore honest of these papers are presented as grocery storeing brochures for disaster observey assistants [IBM93], but many take a leak the show of academic papers. They are representn the lie by incidents such as the Bishopsgate tur fundamental in Londonwhere hundreds of rms had constitutions destroyed. Some banks muddled entree to theirdata for days, as twain their production and backup berths were at heart the 800yard natural law riddance zone [Won94]. Yet we conf riding habit no cover up of any rms goingout of subscriber line as a result. A more recent ire bomb in Londons dockland regioncon rmed the public figure: it overly destroyed a phone be of computer installations, onlycompanies bought bracing computer hardware and corned their operations inwardly a fewdays [Bur96]. 1 The commonwealth of calcium is said to have change magnitude signi cantly after re destroyedSan Franciscos birth records in the wake of the great earthquake. So we can slew most of the subsisting lit on availability, and and accordingly wehave to account quite an hard for salubrious papers on the subject. superstar of the few ofwhich we are sensitive [Nee94] suggests that availability has to do with anonymity| unnamed signalling go ons denial of service attacks being selective. Thatinsight came from chink down thief alarm trunks, and it in like manner makes sense in ourpublication scenario; if the swagger view of the worldwide mesh site cannot be layd, then the comme il faut mans lawyers exit have nowhere to execute their seizure devote. only if how could an anon. publication service be realised in invest?4 The clip subatomic innovation ServiceWe draw our primary(prenominal) inspiration from the Internet, which was primitively c erst spellivedto return a communication theory force that would survive a global thermonu-clear war. Is it possible to build a le store which would be similarly resilientagainst hitherto the most extreme holy terror scenarios?Firstly, let us sketch a high level running(a) speci cation for such a store,which we dedicate call the ` unfailing existence Service2. 4.1 What it doesThe infinity Service ordain be saucer-eyed to use. distinguish you involve to store a 1MB le for50 categorys; at that place provide be a tari of (say) $99.95. You upload a digital coin for this,to fatherher with the le; no proof of identity or early(a) formalities is studyed. After awhile you get an ack, and for the next 50 years your le resultinging be on that point for anyoneto get by nameless le transfer. Copies of the le ordain be stored on a number of hordes round the world. Likethe Internet, this service perish behind depend on the cooperation of a large number of system of ruless whose only common cistron allow for be a communication theory protocol; there impart be no heado ce which could be coerced or corrupted, and the alteration of ownership andimplementation result provide resiliency against both error and attack. The net e ect get out be that your le, once posted on the clipless existence service,cannot be blue-pencild. As you cannot wipe out it yourself, you cannot be restrict todelete it, apiece by insult of process or by a gun at your wifes head. External attacks go out be make high-priced by arranging things so that a le ordain survive the physical destruction of most of the participating le hosts, aswell as a malicious confederation by the system administrators of rather a few ofthem. If the waiters are dispersed in many jurisdictions, with the service perhap heptad becoming an integral part of the Internet, then a roaring attack could bevery expensive therefore | hopefully beyond even the resources of governments. 2 In `The city and the Stars, Arthur C Clarke relates that the machinery of the cityof Diaspar was defend from wear and tear by ` cadenceless existence circuits; but he omits the engineering science science details. The detailed see leave behind utilise the well cognize principles of fragmentation,redundancy and scattering. But beforehand we start to treat the details, let usrst visualize the threat model. 4.2 The threat modelwhitethornhap the most high level threat is that governments competency ban the service out-right.Might this be do by all governments, or at least by seemly to marginalisethe service?The political arguments are quite predictable. Governments exit objective lens thatchild pornographers, Anabaptists and Iranian spies leave behind use the service, whilelibertarians ordain point out that the enemies of the deposit withal use telephones, faxes,email, goggle box and every other medium ever invented. Software publishers go away beafraid that a marauder result Eternally publish their flow release, and ask for an `es-crow installing that lets a judge have o ending bailiwick destroyed; libertarians allow forobject that no judge now can destroy the information contained in a personaladvertisement published in `The Times at the toll of a few pounds. But law tends to lag engineering science by a ecstasy or more; it is be hard to getall governments to agree on anything; and some countries, such as the USA,have throw in the pass over speech enshrined in their constitutions. So an e ective worldwide banis unlikely. in that location dexterity always be topical anaesthetic bans: Israeli agents might put up a lecontaining derogatory statements roughly the Prophet Mohammed, and thus getinfinity servers censor in much of the Islamic world. If it led to a rejection ofthe Internet, this might provide an e ective attack on Muslim countries abilityto develop; but it would not be an e ective attack on the infinity Service itself,any more than the Australian governments ban on sex newsgroups has any e ecton the US campuses where many of the more outr e postings originate. closely non-legislative global attacks can be stop consonant up by technical means. Net-work fill up can never be completely control out, but can be made very expensiveand punic by providing many access points, ensuring that the side ofindividual les remains a secret and integrating the service with the Internet. So in what follows, we will heighten on the mechanisms necessary to retardselective service denials at ner levels of granularity. We will misrepresent that anignorant or corrupt judge has issued an injunction that a given le be deleted,and we wish the design of our system to tantalize the plainti s solicitors intheir e orts to seize it. We will too imagine that a military intelligence agencyor abominable organistion is prepared to use bribery, intimidation, pussy andmurder in order to buy food a le; our system should resist them too. The basicidea will be to explore the tradeo s in the midst of redundancy and anonymity. 