Custos A Flexibly Secure Key-Value Storage Platform Andy Sayler - - PowerPoint PPT Presentation

▶
custos
SMART_READER_LITE
LIVE PREVIEW

Custos A Flexibly Secure Key-Value Storage Platform Andy Sayler - - PowerPoint PPT Presentation

Nov 02, 2023 390 likes •2.39k views

Custos A Flexibly Secure Key-Value Storage Platform Andy Sayler www.andysayler.com University of Colorado, Boulder Masters of Science Computer Science Trust Who do we trust with our data? Today... Feature Provider Features Feature

slide-1
SLIDE 1

Custos

A Flexibly Secure Key-Value Storage Platform

Andy Sayler www.andysayler.com University of Colorado, Boulder Masters of Science Computer Science

slide-2
SLIDE 2

Trust

slide-3
SLIDE 3

Who do we trust with our data?

slide-4
SLIDE 4

Today...

slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7

Feature Provider

Features

slide-8
SLIDE 8

Feature Provider

Features Trust

slide-9
SLIDE 9

Feature Provider

Features User Data Trust

slide-10
SLIDE 10

Feature Provider

User Data Unrestricted Access Trust Features

slide-11
SLIDE 11

Conflicts of Interest Lack of Control Absence of Oversight

slide-12
SLIDE 12

So you don’t use cloud services...

slide-13
SLIDE 13
slide-14
SLIDE 14
slide-15
SLIDE 15
slide-16
SLIDE 16
slide-17
SLIDE 17
slide-18
SLIDE 18

How can we control and protect our data?

slide-19
SLIDE 19

Encryption

slide-20
SLIDE 20

TXkgU2VjcmV0 “My Secret” Encrypt Decrypt

slide-21
SLIDE 21

How does it help us?

slide-22
SLIDE 22
slide-23
SLIDE 23

X

slide-24
SLIDE 24

But what about the keys?

slide-25
SLIDE 25

X

?

slide-26
SLIDE 26

X

slide-27
SLIDE 27
slide-28
SLIDE 28

Key Management Challenges

slide-29
SLIDE 29

Multi-Device Sync

slide-30
SLIDE 30
slide-31
SLIDE 31
slide-32
SLIDE 32
slide-33
SLIDE 33
slide-34
SLIDE 34
slide-35
SLIDE 35
slide-36
SLIDE 36

X

slide-37
SLIDE 37

Out-of-Band Sharing

slide-38
SLIDE 38
slide-39
SLIDE 39
slide-40
SLIDE 40
slide-41
SLIDE 41
slide-42
SLIDE 42
slide-43
SLIDE 43

X

slide-44
SLIDE 44

Autonomous Access

slide-45
SLIDE 45
slide-46
SLIDE 46
slide-47
SLIDE 47
slide-48
SLIDE 48
slide-49
SLIDE 49

X X

slide-50
SLIDE 50

The Cloud

slide-51
SLIDE 51

Feature Provider

User Data Unrestricted Access Trust Features

slide-52
SLIDE 52

Feature Provider

Features Encrypted User Data

slide-53
SLIDE 53

Feature Provider

No Access Features Encrypted User Data

X

slide-54
SLIDE 54

Feature Provider

No Access Encrypted User Data

X

slide-55
SLIDE 55

Encryption is broken

slide-56
SLIDE 56

Lack of key access

slide-57
SLIDE 57

X

slide-58
SLIDE 58

X

slide-59
SLIDE 59

Feature Provider

No Access Features Encrypted User Data

X

slide-60
SLIDE 60

Lack of flexibility

slide-61
SLIDE 61

X X

slide-62
SLIDE 62

Security Accessibility

slide-63
SLIDE 63

Security Accessibility Traditional Encryption Systems Fixed Point

slide-64
SLIDE 64

Ill-suited for Modern Application Difficult to Use Doesn’t Solve the Real Problem

slide-65
SLIDE 65

Encryption is broken

slide-66
SLIDE 66

Encryption is fine

slide-67
SLIDE 67

Encryption is fine Key storage is broken

slide-68
SLIDE 68

To fix key storage...

