And Then There Richard Li University of Utah Were More: Christos - - PowerPoint PPT Presentation

▶
and then there
SMART_READER_LITE
LIVE PREVIEW

And Then There Richard Li University of Utah Were More: Christos - - PowerPoint PPT Presentation

Nov 21, 2023 296 likes •727 views

David Naylor Carnegie Mellon And Then There Richard Li University of Utah Were More: Christos Gkantsidis Microsoft Research Secure Communication for More Than Two Parties Thomas Karagiannis Microsoft Research Peter Steenkiste Carnegie

slide-1
SLIDE 1

And Then There Were More:

Secure Communication for More Than Two Parties

David Naylor

Carnegie Mellon

Thomas Karagiannis

Microsoft Research

Christos Gkantsidis

Microsoft Research

Peter Steenkiste

Carnegie Mellon

Richard Li

University of Utah

slide-2
SLIDE 2
slide-3
SLIDE 3

Web Cache Compression Proxy Intrusion Detection System Virus Scanner Parental Filter Load Balancer

In most networks,

# middleboxes ≈ # routers

[Making Middleboxes Someone Else’s Problem. SIGCOMM ’12]

slide-4
SLIDE 4

In most networks,

# middleboxes ≈ # routers Encryption blinds middleboxes.

slide-5
SLIDE 5

Encryption blinds middleboxes.

Goal: Encryption + Middleboxes

# middleboxes ≈ # routers

slide-6
SLIDE 6

1

Design Space

For secure, multi-entity communication protocols

Goal: Encryption + Middleboxes

2

mbTLS

A deployable protocol for

  • utsourced

middleboxes.

slide-7
SLIDE 7

There’s a big design space for secure, multi-entity

communication protocols

slide-8
SLIDE 8

New Security Properties

2

Other Properties

3

There’s a big design space for secure, multi-entity

communication protocols

Extend TLS Security Properties

1

slide-9
SLIDE 9

Data Secrecy Data Authentication Entity Authentication

Extend TLS Security Properties 1

1 2 3

slide-10
SLIDE 10

Granularity of Data Access

Headers Body Headers

vs Definition of “Party” vs Definition of “Identity” vs

Extend TLS Security Properties 1

slide-11
SLIDE 11

New Security Properties

Granularity of Data Access

Headers Body Headers

vs

Definition of “Party”

vs

Definition of “Identity”

vs

Other Properties

3 1 2

Extend TLS Security Properties

slide-12
SLIDE 12

Authorization Path Integrity Data Change Secrecy

1 2 3

New Security Properties 2

slide-13
SLIDE 13

Granularity of Data Access

Headers Body Headers

vs

Definition of “Party”

vs

Definition of “Identity”

vs

Path Integrity

1 2 3

Data Change Secrecy Authorization

2 New Security

Properties

1

Extend TLS Security Properties

3

Other Properties

slide-14
SLIDE 14

Computation Legacy Endpoints In-Band Discovery

v1.2 Arbitrary Limited

vs

Other Properties 3

slide-15
SLIDE 15

Granularity of Data Access

Headers Body Headers

vs

Definition of “Party”

vs

Definition of “Identity”

vs

Path Integrity

1 2 3

Data Change Secrecy Authorization Legacy Endpoints

v1.2

In-Band Discovery Computation Arbitrary Limited vs

New Security Properties

2 1

Extend TLS Security Properties

3

Other Properties

slide-16
SLIDE 16

There’s a big design space for secure, multi-entity

communication protocols

New Security Properties

2 1

Extend TLS Security Properties

3

Other Properties

slide-17
SLIDE 17

There’s a big design space for secure, multi-entity communication protocols

There is no one-size-fits-all solution.

slide-18
SLIDE 18

There’s a big design space for secure, multi-entity communication protocols There is no one-size-fits-all solution.

Supporting one property

  • ften precludes another.
slide-19
SLIDE 19

Supporting one property

  • ften precludes another.

v1.2

vs

Supports

two legacy endpoints

Prevents

endpoint authentication (owner or code)

TLS interception with custom root certificates

slide-20
SLIDE 20

Supporting one property

  • ften precludes another.

v1.2

Supports

fine-grained data access

Prevents

legacy support

Multi-Context TLS (mcTLS)

Headers Body Headers

vs

[SIGCOMM ’15]

slide-21
SLIDE 21

Supporting one property

  • ften precludes another.

Supports

functional crypto (minimal data access)

Prevents

arbitrary computation

BlindBox

Headers Body Headers

vs

Arbitrary Limited vs

[SIGCOMM ’15]

slide-22
SLIDE 22

There’s a big design space for secure, multi-entity communication protocols There is no one-size-fits-all solution.