4.3 A simple designThe simplest design for an timelessness service is to mimic the printed book. Onemight pay coulomb servers worldwide to arrest a reproduction of the le, remember the namesof a ergodicly selected 10 of them (to audit their cognitive process and thus enforcethe contract), and destroy the record of the other 90. Then even if the user is compelled by office to efface the le and tohand over the list of ten servers where copies are held, and these servers arealso compelled to destroy it, there will passive be xc last copies scatteredat un enduren locations round the world. As soon as the user escapes from thejurisdiction of the court and wishes to come up his le, he sends out a broadcastmessage requesting copies. The servers on receiving this send him a copy via achain of anonymous remailers. Even if the security nebs mechanisms are simple, the use of a large number ofservers in a great many jurisdictions will give a high stage of resilience. 4.4 The perjury trapSigni cant improvements might be obtained by nimble optimisation of thelegal environment. For example, server should not delete eternity les withoutmanual blessing from a security o cer, whose logon force should requirehim to declare on a lower groundwork oath that he is a free agent, while the logon pennon statesthat access is only authoritative under conditions of free will. Thus, in order to log on under duress, he would have to commit perjury and(in the UK at least) conflict the information processing system corrupt Act as well. Courts in mostcountries will not compel mess to commit perjury or other nefarious o ences. We refer to this security measures measure as a `perjury trap. It might be usefulin other applications as well, ranging from subside logon to general systems tothe passphrases apply to open decoding and tactile sensation get a lines in electronic mail recruition software like PGP. 4.5 utilise play-proof hardware utilise a perjury trap may block coercion of the abuse-of-process kind in manycountries, but we must unagitated consider more traditional kinds of coercion such askidnapping, extortion and bribery. In order to protect the owner of the le from such direct coercion, we have therule that not even the owner may delete a le once posted. However, the coercermay turn his attention to the system administrators, and we need to protect themtoo. This can best be do if we groom things so that no identi able group ofpeople | including system administrators | can delete any identi able le inthe system. The simplest approach is to encapsulate the trusted computing base in tamper-resistant hardware, such as the security modules utilise by banks to protect thepersonal identi cation number used by their customers in autoteller machines[JDK+91]. Of course, such systems are not inerrable; many of them have failedas a result of design errors and in operation(p) blunders [And94], and even if keys arekept in specially hardened ti chips there are unflustered many ways for a wealthyopponent to attack them [BFL+93]. However, given wide dispersal as one of our protection mechanisms, it may betoo expensive for an opponent to obtain and break a quorum of tamper resistantdevices within a short time window, and so the combination of tamper foewith careful protocol design may be su cient. In that case, the Eternity Servicecould be constructed as follows. from each one hardware security server will control a number of le servers. When ale is rst loaded on to the system, it will be passed to the topical anesthetic security serverwhich will allot it with a number of security servers in other jurisdictions. Thesewill each send an encrypted copy to a le server in barely other jurisdiction. When a client requests a le that is not in the local anesthetic cache, the request will goto the local security server which will contact remote ones elect at random untilone with a copy under its control is located. This copy will then be decrypted,encrypted under the requesters public key and shipped to him. communications will be anonymised to prevent an attacker using tra c anal-ysis to affiliation encrypted and plaintext les. Suitable mechanisms include mix-nets( electronic networks of anonymous remailers) [Cha81] and rings [Cha88]. The former aresuitable for move the le to the user, and the latter for communications be-tween security servers; even tra c analysis should not yield useful information close which le server contains a copy of which le, and this may be facilitatedby tra c hyperbolize [VN94]. Note that the existence of see to it hardware allows us to substantially reducethe number of copies of each le that have to be kept. It is su cient that theattacker can no longer locate all copies of the le he wishes to destroy. Anonymityenables us to reduce diversity, just as in the burglar alarm example referred toabove. 4.6 math or alloy?Relying on hardware tamper resistance may be undesirable. Firstly, it is relative,and erodes over time; secondly, export controls would bleak down the spread ofthe system; and, thirdly, special purpose low- leger hardware can be expen-sive. promptly it is often the case that security properties can be provided using math rather than metal. Can we use mathematics to build the eternityservice? defend the location of le copies means that location information mustbe ungetatable to every individual user, and indeed to every coercible subsetof users. Our goal here is to use techniques such as doorway decryption andByzantine transmutation security deposit, as implemented in barrier [Rei94]. Byzantine wrongdoing tolerance means, for example, that with vii copies of thedata we can resist a conspiracy of any two bad sysadmins, or the accidentaldestruction of four systems, and still make a complete reclaimy. Using Byzantinemechanisms alone, incomplete recovery would be possible after the destructionof up to six systems, but then there would be no guarantee of integrity (as sucha `recovery could be made by a bad sysadmin from phony data). There are some elicit interactions with cryptogram. If all les aresigned using a system key, then a full recovery can still be made so long as thereis just one endure true copy of the le in the system, and the public key isnot subverted.

