In this lesson, we present a hidden service provided by the Tor network. You should see the descriptions of the paper by Chetverikov appear in 2013 in the prestigious conference, IEEE Security and Privacy. 2004 Tor introduce a new service called hidden service, so that any user can hide their server behind a set of Tor circuit and this add what we call responder anonymity to the Tor. So specifically, hidden service allow anyone to run Internet service like web server, HS access server and so on, so that the client service do not know where the server actually located, the actual IP address of the server. This is achieved by routing all the communication between client and hidden service through a rendezvous point, RP. And which connect between anomaly circuit from the client and also anomaly circuit from the server. The RP node serve to exchange the messages back and forth in the two channel to the two hidden circuit. First the hidden service provider, as you see in the diagram here, select a set of Tor decoyed introduction point. And second step, it publish those introduction point to a hidden service directory server. Step 3, anyone in Internet as a client can query this hidden service HS directory server to find out and pick one of the introduction point for the particular server. Step number 4, the client will select a Tor relay as the rendezvous point, RP. So client actually choosing the RP. And then through this introduction point tell the server hidden service here is the IP I'm going to use as RP. And then Step 5, the client will send this IP address to the IP. Step 6, IP then relays the request back to hidden server. Step 7, hidden server establishes a circuit to RP and start the client and hidden server communications. Chetverikov et all find that by sending 50 package cell, a unique kind of padding cell pattern, followed by a destroyed cell, control messages, from attacker client, they find out if they can somehow inject a lot of their adversary relay node into the Tor network. If any of their cells detect, there's a unique parent coming through exactly downstream with 52 cell to this hidden service server, and then to cell upstream to the circuit. Then they uniquely identify their relay cell is actually one half above the entry target, entry guard, relayed to all the client, just one half above. So they for now trying 794,000 kind of circuit, and only find none, this is very unique and never happen in the other kind of circuit situations. So this is a unique signature, it can be launching by the malicious client and try to identify where is the entry guard of a particular hidden service. And once they find out this entry guard entry node, they can fraud it and do the sniper attack on this entry guard, until the hidden service say, all my entry guard are busy or they are disabled, I better choose another set of relay node. And so as long as the entry guard node has been chosen, happen to belong to the adversary, now whatever coming out from the hidden service are compromised, right? Because they first know it's watching all the packets coming through.