slide-69
SLIDE 69

Flexibility Centralization

slide-70
SLIDE 70

Flexibility

slide-71
SLIDE 71

Security Accessibility Flexible Encryption Systems Flexible Points

slide-72
SLIDE 72

X X

slide-73
SLIDE 73
slide-74
SLIDE 74

Centralization

slide-75
SLIDE 75

Feature Provider

User Data Trust Features Unrestricted Access

slide-76
SLIDE 76

Feature Provider

Trust Features User Data

slide-77
SLIDE 77

Feature Provider

Trust Features

Trust Provider

User Data

slide-78
SLIDE 78

Feature Provider

Encrypted User Data Trust Features

Trust Provider

Encryption Keys

slide-79
SLIDE 79

Feature Provider

Encrypted User Data Trust Features

Trust Provider

Encryption Keys Controlled Access

slide-80
SLIDE 80

Feature Provider

Encrypted User Data Controlled Access By Proxy Trust Features

Trust Provider

Encryption Keys Controlled Access

slide-81
SLIDE 81

Feature Provider

Encrypted User Data Trust Features

Trust Provider

Encryption Keys Controlled Access

Data Host

slide-82
SLIDE 82

Custos

slide-83
SLIDE 83

“Secret Storage as a Service”

slide-84
SLIDE 84

“Key Storage as a Service”

slide-85
SLIDE 85

Central Key:Value Storage Flexible Access Control Access Auditing

slide-86
SLIDE 86

Custos Server

slide-87
SLIDE 87

Custos Server

Key:Value Store

slide-88
SLIDE 88

Custos Server

Key:Value Store Management Subsystem Auditing Subsystem Data Subsystem

slide-89
SLIDE 89

Custos Server

Authentication Subsystem Key:Value Store Management Subsystem Auditing Subsystem Data Subsystem

slide-90
SLIDE 90

Custos Server

Authentication Subsystem Key:Value Store Management Subsystem Auditing Subsystem Data Subsystem

Auth Plugins

slide-91
SLIDE 91

Custos Server

Access Control Subsystem Authentication Subsystem Key:Value Store Management Subsystem Auditing Subsystem Data Subsystem

Auth Plugins

slide-92
SLIDE 92

Custos Server

API Access Control Subsystem Authentication Subsystem Key:Value Store Management Subsystem Auditing Subsystem Data Subsystem

Auth Plugins

slide-93
SLIDE 93

Custos Server System A

Application Custos API

System B

Application Custos API API

System C

Application Custos API Access Control Subsystem SSL Authentication Subsystem Key:Value Store Management Subsystem Auditing Subsystem Data Subsystem

Auth Plugins

slide-94
SLIDE 94

Application Domains

slide-95
SLIDE 95

File Systems

slide-96
SLIDE 96

Encrypted File System

System B System A

Encrypted File System Local Key Store Msg A Doc B Msg A Doc B Local Key Store Alice Bob

X

Mail Daemon

Password Auth Trusted Collaborators

X

Password Auth Password Auth

X

Networked or Cloud File System

slide-97
SLIDE 97

Encrypted File System

System B System A

Encrypted File System Networked or Cloud File System Msg A Doc B Msg A Doc B Alice Bob Mail Daemon

Trusted Collaborators Password Auth P a s s w

  • r

d A u t h

Trust Provider

Custos Key Store

Contextual Auth

slide-98
SLIDE 98

Data Centers

slide-99
SLIDE 99

VM Instance A

SSH Users Server User

SSH Login Server Verification

slide-100
SLIDE 100

SSH Users

VM Instance A

SSH Users Server User

SSH Login

Destroy

VM Instance A

Server

Server Verification

slide-101
SLIDE 101

SSH Users

VM Instance A

SSH Users Server User

SSH Login

Destroy

VM Instance A

Server

VM Instance B

SSH Users Server Create

?

