SLIDE 1
Privacy as a Service
Raymond Cheng
Build practical cloud services that protect user privacy from powerful threats
2
Privacy as a Service Raymond Cheng Build practical cloud services - - PowerPoint PPT Presentation
Privacy as a Service Raymond Cheng Build practical cloud services - - PowerPoint PPT Presentation
Privacy as a Service Raymond Cheng Build practical cloud services that protect user privacy from powerful threats 2 3 Powerful Threats to User Privacy Organized Crime Nation-State Actors 4 Powerful Threats to User Privacy Gather
SLIDE 2
SLIDE 3
3
SLIDE 4
Powerful Threats to User Privacy
4
Nation-State Actors Organized Crime
SLIDE 5
Powerful Threats to User Privacy
5
Nation-State Actors Organized Crime
Gather Intelligence Covert Surveillance Cyberwarfare Corporate Espionage Influence Politics Censor content . . .
SLIDE 6
6
Annual Operating Expenses
SLIDE 7
7
Annual Operating Expenses
SLIDE 8
8
SLIDE 9
9
We have a moral responsibility to build technology to protect human rights and freedoms
SLIDE 10
Threat Model
10
Clients Network Cloud
SLIDE 11
Networks are vulnerable
11
Clients Malicious Network Censorship, surveillance, misdirection Cloud
SLIDE 12
Cloud services are routinely hacked
12
Malicious Clients Hackers Cloud Malicious Network Censorship, surveillance, misdirection
SLIDE 13
Governments can compel cooperation
13
Malicious Cloud Data requests, surveillance, control Malicious Clients Hackers Malicious Network Censorship, surveillance, misdirection
SLIDE 14
14
Malicious Cloud Malicious Clients Malicious Network
What security model can protect users from powerful threats?
SLIDE 15
Encryption not sufficient
15
Malicious Cloud Malicious Clients Malicious Network
TLS Encrypted at rest
SLIDE 16
Overview
16
Malicious Clients
- 2. Radiatus - harden web applications
from external intrusion Malicious Network
- 1. uProxy - censorship circumvention
SLIDE 17
Overview
17
Malicious Cloud
- 3. Oblivious Cloud Services
Talek - private publish-subscribe Malicious Clients
- 2. Radiatus - harden web applications
from external intrusion Malicious Network
- 1. uProxy - censorship circumvention
SLIDE 18
Overview
18
Malicious Cloud
- 3. Oblivious Cloud Services
Talek - private publish-subscribe
(Cheng, Scott, Parno, Zhang, Krishnamurthy, Anderson, 2016)
Malicious Clients
- 2. Radiatus - harden web applications
from external intrusion
(Cheng, Scott, Ellenbogen, Howell, Roesner, Krishnamurthy, Anderson, 2016)
Malicious Network
- 1. uProxy - censorship circumvention
Deployed to thousands over the world
(Cheng, Scott, Dixon, Krishnamurthy, Anderson, 2016)
SLIDE 19
Collaborators
Students: Irene Zhang Paul Ellenbogen Elizabeth Wei Bonnie Pan
19
Tom Anderson Arvind Krishnamurthy Franzi Roesner Will Scott Jon Howell Lucas Dixon Bryan Parno Nick Martindell Tariq Yusuf Caylan Lee Nicholas Shahan
SLIDE 20
Overview
20
Malicious Cloud
- 3. Oblivious Cloud Services
Talek - private publish-subscribe Malicious Clients
- 2. Radiatus - harden web applications
from external intrusion Malicious Network
- 1. uProxy - censorship circumvention
SLIDE 21
Internet Censorship is a Pervasive Problem
21
Censored Country
SLIDE 22
Evading Censorship with Centralized Proxies
22
Proxy Censored Country
SLIDE 23
Evading Censorship with Centralized Proxies
23
Proxy Problem with Centralized Proxies
- Trust: users need to trust proxy
proxy needs to trust users
- Scale: easy to find and block
Censored Country
SLIDE 24
24
SLIDE 25
Do-It-Yourself Censorship Circumvention
25
Censored Country
SLIDE 26
Do-It-Yourself Censorship Circumvention
26
