FARB: Fast Anonymous Reputation-Based Blacklisting without TTPs

Anonymous blacklisting schemes that do not rely on trusted third parties (TTPs) are desirable as they can block misbehaving users while protecting user privacy. Recent TTP-free schemes such as BLACR and PERM present reputation-based blacklisting, for which the service provider (SP) can assign positive or negative scores to anonymous sessions and block users whose reputations are not high enough. Though being the state of the art in anonymous blacklisting, these schemes are heavyweight and only able to support tens of authentications per minute in practical settings. We present FARB, the first reputation-based blacklisting scheme which has constant computational complexity both on the SP and user side. FARB thus supports a reputation list with billions of entries and is efficient enough for heavy-loaded SPs with thousands of authentications per minute. On the user side, FARB is fast enough even for mobile devices and supports flexible rate-limiting. We also present a novel fine-grained weighted extension which allows the SP to ramp up penalties for repeated misbehaviors according to the severity of the misbehaving user's past sessions.