User

Server Verification SSH Login Server Verification

X X

slide-102
SLIDE 102

VM Instance A

SSH User

SSH Login

Users

Server Verification

Custos Key Store

Key Access

Server Custos Client

slide-103
SLIDE 103

SSH

VM Instance A

SSH User

SSH Login

Destroy

VM Instance A

Custos Client Users

Server Verification

Custos Key Store

Key Access

Server Custos Client

slide-104
SLIDE 104

SSH

VM Instance A

SSH User

SSH Login

Destroy

VM Instance A

Custos Client

VM Instance B

SSH Users Create User

Server Verification SSH Login Server Verification

Custos Key Store

Key Access

Server Custos Client

Key Access

Custos Client

slide-105
SLIDE 105

Password Management Personal Data Storage ...

slide-106
SLIDE 106

Custos Design

slide-107
SLIDE 107

Organizational Units

slide-108
SLIDE 108

Server

slide-109
SLIDE 109

Group A Group B

Server

slide-110
SLIDE 110

Group A

Object 1

Server

Object 2 Object 3

Group B

Object 4 Object 5 Object 6

slide-111
SLIDE 111

Group A

Object 1

Server

Object 2 Object 3

Key Value Key Value Key Value

Group B

Object 4 Object 5 Object 6

Key Value Key Value Key Value

slide-112
SLIDE 112

Group A

Object 1

Server

Object 2 Object 3

ACS Key Value Key Value Key Value ACS ACS ACS ACS

Group B

Object 4 Object 5 Object 6

ACS Key Value Key Value Key Value ACS ACS ACS

slide-113
SLIDE 113

Access Control Specification (ACS)

slide-114
SLIDE 114

Organizational Unit (OU)

slide-115
SLIDE 115

Access Control Specification (ACS)

Organizational Unit (OU)

slide-116
SLIDE 116

Access Control Specification (ACS)

Organizational Unit (OU)

Permission A

slide-117
SLIDE 117

Access Control Specification (ACS)

Organizational Unit (OU)

Permission A

Access Control Chain

slide-118
SLIDE 118

Access Control Specification (ACS)

Organizational Unit (OU)

Permission A

Access Control Chain Auth Attribute Auth Attribute Auth Attribute

slide-119
SLIDE 119

Access Control Specification (ACS)

Key:Value Object

Permission A

Access Control Chain Auth Attribute Auth Attribute Auth Attribute

slide-120
SLIDE 120

Access Control Specification (ACS)

Key:Value Object

Read Permission

Access Control Chain Auth Attribute Auth Attribute Auth Attribute

slide-121
SLIDE 121

Access Control Specification (ACS)

Key:Value Object

Read Permission

Access Control Chain Username IP Address Password

slide-122
SLIDE 122

Access Control Specification (ACS)

Key:Value Object

Read Permission

Access Control Chain

Update Perm.

Access Control Chain IP Address Username Username IP Address Password

slide-123
SLIDE 123

Access Control Specification (ACS)

Key:Value Object

Read Permission

Access Control Chain Access Control Chain Username User Cert

Update Perm.

Access Control Chain IP Address Username Username IP Address Password

slide-124
SLIDE 124

Permissions

slide-125
SLIDE 125

Server

slide-126
SLIDE 126

Group

slide-127
SLIDE 127

Object

slide-128
SLIDE 128

Access Control Chain

slide-129
SLIDE 129

Ordered List of Authentication Attributes

slide-130
SLIDE 130

[ [ (username = ’Andy’), (password = ’12345’), (src_ip = 192.168.1.0/24) ] ]

slide-131
SLIDE 131

Multiple Lists per Permission

slide-132
SLIDE 132

[ [ (username = ’Andy’), (password = ’12345’), (src_ip = 192.168.1.0/24) ], [ (username = ’Andy’), (password = ’12345’), (src_ip = 75.148.118.216/29) ], [ (username = ’John’), (password = ’Swordfish’) ] ]

slide-133
SLIDE 133
slide-134
SLIDE 134

Authentication Attributes

slide-135
SLIDE 135

Plugins

slide-136
SLIDE 136

Explicit ip_src user_agent auth_type auth_value time_utc ... Implicit user_id psk psk_sha256 ...

