  Anonymous data collection systems allow users to contribute the data
necessary to build services and applications while preserving their privacy.
Anonymity, however, can be abused by malicious agents aiming to subvert or to
sabotage the data collection, for instance by injecting fabricated data. In
this paper we propose an efficient mechanism to rate-limit an attacker without
compromising the privacy and anonymity of the users contributing data. The
proposed system builds on top of Direct Anonymous Attestation, a proven
cryptographic primitive. We describe how a set of rate-limiting rules can be
formalized to define a normative space in which messages sent by an attacker
can be linked, and consequently, dropped. We present all components needed to
build and deploy such protection on existing data collection systems with
little overhead. Empirical evaluation yields performance up to 125 and 140
messages per second for senders and the collector respectively on nominal
hardware. Latency of communication is bound to 4 seconds in the 95th percentile
when using Tor as network layer.