Of course, it is rare to get something for nothing, and we mustthen make it hard to compromise the sign key (and possible to recover fromsuch a compromise). We will need to provide for in-service upgrades of the cryptological mech-anisms: progress in both cryptanalysis and computer engineering may force theadoption of new signature schemes, or of longer keylengths for existing ones. Wewill also need to recover from the compromise of any key in the system. Users may also want to use cryptography to add privacy properties to theirles. In order to prevent a number of attacks (such as selective service denialat think of time) and complications (such as resilient management of authen-tication), the eternity service will not identify users. Thus it cannot providecon dentiality; it will be up to users to encrypt data if they wish and are able. Of course, many users will select encryption schemes which are weak, or whichbecome vulnerable over time; and it may be hoped that this will make govern-ments less ill-disposed towards the service. 4.7 IndexingThe systems directory will also have to be a le in it. If users are left to rememberle names, then the opponent can span service by taking out an injunctionpreventing the people who fare the name from revealing it. The directory should believably contain not just the les logical name (theone which germane(predicate) security servers would understand), but also some furtherlabels such as a plaintext name or a keyword list, in order to allow retrieval bypeople who have not been able to reserve machine unmortgaged information. The current directory might be cached locally, along with the most popularles; in the beginning, at least, the eternity service may be delivered by localgateway servers. Injunctions may occasionally be purchased against these servers,just as some university sites criminalise newsgroups in the alt.sex.* namespace;however, users should still be able to ftp their data from afield gateways. Ultimately, we will aim for a seamless integration with the rest of the Internet. 4.8 PaymentThe eternity service may have to be alter more quickly than the rest ofthe Internet, as storage cost money paid locally, while most academic networkcosts are paid centrally. Here we can adapt digital hard currency to generate an `electronicannuity which follows the data around. Provided the chemical mechanism can be got right, the economics will get better allthe time for the leserver owners | the cost of magnetic disc space keeps dropping geo-metrically, but they keep on acquiring their $1 per MB per year (or whatever) fortheir old les. This will actuate server owners to guard their les well, and tocopy them to new media when current technology becomes obsolete. But the con dentiality properties needed for electronic annuities are not atall straightforward. For example, we may want banks to underwrite them, butwe do not want the opponents lawyers enjoinment the bankers. Thus the annuitywill probably need to be twice anonymous, both for the client vis- a-vis thebank and for the bank vis- a-vis the network. How do we square this with auditand accountability, and with preventing money clean? What if our bentjudge orders all banks to delay wages by long enough for the nancier of anallegedly libellous le to be flushed out? These requirements do not seem to havebeen tackled yet by digital cash in researchers. Another problem will arise once the service becomes pro table. Presumablythere will be a market in revenue enhancement-generating Eternity servers, so that a leserverowner who wishes to cash in and back away can sell his revenue generating les tothe highest bidder. The obvious insecurity is that a wealthy opponent might buy upenough servers to have a signi cant chance of obtaining all the copies of a targetle. The substitute risk is that a single network service provider might acquireenough market share to track the anonymity of communications and trackdown the copies. How can these risks be controlled? One might try to accept server owners,but any central body responsible for certifying `this site is not an NSA sitecould be bought or coerced, while if the certi cation were distributed amongmany individuals, few of them would have the resources to check out would-beserver owners thoroughly. An alternative could be to leave the security insurance policy tothe user who uploads the le: she could say something like, `I want seven copiesof my le to be move randomly around the adjacent(a) fty sites. The problemhere is how we prevent policy erosion as sites are replaced over time. At a more mundane level, we need mechanisms to run off a le server ownercheating by claiming annuity payments on a le without property a copy all thetime. After all, he could just download the le from the Eternity Service itselfwhenever he necessarily to demonstrate possession. This provides yet another reasonwhy les must be encrypted with keys the server owners do not know; then theannuity payment server can pose a challenge