slide-137
SLIDE 137

Access Example

slide-138
SLIDE 138

619a06f0-50af-11e3-8f96-0800200c9a66 ACS {

  • bj_read:

[ [ (ip\_src = ’1.2.3.4’), (time\_utc = ’1300 +/- 5’) ], [ (user\_id = ’Dirk’), (psk = ’ImaHakzor’) ] ... ] ... }

slide-139
SLIDE 139

Daemon Access

slide-140
SLIDE 140

Server

Daemon Process Encrypted File System Custos API

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification Access Control Encryption Key Store

slide-141
SLIDE 141

Request: 619a06f0-50af-11e3-8f96-0800200c9a66 Authentication Attributes: (ip_src = ‘1.2.3.4’) (time_utc = ‘1303’)

slide-142
SLIDE 142

Server

Daemon Process Encrypted File System Custos API

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification Access Control Encryption Key Store

slide-143
SLIDE 143

Server

Daemon Process Encrypted File System Custos API

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification Access Control Encryption Key Store

slide-144
SLIDE 144

{

  • bj_read:

[ [ (ip\_src = ’1.2.3.4’), (time\_utc = ’1300 +/- 5’) ], [ (user\_id = ’Dirk’), (psk = ’ImaHakzor’) ] ... ] ... }

slide-145
SLIDE 145

Server

Daemon Process Encrypted File System Custos API

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification Access Control Encryption Key Store

slide-146
SLIDE 146

Request: 619a06f0-50af-11e3-8f96-0800200c9a66 Authentication Attributes: (ip_src = ‘1.2.3.4’) (time_utc = ‘1303’)

slide-147
SLIDE 147

Server

Daemon Process Encrypted File System Custos API

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification Access Control Encryption Key Store

slide-148
SLIDE 148

Server

Daemon Process Encrypted File System Custos API

Custos Server

API Encryption Key Store Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification Access Control

slide-149
SLIDE 149

User Access

slide-150
SLIDE 150

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification

Laptop

Dirk Encrypted File System Custos API Access Control Encryption Key Store

slide-151
SLIDE 151

Request: 619a06f0-50af-11e3-8f96-0800200c9a66 Authentication Attributes: user_id = Dirk (ip_src = ‘1.2.3.4’) (time_utc = ‘1133’)

slide-152
SLIDE 152

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification

Laptop

Dirk Encrypted File System Custos API Access Control Encryption Key Store

slide-153
SLIDE 153

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification

Laptop

Dirk Encrypted File System Custos API Access Control Encryption Key Store

slide-154
SLIDE 154

{

  • bj_read:

[ [ (ip\_src = ’1.2.3.4’), (time\_utc = ’1300 +/- 5’) ], [ (user\_id = ’Dirk’), (psk = ’ImaHakzor’) ] ... ] ... }

slide-155
SLIDE 155

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification

Laptop

Dirk Encrypted File System Custos API Access Control Encryption Key Store

slide-156
SLIDE 156

Request: 619a06f0-50af-11e3-8f96-0800200c9a66 Authentication Attributes: user_id = Dirk (ip_src = ‘1.2.3.4’) (time_utc = ‘1133’)

slide-157
SLIDE 157

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification

Laptop

Dirk Encrypted File System Custos API Access Control Encryption Key Store

slide-158
SLIDE 158

{

  • bj_read:

