2.1.1 Study of tools for anonymous communication

The research and classification of the tools and methods that are currently used to control or maintain the anonymity of the user while browsing the network was carried out, followed by the grouping of these tools with respect to their field of implementation, obtaining the following areas:

It should be noted that there are currently additional tools to those described in this section, for the realization of this selection of tools the following characteristics were taken into account: Mainly anonymity and privacy, in terms of operation tools with their stable versions and with system support, in licensing issues, tools with free software license were considered, free tools in their basic version with the possibility of increasing your privacy characteristics by buying a plus version, these selected tools have a good basic version that complies with the requirements for a user to maintain their privacy and anonymity.

Tool evaluation criteria: The objective of these criteria is to ensure an appropriate evaluation of each of the tools presented above, the following criteria are based considering the objectives proposed in this research. First, the characteristics that each of the tools must have were defined, in this case they were the following: anonymity, flexibility, ARM compatibility ⁽⁶, costs and update period. Each tool has different specifications, and each specification has its corresponding value, that is, each characteristic provides a value that, when added together, finally generates the score for each tool. In the process of assigning values, it should be noted that the specifications of each characteristic are mutually exclusive except for the anonymity characteristic, which its specifications are inclusive depending on the tool, that is, a tool can comply with 1, 2, 3 or 4 anonymity specifications. Next, Table 1 shows the mentioned distribution

2.1.2 Results of the evaluation of tools

For the subsequent analysis of the results, the score obtained by each evaluated tool was transformed to its percentage value. These tools have 5 characteristics each one contributing with a maximum value established in the following way: Anonymity 5, because it’s the main feature of the project, the following characteristics are: flexibility 1, compatibility 1, costs 1 and update period 1 that contribute a total of 4, that is, the maximum value that a tool could obtain is 9 that corresponds to 100%. Finally, the percentage and qualitative assessment was carried out to classify each of the tools evaluated as shown in the following Table 1.

Next, Table 2 shows the results of the evaluation with the score obtained by each tool⁷ and its corresponding percentage value, as well as the tools ordered from highest to lowest score in their corresponding area.

Tool evaluation analysis: For this study, a total of 29 tools were evaluated, 11 of which turned out to be not compatible with the ARM architecture, these are shown shaded (gray) in Table 3 in the compatibility column with the value of 0.

For this reason, these tools were discarded for the development of this project; However, it should be noted that they are tools that provide a high level of anonymity, since they have been specifically designed with the aim of maintaining privacy on the network and are tools commonly used by people whose job or occupation requires the protection of their identity such as: journalists, politicians, government agents, among others.

Next, from Table 4, it can be seen how the Tor project is present in 2 of the 5 tools in the ranking (rows 1 and 2), taking into account that the Parrot operating system uses the Tor network internally to route its traffic; On the other hand, the presence of cryptographic methods that protect the content of the communication can be implicitly noticed, in addition they hide the true IP address of the user and protect the privacy of the communication route, finally, in the area called security of The network has the largest number of tools positioned in the top 5 (previous table 4) compared to the other areas, in other terms, network security 4 and anonymous operating systems 1.

As mentioned before, each tool was grouped depending on its implementation area, this was done because each of the tools provides privacy to a certain area of the user who browses through cyberspace⁸, in addition to this, each tool operates in a different way and provides a different level of anonymity, thinking about protecting each aspect of the user, the selection of the best tool by area was made as shown in the following Table 5, it should be remembered that the tools incompatible with the ARM architecture were discarded.

According to Table 5, for the parameters of this study and the requirements of this project, the set of tools presented, are the best option for a user to keep their identity anonymous on the network, in conclusion, to achieve anonymity it must be managed the security of each aspect or area involved in the communication since the smallest information leak can cause a domino effect that ultimately causes loss of private information or exposure of real user data. It should be noted that the selected tools have no financial cost for their implementation.

2.2.1 SBC device characterization

For the development of the solution of this research work it is desired to build a low-cost hardware prototype based on SBC devices⁹, for this reason a search was made of the devices that are currently on the market. It should be noted that all the devices classified are of RISC (Reduced Instruction Set Computer) architecture on which the ARM microprocessors are based, in addition the price value is an approximate that covers the cost of the device and its shipping as a reference, this classification was made with the devices offered until July 20, 2019.

