Forgetting with Puzzles: Using Cryptographic Puzzles to support - - PowerPoint PPT Presentation

▶
forgetting with puzzles using cryptographic puzzles to
SMART_READER_LITE
LIVE PREVIEW

Forgetting with Puzzles: Using Cryptographic Puzzles to support - - PowerPoint PPT Presentation

Feb 06, 2024 233 likes •471 views

Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting Shujaat Mirza msm622@nyu.edu Cyber Security & Privacy Lab (CSP-lab) Digital Forgetting Right to Right to be Privacy Forgotten constitutes data

slide-1
SLIDE 1

Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting

Shujaat Mirza msm622@nyu.edu Cyber Security & Privacy Lab (CSP-lab)

slide-2
SLIDE 2

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Digital Forgetting

Right to Privacy Right to be Forgotten

≠

constitutes data that is not publicly available talks about revocation of public data after a certain point in time and no allowing third parties to access it further

2

slide-3
SLIDE 3

Forgetting with Puzzles; Amjad, Mirza and Pöpper

5 years of the Right to be Forgotten

Right to be forgotten was upheld by the European Court of Justice in Gonzalez’s vs Google:

  • The court ruled that search engines must remove links to pages that “appear to

be inaccurate, inadequate, irrelevant, or excessive in the light of the time that had elapsed” where requested by individuals.

[Source: http://ec.europa.eu/justice/data-protection/files/factsheets/factsheet_data_protection_en.pdf]

3

slide-4
SLIDE 4

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Right to be Forgotten: Google Case

[Source:- https://transparencyreport.google.com/eu-privacy/ & https://elie.net/blog/web/insights-about-the-first-three-years-of-the-right-to-be-forgotten-requests-at-google ]

4

3.1 M

5/2014-5/2019

slide-5
SLIDE 5

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Outline

  • 1. What is Digital Forgetting?
  • 2. Related Work
  • a. General Approach
  • 3. Our Contribution
  • a. Extension of Threat Model
  • b. Integration with Puzzles
  • c. Prototype Implementation and Results
  • 4. Conclusions

5

slide-6
SLIDE 6

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Related Work

Vanish 2009: DHTs EphPub 2011: DNS caches

Where to store the key(s)?

WPES 2012: Website encoding Neuralyzer 2016: DNS caches Ephemerizer 2005: centralized

6

slide-7
SLIDE 7

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Approach to Digital Forgetting

Encrypt locally Upload Distribute key 1 key bit → 1 node 1 node → 1 address B A C D Upload object

7

Ephemeral key storage

A D E 1 1 1 B C 1 1 1

[Apostolis Zarras, Katharina Kohls, Markus Dürmuth, Christina Pöpper: Neuralyzer: Flexible Expiration Times for the Revocation of Online Data. ACM Conference

  • n Data and Application Security and Privacy (ACM CODASPY),2016]
slide-8
SLIDE 8

Forgetting with Puzzles; Amjad, Mirza and Pöpper

1 1 1 B A C D

Approach to Digital Forgetting

Get encrypt. data Download B A C D Access nodes Recover key 1 1 1

8 [Apostolis Zarras, Katharina Kohls, Markus Dürmuth, Christina Pöpper: Neuralyzer: Flexible Expiration Times for the Revocation of Online Data. ACM Conference

  • n Data and Application Security and Privacy (ACM CODASPY),2016]
slide-9
SLIDE 9

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Outline

  • 1. What is Digital Forgetting?
  • 2. Related Work
  • 3. Our Contribution
  • a. Extension of Threat Model
  • b. Integration with Puzzles/Our Approach
  • c. Prototype Implementation with Neuralyzer and Results
  • 4. Conclusions

9

slide-10
SLIDE 10

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Threat Model

Retrospective privacy

10

GhousAmjad, Muhammad Shujaat Mirza, Christina Pöpper: Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting, ACM Conference on Data and Application Security and Privacy (ACM CODASPY),2018

slide-11
SLIDE 11

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Our Threat Model

Pre Expiry Attackers

  • Curious but non interfering
  • Interfering!
  • Affecting data on large scale

11

GhousAmjad, Muhammad Shujaat Mirza, Christina Pöpper: Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting, ACM Conference on Data and Application Security and Privacy (ACM CODASPY),2018

slide-12
SLIDE 12

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Our Approach

  • Make the large scale attacker spend some time on each data object!
  • Make it solve a puzzle
  • Only then can it access key storage addresses

12

  • Creator should be able to set the time needed to solve it
  • Should not be parallelizable
  • Self-Verifying

GhousAmjad, Muhammad Shujaat Mirza, Christina Pöpper: Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting, ACM Conference on Data and Application Security and Privacy (ACM CODASPY),2018

slide-13
SLIDE 13

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Time lock Puzzles

  • Time lock puzzle proposed by Rivest et al.
  • Based on repeated Squaring modulo N.
  • To lock with puzzle, we do...