Supporting one property

  • ften precludes another.
slide-23
SLIDE 23

There’s a big design space for secure, multi-entity communication protocols

There is no one-size-fits-all solution.

Supporting one property

  • ften precludes another.
slide-24
SLIDE 24

1

Design Space

For secure, multi-entity communication protocols

Goal: Encryption + Middleboxes

2

mbTLS

A deployable protocol for

  • utsourced

middleboxes.

slide-25
SLIDE 25

mbTLS targets two common- case, real-world needs

1

Immediate deployability

Interoperate with one legacy endpoint

2

Protection for outsourced middleboxes

Protect session data from middlebox infrastructure

(in addition to traditional network attackers)

slide-26
SLIDE 26

mbTLS targets two common- case, real-world needs

Residential ISP Upgraded Server Server-Side Proxy Legacy Clients Legacy Endpoint

1

Outsourced Middlebox

2

slide-27
SLIDE 27

mbTLS targets two common- case, real-world needs

Cloud Compute Provider Upgraded Client Client-Side Proxy Legacy Servers Legacy Endpoint

1

Outsourced Middlebox

2

slide-28
SLIDE 28

mbTLS targets two common- case, real-world needs

1

Immediate deployability

Interoperate with one legacy endpoint

2

Protection for outsourced middleboxes

Protect session data from middlebox infrastructure

(in addition to traditional network attackers)

slide-29
SLIDE 29

2

Protection for outsourced middleboxes

Protect session data from middlebox infrastructure

(in addition to traditional network attackers) Client R/W access Server R/W access Middlebox Infrastructure No access Middlebox Software R/W access Everyone Else No access

slide-30
SLIDE 30

mbTLS targets two common- case, real-world needs

1

Immediate deployability

Interoperate with one legacy endpoint

2

Protection for outsourced middleboxes

Protect session data from middlebox infrastructure

(in addition to traditional network attackers)

slide-31
SLIDE 31

Primary TLS Connection Secondary TLS Connection

A first approach: pass primary session key over secondary TLS session

Supports legacy endpoints ✔ Data and keys visible in RAM ✗

slide-32
SLIDE 32

1 2

Secure Execution Environment Remote Attestation

Program code, data, and stack encrypted. Prove to remote party that is working.

1

An aside:

Intel SGX

slide-33
SLIDE 33

Primary TLS Connection Secondary TLS Connection

A first approach: pass primary session key over secondary TLS session

Supports legacy endpoints ✔ Data and keys visible in RAM ✗

slide-34
SLIDE 34

SGX Enclave

TLS Handshake + Attestation

mbTLS protects session data and keys using SGX

Supports legacy endpoints ✔ Data and keys encrypted in RAM ✔ Primary TLS Connection

slide-35
SLIDE 35

On-path middleboxes can be discovered “on-the-fly”

ClientHello + MiddleboxSupportExtension ServerHello MiddleboxAnnouncement + MboxHello

[ ]

MbtlsEncap

slide-36
SLIDE 36

Per-hop keys provide path integrity and data change secrecy

Original session key “bridges” client- and server-side middleboxes.

slide-37
SLIDE 37

Evaluation

1

What overheads does mbTLS introduce?

From SGX? From crypto?

2

Is mbTLS immediately deployable?

Will existing network devices drop mbTLS handshake messages?

slide-38
SLIDE 38

SGX doesn’t have much impact on I/O+compute-intensive workloads

512 1K 2K 4K 8K 12K Record Size (Bytes) 2 4 6 8 10 Throughput (Gbps) No Enclave Enclave

slide-39
SLIDE 39

Server 0.0 0.5 1.0 1.5 2.0 2.5 Server Computation Time (ms) TLS (no mbox) mbTLS (1 server mbox) mbTLS (2 server mboxes) mbTLS (3 server mboxes)

mbTLS adds some handshake CPU overhead on the server

TLS

no mbox

mbTLS

1 mbox

mbTLS

2 mbox

mbTLS

3 mbox

slide-40
SLIDE 40

mbTLS’ handshake protocol changes are deployable today

??

Drop handshake?

No handshakes were dropped.

6

enterprise

networks

34 residential

networks

2 mobile

networks

11 university

networks

35

colocation

networks

1

public

network

56 hosting

networks

19

data center

networks

77

unlabeled

networks

slide-41
SLIDE 41

And Then There Were More:

Secure Communication for More Than Two Parties

David Naylor

Carnegie Mellon

Thomas Karagiannis

Microsoft Research

Christos Gkantsidis

Microsoft Research

Peter Steenkiste

Carnegie Mellon

Richard Li

University of Utah