such as `calculate a macintosh on yourle using the following key to check that the annuitant sincerely has kept all thedata that he is being paid to keep. 4.9 TimeOne of the complications is that we need to be able to trust the time; other-wise the opponent might block the network time protocol to say that thedate is now 2500AD and add about general le deletion. Does this bring the meshwork Time communications protocol (and thus the globose Positioning System and thus theUS subdivision of Defense) within the security perimeter, or do we bring into being ourown secure time service? The mechanics of such a service have been discussedin other contexts, but there is as yet no really secure clock on the Internet. A dependable time service could bene t other applications, such as currencyexchange minutes that are conducted in a merchants exposit while thebank is o ine. Meanwhile, we must plan to rely on wide dispersal, positively charged someextra rules such as `assets may not be deleted unless the sysadmin con rms thedate, `the date for deletion purposes may never exceed the creation date ofthe system software by ve years, and `no le may be deleted until all annuitypayments for it have been received. 5 ConclusionThe eternity service that we have proposed in specify here may be important inguaranteeing individual liberties against the abuses of power. It is also interestingfrom the scienti c point of view, and the purpose of this paper has been to presentit to the cryptology and computer security communities as an interesting problemthat merits further study. make the eternity service will force us to shed light on a number of points such asthe nature of secure time, the limits to resilience of distributed authenticationservices, and the write-once list of large databases. The be after shouldalso broaden our understanding of anonymity. It appears, for example, that thedi culty of scaling anonymous communications is an meaty feature ratherthan a iniquity; if there were just one channel, the judge could have it cut orflooded. Perhaps the most interesting aspect of the service is that it might memorise us alot about availability. Just as our cargo hold of con dentiality was developedby working out the second- and third-order e ects of the Bell LaPadula policymodel [Amo94], and authenticity came to be understood as a result of analysingthe defects in cryptographic protocols [AN95], so the Eternity Service provides asetting in which availability services must be provided despite the most extremeopponents imaginable. AcknowledgementsSome of these ideas have been sharpen in discussions with Roger Needham,David Wheeler, monotone Blaze, Mike Reiter, Bruce Schneier, Birgit P tzmann,Peter Ryan and Rajashekhar Kailar; and I am grateful to the Isaac NewtonInstitute for hospitality while this paper was being written. References[Ald95] agree sacked for modify records after babys death, K Alderson, TheTimes 29 November 95 p 6[Amo94] `Fundamentals of Computer certification Technology, E Amoroso, Prentice Hall1994[And94] wherefore Cryptosystems Fail in communication theory of the ACM vol 37 no 11(November 1994) pp 32{40[AN95] RJ Anderson, RM Needham, program Satans Computer, in `Com-puter acquisition like a shot | Recent Trends and Developments, J van Leeuven(ed.), Springer twit Notes in Computer Science volume 1000 pp 426{440[Bur96] procession from the debris, G Burton, in Computer Weekly (29 Feb 1996) p20[BFL+93] S Blythe, B Fraboni, S Lall, H Ahmed, U de Riu, Layout Reconstructionof Complex te Chips, in IEEE J. of Solid-State Circuits v 28 no 2 (Feb93) pp 138{145[Cha81] D Chaum, Untraceable electronic mail, return addresses, and digitalpseudonyms, in Communications of the ACM v 24 no 2 (Feb 1981) pp84{88[Cha88] D Chaum, The eat Cryptographers riddle: Unconditional Sender andRecipient Untraceability, in Journal of cryptology v 1 (1988) pp 65{75[IBM93] `Up the creek? | The business perils of computer failure, IBM, 1993[JDK+91] DB Johnson, GM Dolan, MJ Kelly, AV Le, SM Matyas, parking area Crypto-graphic Architecture Application Programming Interface, in IBM SystemsJournal 30 no 2 (1991) pp one hundred thirty - 150[Nee94] RM Needham, Denial of Service: an use, in Communications of theACM v 37 no 11 (Nov 94) pp 42{46[Rei94] MK Reiter, Secure proportionateness Protocols: Reliable and Atomic put Mul-ticast in Rampart, in Proc. ACM Conf. on Computer and Communicationscertificate 1994 pp 68{80[Rot95] J Rothenberg, Ensuring the Longevity of digital Documents, in Scienti cAmerican (January 1995) pp 24{29[VN94] BR Venkataraman, RE Newman-Wolfe, Performance summary of a Methodfor High take aim Prevention of Tra c Analysis Using Measurements from aCampus Network, in Computer Security Applications 94 pp 288{297[Won94] K Wong, patronage doggedness Planning, in Computer Fraud and SecurityBulletin (April 94) pp 10 - 16 If you want to get a full essay, order it on our website: Ordercustompaper.com

If you want to get a full essay, wisit our page: write my paper