Censored Country
- Trust: Explicit consent between friends
- Scale: Trivially easy to install and operate proxy
SLIDE 27
27
SLIDE 28
28
uProxy Usage https://www.uproxy.org
SLIDE 29
Overview
29
Malicious Cloud
- 3. Oblivious Cloud Services
Talek - private publish-subscribe Malicious Clients
- 2. Radiatus - harden web applications
from external intrusion Malicious Network
- 1. uProxy - censorship circumvention
SLIDE 30
Websites Vulnerable to Hacking
30
Trust the cloud provider Want to prevent external attacks
- Craft arbitrary network packets
SLIDE 31
Traditional Architecture
31
Trusted Computing Base Client User A User B User C User D User E User F User G ... Hacker
SLIDE 32
Traditional Architecture
32
Global Application Logic + Access Control + Authentication Sockets Global Application Logic + Access Control + Authentication Sockets Global Application Logic + Access Control + Authentication Sockets Trusted Computing Base Client User A User B User C User D User E User F User G
... ...
Load Balancer Hacker
SLIDE 33
Traditional Architecture
33
Global Database Memcache Global Application Logic + Access Control + Authentication Sockets Global Application Logic + Access Control + Authentication Sockets Global Application Logic + Access Control + Authentication Sockets Trusted Computing Base Client User A User B User C User D User E User F User G
... ...
Load Balancer Hacker
SLIDE 34
Traditional Architecture
34
Global Database Memcache Global Application Logic + Access Control + Authentication Sockets Global Application Logic + Access Control + Authentication Sockets Global Application Logic + Access Control + Authentication Sockets Trusted Computing Base Client User A User B User C User D User E User F User G
... ...
Load Balancer Hacker
SLIDE 35
Radiatus Shared-nothing server-side architecture for strongly isolating users in web applications
- Sandboxed user containers for code and data
- Limit impact of unknown vulnerabilities
35
SLIDE 36
Radiatus
36
Radiatus API Radiatus API Radiatus API Trusted Computing Base Client User A User B User C User D User E User F User G
... ...
User Router + Auth Sandboxed application logic B C D E F G H I A Hacker
SLIDE 37
Radiatus
37
Database Memcache Radiatus API Radiatus API Radiatus API Trusted Computing Base Client User A User B User C User D User E User F User G
... ...
User Router + Auth Sandboxed application logic Guard Guard B C D E F G H I A Hacker
SLIDE 38
Radiatus
38
Database Memcache Radiatus API Radiatus API Radiatus API Trusted Computing Base Client User A User B User C User D User E User F User G
... ...
User Router + Auth Guard Guard B C D E F G H I A Sandboxed application logic Hacker
SLIDE 39
Radiatus Results
Benefits:
- Scales linearly
- Prevents most severe web-related vulnerabilities
Trade-offs:
- Additional cost: ~$0.008 / user-year
- Programmability of explicit message passing
39
https://github.com/freedomjs/radiatus
SLIDE 40
Overview
40
Malicious Cloud
- 3. Oblivious Cloud Services
Talek - private publish-subscribe Malicious Clients
- 2. Radiatus - harden web applications
from external intrusion Malicious Network
- 1. uProxy - censorship circumvention
SLIDE 41
Trusted Cloud
Cloud Global Application Logic Global Storage
41
Client User Input Render View
Safeguarding security
SLIDE 42
Untrusted Cloud
Cloud Global Application Logic Global Storage
42
Client User Input Render View
What if we don’t trust the cloud?
SLIDE 43
Untrusted Cloud
Cloud
43
Client Per-user application logic Per-user storage User Input Render View
What do we need the cloud to do?
