What would be an example of a routing protocol that preserves anonymity even if the Guard Node and Exit Node are both compromised

Question

I was reading a comment discussion on the answer to this question

Where it's basically revealed that large numbers of middle nodes do not provide any additional security if the Guard Node and Exit Node are compromised. Because analysis traffic (in particular correlating volume of data requested at the exit node vs transmitted at the guard node) can be used to deanonymize the user)

Are there any known onion-like protocols which allow you to maintain anonymity even if the Guard and Exit nodes are both compromised and cooperating, but the middle node(s) is(are) not.

What would be examples of some protocols?

Some Thinking:

This type of protocol would probably need to randomly junk data and sometimes remove this junk at a later time from node to node, so that packet analysis, and volume of data analysis could not be used to correlate data returning from the exit node vs the guard node. (I.E. the size of the data the Exit Node passes along should be made to very weakly correlate with the amount of data the Guard Node passes along to the user).

Answer 1

The method you mention of preventing traffic correlation attacks is generally called cover traffic. Sometimes it also makes sense to reorder the traffic as well, which is a network design often called mix networks or Chaum mixes. These techniques generally have the downsides of increasing latency and decreasing network capacity, so you need to be careful about how much cover traffic or mixing that you add.

You might find Loopix interesting to start with, and you may find other designs/techiques/analyses in the papers here: https://www.freehaven.net/anonbib/