[ [ (ip\_src = ’1.2.3.4’), (time\_utc = ’1300 +/- 5’) ], [ (user\_id = ’Dirk’), (psk = ’ImaHakzor’) ] ... ] ... }

slide-159
SLIDE 159

Request: 619a06f0-50af-11e3-8f96-0800200c9a66 Authentication Attributes: user_id = ‘Dirk’ psk = ‘ImaHackzor’ (ip_src = ‘1.2.3.4’) (time_utc = ‘1133’)

slide-160
SLIDE 160

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification

Laptop

Dirk Encrypted File System Custos API Access Control Encryption Key Store

slide-161
SLIDE 161

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification

Laptop

Dirk Encrypted File System Custos API Access Control Encryption Key Store

slide-162
SLIDE 162

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification

Laptop

Dirk Encrypted File System Custos API Access Control Encryption Key Store

slide-163
SLIDE 163

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification

Laptop

Dirk Encrypted File System Custos API Access Control Encryption Key Store

slide-164
SLIDE 164

Custos Server

API Authentication Attributes Source IP Verification Time Verification User ID Verification PSK Verification

Laptop

Dirk Encrypted File System Custos API Access Control Encryption Key Store

slide-165
SLIDE 165

API

slide-166
SLIDE 166

RESTful

slide-167
SLIDE 167
slide-168
SLIDE 168

Prototype

slide-169
SLIDE 169

Custos Server

API Access Control Subsystem Authentication Subsystem Key:Value Store Management Subsystem Auditing Subsystem Data Subsystem

Auth Plugins

slide-170
SLIDE 170

Custos Server System A

Application Custos API

System B

Application Custos API API

System C

Application Custos API Access Control Subsystem SSL Authentication Subsystem Key:Value Store Management Subsystem Auditing Subsystem Data Subsystem

Auth Plugins

slide-171
SLIDE 171

Base Filesystem (ext4) EncFS (fuse)

File (Encrypted) [On Disk] libcustos

  • penSSL

encrypt decrypt File (Decrypted) [In Memory]

User Custos Server

User’s Computer Trust Provider

write read write read Enc Key Enc Key ACS ACS

slide-172
SLIDE 172

“Banking” Website User Custos Server

Corporate Server Trust Provider

SSN UUID

Web Browser

ACS ACS User Data User Data requests flask Data Fields

slide-173
SLIDE 173

Custos Management Interface

requests

User Custos Server

Trust Provider

Web Browser

flask OU Query Enc Key Enc Key ACS ACS

Management Server

ACS ACS User Data User Data

slide-174
SLIDE 174

Future Work

slide-175
SLIDE 175

Expand Prototypes Usability Studies Distributed Usage ...

slide-176
SLIDE 176

Conclusion

slide-177
SLIDE 177

Attempt to solve the Key Storage Problem

slide-178
SLIDE 178

Provides a Secret Storage Service

slide-179
SLIDE 179

With... Flexible Authentication Powerful Access Control Standardized Interface

slide-180
SLIDE 180

Making Encryption... Tolerant of Modern Uses Cases Easier to Use Better at Protecting Our Data

slide-181
SLIDE 181

Questions

slide-182
SLIDE 182

Extra Slides

slide-183
SLIDE 183

Avoiding a Trusted Third Party

slide-184
SLIDE 184

Shamir’s Secret Sharing

slide-185
SLIDE 185

Provider D Provider C Provider B

Custos Key Store

Provider A

Custos Key Store Custos Key Store Custos Key Store Private Key Client Application Private Key Attacker

?