SLIDE 44
Untrusted Cloud
Cloud Send data between users Backup/sync storage Analytics
44
Client Per-user application logic Per-user storage User Input Render View
What do we need the cloud to do?
SLIDE 45
the Vision of Oblivious Cloud Services
Cloud Send data between users Backup/sync storage Analytics
45
Client Per-user application logic Per-user storage User Input Render View
Service Application Library
Sees random noise Sends requests Receives responses
SLIDE 46
the Vision of Oblivious Cloud Services
Cloud Send data between users Backup/sync storage Analytics
46
Client Per-user application logic Per-user storage User Input Render View
Service Application Library
Sees random noise Sends requests Receives responses
Cloud services that are secure by design
SLIDE 47
Talek: a Private Publish-Subscribe Protocol
47
SLIDE 48
Publish-Subscribe
48
Chat 1:message 2:message 3:message Newsfeed 1: image 2: tweet 3: video Calendar 1: new event 2: delete event 3: update Game 1: playerA move 2: playerB move 3: playerA move IoT 1: config lights 2: security video 3: set temp
SLIDE 49
Encryption protects the content...
49
Chat 1:message 2:message 3:message Newsfeed 1: image 2: tweet 3: video Calendar 1: new event 2: delete event 3: update Game 1: playerA move 2: playerB move 3: playerA move IoT 1: config lights 2: security video 3: set temp
SLIDE 50
… but communication patterns are exposed
50
Journalist Source Collaborator Activist Activists
SLIDE 51
New York Times Source
51
Thread 1:message 2:message 3:message Country X Country Y Alice Source Bob Journalist
SLIDE 52
New York Times Source
52
Country X Country Y Alice Source Bob Journalist Thread 1:message 2:message 3:message
SLIDE 53
New York Times Source
53
Thread 1:message 2:message 3:message Country X Country Y Alice Source Bob Journalist Relay
SLIDE 54
New York Times Source
54
Thread 1:message 2:message 3:message Country X Country Y Alice Source Bob Journalist Relay
SLIDE 55
Talek
55
Private publish-subscribe (pub/sub) system for sharing data through untrusted clouds
- Hide both contents and communication patterns
- Made practical using oblivious logging
and private notifications
- System with 3-4 orders of magnitude better
performance than closest related work
SLIDE 56
Security Goal: Indistinguishability
56
Any two access sequences from a client look indistinguishable to the adversary
SLIDE 57
Security Goal: Indistinguishability
57
Randomness Randomness Randomness Randomness Randomness Randomness Randomness Randomness Randomness Randomness Randomness Randomness Any two access sequences from a client look indistinguishable to the adversary
SLIDE 58
Talek Goals
58
Security Goal: Indistinguishability Any two access sequences from a client look indistinguishable to the adversary Systems Goals:
- Mobile-friendly: 1 message per request/response
- Efficient: Thousands of online users sending a message every 5 seconds
- General Purpose: messaging and newsfeeds
- Low latency: ~5-10s
SLIDE 59
Limitations
59
Country X Country Y Country Z Country W
- Any unavailable cloud will prevent access
- Host in widely used cloud providers
SLIDE 60
Anytrust Threat Model