2.2.2 Device evaluation results

For the analysis of the results, the score obtained from each device was transformed into its percentage value, in other words, each characteristic provides a maximum value of 1, therefore, the maximum score that a device could obtain is 6, which represents 100 %, for this study the devices with the highest percentage are those considered suitable for this research, finally, the percentage and qualitative assessment was established that classifies each of the devices evaluated as shown in the following Table 6. Next, Table 7 presents the evaluation and the results obtained by each device with its corresponding score and percentage valuation ordered from highest to lowest.

Device evaluation analysis: The objective of this study is to find the devices that best fit the project requirements, taking into account the following aspects: Performance: the device must have the ability to execute processes quickly and in parallel, in the same way it is obliged to load a complete operating system in addition to additional tools similar or equal to those presented in the previous study. Support: the device should have as much documentation and software support as possible, due to the diverse number of tools that have been developed with a focus on cybersecurity. Price: the device must have the lowest possible cost while maintaining a balance regarding the two aspects mentioned above.

The Raspberry pi¹⁰ foundation is currently an organization with years of experience dedicated to the production of SBC devices, among them are the Raspberry pi 3 and 4 devices that managed to position themselves in the top 5 of devices considered suitable for the implementation of the prototype (Table 8), also with very close scores followed by the Rock pi, Orange pi and Latte. panda devices manufactured by Chinese organizations that have several years dedicated to the creation of hardware solutions, in conclusion, any of the five devices presented above are considered a good choice and that meet the requirements of the project, also come from trusted entities with experience in the development of these hardware devices.

2.3.1 Results of the evaluation of operating systems

For the analysis of the results, the result of the score obtained from each operating system was transformed into its percentage value to easily and clearly manage the data obtained in the evaluation, in this way it is necessary that each characteristic contributes a maximum value of 1, for Therefore, the maximum score that an operating system could obtain is 5, which represents 100%, for this study the operating systems with the highest percentage are those considered suitable for the project, finally, the percentage and qualitative assessment that classifies each one of the systems evaluated as shown in the following Table 9. Next, Table 10 shows the evaluation and the results obtained by each operating system with its corresponding score and percentage valuation ordered from highest to lowest.

Analysis of the evaluation of operating systems: The objective of this study of operating systems is to identify which are the best options to be implemented in the final solution, all this taking into account the characteristics presented above that allow in the evaluation to maintain a balance between the performance of the hardware and the reliability of the operating system for implementation of this research work, below, Table 11 lists the 5 operating systems that obtained the best scores in the evaluation. With respect to the results obtained in the previous Table 11, the following statement can be extracted. The Debian operating system is implicitly shown as the best option to be implemented in the solution, since it is present in each of the operating systems except for Alpine Linux, which was developed based on other libraries, keeping in mind that Raspbian and DietPi They have been developed based on Debian Buster, finally Ubuntu Mate belongs to one of the many Debian distributions.

2.4.1 Security controls for network communications

Below are the controls that must be implemented to guarantee information security in a network communications environment according to the ISO 27002 standard of 2013¹¹. This standard is divided by 14 domains and 114 controls with their corresponding names, the domains refer to the area that is going to be managed and the controls are the guidelines that must be met to maintain the security of the information. Based on the objectives of this project, domains 10 and 13 apply, which refer respectively to cryptography and communications security.

OWASP IoT project

The OWASP Internet of Things Project¹², started in 2014, is designed to help manufacturers, developers and consumers better understand the security issues associated with IoT (Internet of Things), and to allow users in any context to make better security decisions by build, implement or evaluate IoT technologies, the most recent OWASP IoT testing guide corresponds to the OWASP IoT Top 10 of the year 2018¹². The project seeks to define a structure for several IoT sub-projects separated into the following 10 categories.

OWASP IoT Security Testing Guide

The guide below is at a basic level, giving device and app testers a set of guidelines to consider from their perspective. This is not an exhaustive list of considerations and should not be treated as such, but ensuring these fundamentals are covered will greatly enhance the security of any IoT product. The categories covered by the test are listed below: I1- Insecure web interface, I2- Insufficient authentication or authorization, I3- Insecure network services, I4- Lack of transport encryption, I5- Privacy concerns, I6- Cloud interface Insecure, I7- Insecure Mobile Interface, I8- Insufficient Security Configuration, I9- Insecure Software or Firmware, and I10- Bad Physical Security.

Study and evaluation of configurations for the prototype

Based on the results obtained in the three previous studies where tools, SBC devices and operating systems were evaluated, the configurations presented in the following Table 12 were elaborated, it is worth mentioning that these are only initial proposals to build the final solution, this because Compatibility problems between the operating system and the tools can probably arise, in addition it is intended to build a prototype that preserves a balance between hardware performance and its functionality given that there are limited machine resources due to each SBC device.