B A C D

Encrypt with K

  • Puzzle Creation:

○ Encrypt key K using the process outlined by Rivest et al. ○ The process outputs Ck , a , b , N.

  • Puzzle Solution:

○ Square a , b times (sequential) modulo N (call this X) ○ Recover K = Ck- X

b determines the time spent on the puzzle!

13

GhousAmjad, Muhammad Shujaat Mirza, Christina Pöpper: Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting, ACM Conference on Data and Application Security and Privacy (ACM CODASPY),2018

slide-14
SLIDE 14

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Get encrypt. data Download B A C D

14

Our Approach

GhousAmjad, Muhammad Shujaat Mirza, Christina Pöpper: Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting, ACM Conference on Data and Application Security and Privacy (ACM CODASPY),2018

slide-15
SLIDE 15

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Get encrypt. data Download B A C D Solve the Puzzle

15

Our Approach

GhousAmjad, Muhammad Shujaat Mirza, Christina Pöpper: Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting, ACM Conference on Data and Application Security and Privacy (ACM CODASPY),2018

slide-16
SLIDE 16

Forgetting with Puzzles; Amjad, Mirza and Pöpper

1 1 1 B A C D Get encrypt. data Download B A C D Access nodes Solve the Puzzle

16

Our Approach

GhousAmjad, Muhammad Shujaat Mirza, Christina Pöpper: Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting, ACM Conference on Data and Application Security and Privacy (ACM CODASPY),2018

slide-17
SLIDE 17

Forgetting with Puzzles; Amjad, Mirza and Pöpper

1 1 1 B A C D

Our Approach

Get encrypt. data Download B A C D Access nodes Recover key 1 1 1 Solve the Puzzle

17

GhousAmjad, Muhammad Shujaat Mirza, Christina Pöpper: Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting, ACM Conference on Data and Application Security and Privacy (ACM CODASPY),2018

slide-18
SLIDE 18

Forgetting with Puzzles; Amjad, Mirza and Pöpper

More than One puzzle?

B A C D G H F E 1 1 1 B A C D 1 1 1 G H F E

Takes 2 seconds to solve Takes 30 seconds to solve

18

GhousAmjad, Muhammad Shujaat Mirza, Christina Pöpper: Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting, ACM Conference on Data and Application Security and Privacy (ACM CODASPY),2018

slide-19
SLIDE 19

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Outline

  • 1. What is Digital Forgetting?
  • 2. Related Work
  • 3. Our Contribution
  • a. Extension of Threat Model
  • b. Integration with Puzzles/Our Approach
  • c. Prototype Implementation with Neuralyzer and Results
  • 4. Conclusions

19

slide-20
SLIDE 20

Forgetting with Puzzles; Amjad, Mirza and Pöpper

20

Data Object Creation

GhousAmjad, Muhammad Shujaat Mirza, Christina Pöpper: Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting, ACM Conference on Data and Application Security and Privacy (ACM CODASPY),2018

slide-21
SLIDE 21

Forgetting with Puzzles; Amjad, Mirza and Pöpper

21

Data Object Decryption

GhousAmjad, Muhammad Shujaat Mirza, Christina Pöpper: Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting, ACM Conference on Data and Application Security and Privacy (ACM CODASPY),2018

slide-22
SLIDE 22

Forgetting with Puzzles; Amjad, Mirza and Pöpper

Conclusion | Questions

  • We outline a general use case for Crypto Puzzles to support Digital Forgetting.
  • The proposal extends the classical model to incorporate large scale attackers during pre

expiry times.

  • The system makes it hard to take snapshots, much harder to delete a lot of data but at

the same time keep user experience relatively smooth.

  • The system still ensures that data is no longer available after expiration.
  • Tested prototype implementation with Neuralyzer, a scheme that supports life

extension, with promising results

22

ShujaatMirza msm622@nyu.edu

GhousAmjad, Muhammad Shujaat Mirza, Christina Pöpper: Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting, ACM Conference on Data and Application Security and Privacy (ACM CODASPY),2018