60
Country X Country Y Country Z Country W
- Application configured with >1 independent clouds
- Clouds logging everything about users
At least 1 non-colluding
SLIDE 61
Talek Threat Model
61
Mutually distrusting users Anytrust: At least 1 non-colluding Trusted groups
SLIDE 62
Private Information Retrieval (PIR)
62
Client Read bucket 2 q’=[0,0,1,0,0]
B4 B3 B2 B1 B0 B4 B3 B2 B1 B0 B4 B3 B2 B1 B0
(Chor,1998)
SLIDE 63
Private Information Retrieval (PIR)
63
Client Read bucket 2 q’=[0,0,1,0,0]
B4 B3 B2 B1 B0 B4 B3 B2 B1 B0 B4 B3 B2 B1 B0
q0=[1,1,1,0,1] q1=[1,0,1,0,0] Random Random
SLIDE 64
Private Information Retrieval (PIR)
64
Client Read bucket 2 q’=[0,0,1,0,0]
B4 B3 B2 B1 B0 B4 B3 B2 B1 B0 B4 B3 B2 B1 B0
q0=[1,1,1,0,1] q1=[1,0,1,0,0] q2=[0,1,1,0,1] =q’⊕q0⊕q1
SLIDE 65
Private Information Retrieval (PIR)
65
Client
B4 B3 B2 B1 B0 B4 B3 B2 B1 B0 B4 B3 B2 B1 B0
q0=[1,1,1,0,1] q1=[1,0,1,0,0] q2=[0,1,1,0,1] =q’⊕q0⊕q1 B0⊕B1⊕B2⊕B4 B0⊕B2 B1⊕B2⊕B4
SLIDE 66
Private Information Retrieval (PIR)
66
Client B0⊕B1⊕B2⊕B4⊕B0⊕B2⊕B1⊕B2⊕B4 = B2
B4 B3 B2 B1 B0 B4 B3 B2 B1 B0 B4 B3 B2 B1 B0
q0=[1,1,1,0,1] q1=[1,0,1,0,0] q2=[0,1,1,0,1] =q’⊕q0⊕q1 B0⊕B1⊕B2⊕B4 B0⊕B2 B1⊕B2⊕B4
SLIDE 67
PIR Limitations
67
- Expensive: Read requires scan of database
- Equal-sized buckets
- Consistent snapshots across all servers
- Read-only
SLIDE 68
Client Indistinguishability
68
PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR
SLIDE 69
Talek Overview
69
publish() write queue subscribe() read queue Client Write Read libtalek Application
SLIDE 70
Talek Overview
70
publish() write queue subscribe() read queue Client Write Read libtalek Application
Oblivious logging enables servers to operate
- n noise, while delivering pub/sub functionality
SLIDE 71
Oblivious Logging
71
- 1. How do we bound the cost of a PIR operation?
- 2. How do publishers write in a way that looks random?
- 3. How do subscribers find messages on the server?
- 4. How do we deal with write conflicts?
- 5. How do we keep all servers consistent?
SLIDE 72
n
Fixed Size Server-side State
72
publish() write queue subscribe() read queue Client Write Read libtalek Application
n n
SLIDE 73
n
Fixed Size Server-side State
73
publish() write queue subscribe() read queue Client Write Read libtalek Application
n n
- 1. PIR Cost
Bound the cost of a PIR by configuring the size of the database
SLIDE 74
Oblivious Logging
74
n
Write(bucket, encryptedMsg) 1. Remove oldest message 2. Insert message at specified bucket
SLIDE 75
Oblivious Logging
75
n
Write(bucket, encryptedMsg) 1. Remove oldest message 2. Insert message at specified bucket
- 2. Random writes
Write encrypted messages to random buckets
SLIDE 76
Topics and Log Trails
76
3 4 2 1
n
Topic Handle: { topicId: uint128, encKey: byte[] seed: uint128 }
PRF(seed, seqNo) mod n
Write(bucket, encryptedMsg) Log Trail:
SLIDE 77
Topics and Log Trails
77
3 4 2 1
n
Topic Handle: { topicId: uint128, encKey: byte[] seed: uint128 }
PRF(seed, seqNo) mod n
Write(bucket, encryptedMsg) Log Trail:
- 3. Zero Coordination
Publishers and subscribers use secret topic handles to coordinate
SLIDE 78
Indistinguishable Writes
78