It is important to note that configuration 4 highlighted in light gray has a fixed configuration because Parrot as an operating system contains pre-configured tools by default, among them are the Tor network, Duck duck go, Onionshare, Tor browser and ZuluCrypt, in addition, it contains some few tools that were presented in section 2.1.1 study of tools for anonymous communication and a great variety of additional tools related to security, anonymity, pentesting, among other areas.

2.4.2 Evaluation of configurations

Configuration evaluation criteria

The following criteria were established to determine which of all is the appropriate configuration to continue with the construction of the prototype, taking as a reference the requirements of this investigation. First, the characteristics with which each configuration must comply were defined, in this case they were the following: Anonymity, Performance, Protected Area and OWASP IoT. Each configuration has its specifications, and each specification has its corresponding value, that is, each characteristic contributes a value that when added together finally generates the score for the configuration. It should be noted that in the anonymity characteristic its specifications are inclusive depending on the selected configuration. In other words, a configuration can meet A1, A2, A3, or A4 specifications for that characteristic.

Anonymity has 4 specifications that in this case evaluate the security of the area called "Network Security" and correspond to the same specifications established in the study of tools. The Protected Area has 5 specifications that correspond to the remaining 5 areas (excluding "Anonymous operating systems") in other words it is the number of areas that the configuration protects. The Performance corresponds to the RAM memory resources (including buffer and cache) that each configuration needs to keep the operating system running with its anonymity tools in its active or working state, in other terms, the greater the available memory space, the greater it is. the score, it is necessary to clarify that all these memory tests were carried out using the same hardware device, for these tests, the "most limited case" of the top 3 devices was selected, that is, the Raspberry Pi 3 board because it is the device with the lowest RAM capacity (1GB) compared to the other devices.

With this "more limited case" it was verified that it’s possible to execute each of the configurations. The OWASP IoT characteristic corresponds to the tests developed by the OWASP IoT project, the configurations were evaluated considering each of the tests established in the OWASP IoT project, that is, the value obtained by a configuration is given by the total amount of tests passed, the total number of OWASP IoT tests is 50 and in this case each test passed contributes 0.1 to the final value. Next, Table 13 shows the mentioned distribution

Results of the configuration evaluation

For the analysis of these results, the score obtained for each configuration evaluated was transformed to its percentage value to classify it as shown in the following Table 13, for this evaluation 5 characteristics presented previously were determined, each one providing a maximum value established for the following form: Anonymity 5, Protected Area 5, Performance 5 and OWASP IoT 5, that is to say that the maximum value that a configuration could obtain is 20 which corresponds to 100%, with this assessment it is possible to determine what configuration or configurations are appropriate for this project, maintaining a balance between its main characteristic, which is anonymity, the areas that it manages to anonymize and the performance of the CPU, since SBC devices have limited hardware capabilities, and must also pass the largest number of tests designed, by the OWASP IoT project, for this type of project or prototype. Finally, we proceed with the percentage and qualitative assessment to classify each of the configurations evaluated as shown in the following Table 13.

Next, Table 14 presents the results of the evaluation with the score obtained for each configuration and its corresponding percentage value, as well as the tools ordered from highest to lowest score in their corresponding area.

Configuration analysis and selection: With respect to the data presented in Table 15, the following conclusions can be drawn: In the Anonymity characteristic, when adding their values for each configuration, it is obtained that C2 and C4 achieve the best score (4.5) compared to the other configurations (4.2), this is because C2 and C4 use Tor as an anonymity service for the network compared to the others that use a VPN, this score is higher thanks to the extra protection that the Tor network has by managing to hide the communication path and use an encryption system that allows to protect the communication content with its original location in a better way than the VPN, in addition with the Protected Area feature it can be noticed as the C2 and C4 configurations because of its operating system allow to protect all areas that may be vulnerable to the user (score 5).

The above is presented as a disadvantage when compared to the Performance feature where C2 and C 4 have the lowest score in this column, this is because C1 and C3 (i.e. Raspbian Buster Lite and DietPi) are systems specifically designed to make optimal use of the machine resources of the SBC device, because of this the system has some limitations of use that do not allow protecting all areas of a user's communication as seen in the Protected Area column where C1 and C3 obtained low scores, additionally these limitations also affected their scores obtained in the OWASP IoT column where they could not be apply many of the tests due to the absence of interface (categories I1 and I7).

Finally, the configuration chosen to continue with the development of the project was C2, which obtained the highest score as seen in Table 15, then this configuration C2 is presented with its corresponding tools.