slide-186
SLIDE 186

Full Stack File Systems

slide-187
SLIDE 187

System B System A

Msg A Doc B Msg A Doc B Alice Bob Mail Daemon

Trusted Collaborators

Cloud Storage Service

X

Distributed Encrypted File System (with Internal Key Store) Out-of-Band Sharing

X X

Password Auth Password Auth Password Auth

slide-188
SLIDE 188

Password Auth

System B System A

Msg A Doc B Msg A Doc B Alice Bob Mail Daemon

Trusted Collaborators

Cloud Storage Service Distributed Encrypted File System Out-of-Band Sharing

Contextual Auth

Trust Provider

Custos Key Store

P a s s w

  • r

d A u t h

slide-189
SLIDE 189

Example “Create” API Call

slide-190
SLIDE 190

Authentication Attributes (JSON) [ { "Class": "explicit", "Type": "user_id", "Value": "YXNheWxlcgA=", "Echo": true }, { "Class": "explicit", "Type": "psk", "Value": "TXlPYmplY3RDcmVhdGlvblBhc3N3b3JkA A==", "Echo": false } ]

slide-191
SLIDE 191

Request URL POST https://custos.net/grp/cc4273ae-4e1e-11e3-90d4- 10bf487b3e94/obj?aa=%5B%20%7B%20%22Class%22%3A%20% 22explicit%22%2C%20%22Type%22%3A%20%22user_id%22%2C% 20%22Value%22%3A%20%22YXNheWxlcgA%3D%22%2C%20% 22Echo%22%3A%20true%20%7D%2C%20%7B%20%22Class%22%3A% 20%22explicit%22%2C%20%22Type%22%3A%20%22psk%22%2C% 20%22Value%22%3A%20% 22TXlPYmplY3RDcmVhdGlvblBhc3N3b3JkAA%3D%3D%22%2C%20% 22Echo%22%3A%20false%20%7D%20%5D

slide-192
SLIDE 192

Request Body (JSON) { "Keys": [ { "Value": "VHdhcyBicmlsbGlnLC BhbmQgdGhlIHNsaXRo eSB0b3ZlczsgRGlkIG d5cmUgYW5kIGdpbWJs ZSBpbiB0aGUgd2FiZQ A=", "Echo": true } ], ...

slide-193
SLIDE 193

Request Body (JSON) - Continued ... "ACSs": [ { "Permissions": { "obj_delete": null, "obj_read": [ [ { "Class": "explicit", "Type": "user_id", "Value": "YXNheWxlcgA=", "Echo": true } ] ] ...

slide-194
SLIDE 194

Response (JSON) { "Status": "okay", "Keys": [ { "Value":"VHdhcyBicmlsbGlnLC BhbmQgdGhlIHNsaXRo eSB0b3ZlczsgRGlkIG d5cmUgYW5kIGdpbWJs ZSBpbiB0aGUgd2FiZQ A=", "Echo": true, "Revision": 0, "UUID": "7af8c95d-479a...", "Status": "accepted" } ], ...

slide-195
SLIDE 195

Response (JSON) - Continued ... "ACSs": [ { "Permissions": { "obj_delete": null, "obj_read": [ [ ... ] ] ... }, "Echo": true, "Status": "accepted" } ], ...

slide-196
SLIDE 196

Response (JSON) - Continued ... "Attrs": [ { "Class": "explicit", "Type": "user_id", "Value": "YXNheWxlcgA=", "Echo": true, "Status": "accepted", "ResValue": null }, ...

slide-197
SLIDE 197

Filesystem References Kubiatowicz, et. al. OceanStore. ASN 2000. Kallahalla, et. al. Platus. FST 2003. Wilcox-O’Hearn, et. al. Tahoe. SSS 2008. Mahajan, et. al. Depot. TCS 2011. Geambasu, et. al. Keypad. EuroSys 2011.

slide-198
SLIDE 198

Usability References Whitten & Tygar. Why Johnny Can’t

  • Encrypt. USENIX Security. 1999
  • Anderson. Why information security is hard.
  • CSAC. 2001
  • Furnell. Usability versus Complexity.

Network Security. 2010

slide-199
SLIDE 199

Crypto References Diffie & Hellman. New directions in

  • cryptography. IEEE Trans. on IT. 1976
  • Shamir. How to share a secret.

Comm ACM. 1979.

  • Schneider. Applied Cryptography. 1996

Denning & Branstad. A Taxonomy for Key Escrow Encryption Sys. Comm ACM. 1996