{ topicId: uint128, encKey: byte[], seed: uint128 }
Write bucket payload Dummy PRF(idleSeed, i | 1) mod b Enc(idleKey, PRF(idle, i | 2)) Legitimate PRF(seed, seqNo) mod b Enc(encKey, message)
SLIDE 79
Handling Conflicts
79
3 4 2 1
n
Write(bucket, encryptedMsg)
SLIDE 80
Cuckoo Hashing
80
n
Write(bucket1,bucket2,encryptedMsg)
SLIDE 81
Cuckoo Evictions
81
n
Write(bucket1,bucket2,encryptedMsg) Eviction
SLIDE 82
Cuckoo Hashing
82
4 3 4 1 2 2 1 3
2n
Topic Handle: { topicId: uint128, encKey: byte[] seed1: uint128 seed2: uint128 }
PRF(seed1, seqNo) mod n
Write(bucket1,bucket2,encryptedMsg) Log Trail:
PRF(seed2, seqNo) mod n
SLIDE 83
Blocked Cuckoo Table
83
3 4 2 1 5 4 3 2 5 1
b d
{ topicId: uint128, encKey: byte[] seed1: uint128, seed2: uint128 }
PRF(seed1, seqNo) mod b PRF(seed2, seqNo) mod b
SLIDE 84
Blocked Cuckoo Table
84
3 4 2 1 5 4 3 2 5 1
b d
{ topicId: uint128, encKey: byte[] seed1: uint128, seed2: uint128 }
PRF(seed1, seqNo) mod b PRF(seed2, seqNo) mod b
- 4. Dense data structures
Blocked cuckoo hashing handles writes conflicts with high density
SLIDE 85
Consistency
85
publish() write queue subscribe() read queue Client Writes globally
- rdered
Read requests encrypted libtalek Application Leader Follower Follower
SLIDE 86
Consistency
86
publish() write queue subscribe() read queue Client Writes globally
- rdered
Read requests encrypted libtalek Application Leader Follower Follower
- 4. Leaders enforce consistency
Timestamp ordering achieves sequential consistency
SLIDE 87
Indistinguishable Writes
87
{ topicId: uint128, seed1: uint128, seed2: uint128, encKey: byte[] }
Write bucket1 bucket2 payload Dummy PRF(idle, i | 1) mod b PRF(idle, i | 2) mod b Enc(idle, PRF(idle, i | 3)) Legitimate PRF(seed1, seqNo) mod b PRF(seed2, seqNo) mod b Enc(encKey, message)
SLIDE 88
Indistinguishable Reads
88
{ topicId: uint128, seed1: uint128, seed2: uint128, encKey: byte[] }
Read server0 server1 server2 Dummy Enc(serverKey0, pirVector) Enc(serverKey1, pirVector) Enc(serverKey2, pirVector) Legitimate Enc(serverKey0, pirVector) Enc(serverKey1, pirVector) Enc(serverKey2, pirVector)
SLIDE 89
Scheduling Reads
89
publish() write queue subscribe() read queue Client libtalek Application Leader Follower Follower Topic 1 Topic 2 Topic 3
SLIDE 90
Private Notifications
90
publish() write queue subscribe() read queue Client libtalek Application Leader Follower Follower Topic 1 Topic 2 Topic 3
GetUpdates() returns
Global Interest Vector: Privately which messages readable on the server
SLIDE 91
Talek Overview
91
publish() write queue subscribe() read queue Client libtalek Application Leader Follower Follower Topic 1 Topic 2 Topic 3 Write Read GetUpdates
SLIDE 92
Experiment Setup
92
publish() write queue subscribe() read queue Write every 5 sec Read every 5 sec libtalek Messaging AWS EC2 Thousands of Clients
SLIDE 93
Comparison to Previous Work
93
SLIDE 94
Comparison to Previous Work
94
Pung (OSDI 2016):
- Stronger threat model
- Uses computational
PIR
SLIDE 95
Comparison to Previous Work
95
Riposte (Oakland 2015):
- Same threat
model
- Anonymous
writes by “PIR in reverse”
SLIDE 96
Scaling Clients
96
SLIDE 97
97
https://github.com/privacylab/talek
