Can Mesh Networks Survive Large Crowds?

A decentralized networking technology originally built for battlefields and Burning Man is today being reimagined from the ground up.

Mesh networks—named for their fishnet-like connections—emerged over the past few decades from rigorous, mathematical research on keeping data flowing even when portions of a system fail. But the theory hasn’t always matched up to reality. Real-world mesh networks have proved vulnerable to shutdowns in some of the very settings, such as certain kinds of large crowds, they’re supposed to be good at handling.

So researchers from Johns Hopkins University, Harvard, and the City College of New York have recently built a prototype mesh networking system that’s been hardened for some of the most challenging and adversarial environments around: political protests.

In a paper presented last week at the ACM Conference on Computer and Communications Security in Taipei, the researchers announced a prototype mesh network called Amigo. Amigo, for starters, has been designed to work in environments where the Internet has been shut off, as seen during unrest in India, Iraq, and Syria, among other countries.

“Shutting down the internet during times of great civil protest is a way to prevent people from being able to organize and come together,” says Tushar Jois, assistant professor of electrical engineering at City College. “That is what we’re specifically tailoring our technology for.”

Amigo proposes at least three ways to bolster the more traditional approaches to mesh networks. Recent scholarship on mesh outages in protest scenarios reveals problems such as network messages failing to deliver, appearing out of order, and exposing users to being traced—even if the nodes in the network (e.g. phones running the mesh app) are right next to each other. The researchers found that prying beneath the mesh network’s high-level, encrypted communications and down into nuts-and-bolts Wi-Fi operations revealed opportunities that previous mesh networks had failed to seize on.

“The story is the cryptography alone won’t save us,” says Jois. Jois and colleagues presented a version of their Amigo paper earlier this year at the Real World Cryptography conference in Sofia, Bulgaria.

Why Political Protests Matter in Mesh Networks

Amigo drew key lessons from a set of studies on mesh networking in a range of recent political protests—including Hong Kong pro-democracy actions in 2019 and ’20.

For example, how previous mesh networks handled routing of their messages could accidentally lead to a flooding of the zone. Multiple nodes in a stressed network can pump out redundant messages into the network, causing communications to grind to a crawl. By contrast, Amigo forms what the researchers call dynamic “cliques”—where only designated leader nodes exchange messages with each other, while regular nodes just talk to their leader. This technique, the researchers say, substantially reduces message traffic, decreasing the chance the network might seize up.

“We’re one of the people to discover that in secure mesh messaging, we’ve had this blind spot,” Jois says. “So we proposed some new algorithms that help address this blind spot. Dynamic clique routing basically allows groups of nodes to self-organize routing units in a geographic area based on GPS.”

Another example is Amigo’s approach to cryptography and anonymity. Previous mesh environments provided no easy way to remove members from encrypted groups. (In a protest setting, group removal might be necessary, for instance, because a device or its user has been apprehended by authorities.) Older mesh standards also leaked metadata that could reveal other group members. Amigo aims to correct both problems.

“One thing we talk about is outsider anonymity,” Jois says. “People who are outside your group don’t know that the group exists.” Amigo, he says, adds new algorithms to ensure outsider anonymity and group removal. Jois adds that Amigo aims to achieve these goals while still retaining protections of existing encrypted-message networks like WhatsApp and Signal.

Traditionally, Jois adds, encrypted messaging provides a couple of important features. One feature involves protecting past messages: via “forward secrecy,” even if keys are stolen today, past messages are still secure. The other involves protecting future messages: via “post-compromise security,” even a compromised system can heal by generating new keys and thus locking an intruder out of future communications. Amigo retains both features.

“We add [our new protections] to the classic forward secrecy and post-compromise security,” Jois says. “But maybe there are more properties that we need from a security perspective. So I think juggling all of those will be fun.”

Diogo Baradas, assistant professor of computer science at the University of Waterloo in Canada, adds that Amigo could find applications beyond political protests.

“Another scenario where such crowd dynamics are of particular interest include natural disaster scenarios— like flooding, fires, and earthquakes—where Internet communications may become unavailable,” says Baradas, who is not on the Amigo team. “And affected citizens, first-responders, and volunteers must coordinate to ensure a fitting response.”

Developers have built the Amigo mesh network around mathematical models of crowds that are based on studies of real-world crowds. Cora Ruiz

Today’s Mesh Networks Know Nothing About Crowds

A final, real-world reality check on mesh standards emerges from a new study of how mesh networks handle crowds.

Cora Ruiz is a graduate student in Jois’s Security, Privacy and Cryptographic Engineering Lab at City College. She’s been investigating the “random walk”-style approach to modeling crowds in most mesh network environments.

Like nitrogen and oxygen molecules in a sample of air, individual mesh nodes today are typically imagined to each trace random paths whose motions are uncorrelated to nearby nodes. If this, Ruiz says, is how mesh networks mathematically model crowd behavior, then no wonder mesh networks seize up in certain real-world environments.

“There’s really no understanding of the way that protesters are physically moving in these mass civil protests,” Ruiz says of traditional mesh models of crowd behavior. “And without having that understanding of the way that people move and what drives the movement, what it looks like on any level, it’s going to be nearly impossible to develop a really tailored solution.”

So instead, Ruiz is exploring ways to bring models of what she calls psychological crowds into mesh network algorithms.

“Psychological crowds are a concentration of people in a place that have a certain shared sense of self,” she says. “And that shared sense of self can directly impact the way that people move. They tend to move closer together. They don’t tolerate as much distance being put in between one another. They move slower.”

Jois says developing more realistic mathematical models of psychological crowds is a cross-disciplinary effort. It’s part math, and it’s part sociology and group psychology. “[Ruiz’s] current work is about determining communications dynamics and [group] dynamics by going to protest activists and journalists—in these places where internet shutdowns are common—and figuring out what are their needs,” he says.

“Since mesh is so heavily impacted by physical movement and traffic patterns,” Ruiz adds, “Having a strong understanding is key to furthering Amigo and other future mesh messaging tools.”

Jois adds that Amigo drew as inspiration for its crowd models a document created in 2019 by Hong Kong pro-democracy protesters, advising fellow activists how to march and gather. From that and other studies that could help devise mathematical models of real-world crowd movements, Jois says Amigo represents an important next step toward bringing mesh networks into the real world.

“Our results show that there is like some foundational work necessary in mesh networking,” Jois says. “We can stand in our academic spaces and say, ‘Oh well, this is what we think is necessary.’ But unless we get that from the source, we don’t know.”