SLIDE 98
Future Work: Scale Private Cloud Services
Scale out architectures
98
SLIDE 99
Future Work: Support Diverse Functionality
Scale out architectures
99
Oblivious Cloud Services Storage Pub/Sub Machine Learning Analytics Search
SLIDE 100
Future Work: Application Integration
Scale out architectures
100
Oblivious Cloud Services Storage Pub/Sub Machine Learning Analytics Search
Application Integration
SLIDE 101
Future Work Scale out architectures
101
Oblivious Cloud Services Storage Pub/Sub Machine Learning Analytics Search
Application Integration
Build practical cloud services that protect user privacy from powerful threats
SLIDE 102
102
SLIDE 103
103
References
[1] Cheng, R., Scott, W., Parno, B., Zhang, I., Krishnamurthy, A., Anderson, T. Talek: a Private Publish-Subscribe Protocol. [2] Cheng, R., Scott, W., Ellenbogen, P., Howell, J., Roesner, F., Krishnamurthy, A., and Anderson, T. Radiatus: a Shared-Nothing Server-Side Web Architecture. ACM Symposium on Cloud Computing (SOCC). 2016 [3] Zhang, I., Lebeck, N., Fonseca, P., Holt, B., Cheng, R., Norberg, A., Krishnamurthy, A., Levy, H. Diamond: Automating Data Management and Storage for Wide-area, Reactive Applications. 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI). 2016. [4] Bhoraskar, R., Langenegger, D., He, P., Cheng, R., Scott, W., and Ernst, M. User scripting on Android using BladeDroid. The 5th ACM SIGOPS Asia-Pacific Workshop on Systems (APSYS). 2014. [5] Cheng, R., Scott, W., Krishnamurthy, A., and Anderson, T. FreeDOM: a New Baseline for the Web. The 11th ACM Workshop on Hot Topics in Networks (HotNets XI). 2012. [6] Cheng, R., Hong, Ji., Kyrola, A., Miao, Y., Weng, X., Wu, M., Yang, F., Zhou, L., Zhao, F., and Chen, E. Kineograph: Taking the Pulse
- f a Fast-Changing and Connected World. Proceedings of the 7th ACM European Conference on Computer Systems (Eurosys).
2012. [7] Scott, W., Cheng, R., Li, J., Krishnamurthy, A., and Anderson, T. Blocking Resistant Network Services using Unblock. UW Technical Report UW-CSE-14- 06-01. 2014. [8] Cheng, R., Schueppert, M., Becker, H., and Thakur, M. SolocoRank: Social Signals for Local Search Quality. UW Technical Report UW-CSE-13-11-05. 2013. [9] Scott, W., Cheng, R., Krishnamurthy, A., and Anderson, T. freedom.js: an Architecture for Serverless Web Applications UW Technical Report. UW-CSE-13-05- 03. 2013. [10] B. Chor, E. Kushilevitz, O. Goldreich, and M. Sudan. Private Information Retrieval. Journal of the ACM (JACM), 45(6):965–981, 1998
SLIDE 104
104
Talek Related Work
System Security Goal Threat Model Technique Application Talek indistinguishability ≥1 IT-PIR pub/sub Pynchon Gate k-anonymity ≥1 mixnet/IT-PIR email Riffle k-anonymity ≥1 mixnet/IT-PIR file-sharing Riposte k-anonymity ≥1 IT-PIR broadcast Dissent k-anonymity ≥1 DC-nets broadcast Vuvuzela differential privacy ≥1 mixnet 1-1 messaging DP5 indistinguishability ≥1 IT-PIR chat presence Popcorn indistinguishability ≥1 C-PIR/IT-PIR video streaming Pung indistinguishability C-PIR key-value store ORAM indistinguishability ORAM storage
Weaker Security Goal Application Specific Prohibitively Expensive