Social Networking with Frientegrity: Privacy and Integrity with an Untrusted Provider Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/121 Joint work with: Aaron Blankstein, Michael J. Freedman, and Edward W. Felten Ariel J. Feldman PrincetonUPenn

Online social networks are centralized Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/122 Pro: Availability, reliability, global accessibility, convenience Con: 3 rd party involved in every social interaction Must trust provider for confidentiality & integrity

Google Transparency Report Jan. – Jun Threats to confidentiality Theft by attackers Accidental leaks Privacy policy changes Government pressure Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/123 PC World. Dec. 6, 2011 WSJ. Feb. 22, 2012 EFF. Apr. 28, 2010 Ars Technica. Mar. 11, 2011

Threats to integrity Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/124 Simple: Corrupting messages Complex: Server equivocation Alice 123 Equivocation in the wild: (translated by Google) (e.g to disguise censorship)

Limits of prior work Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/125 1.Cryptographic 2.Decentralized Run your own server OR Trust a provider Dont protect integrity (sacrifice availability, convenience, etc.)(who you may not know either)

Frientegritys approach Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/126 Client Server Provider Client Benefit from a centralized provider Support common features (e.g. walls, feeds, friends, FoFs, followers) Assume untrusted provider

Enforce confidentiality Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/127 Client Server Provider Client Provider only observes encrypted data (Need dynamic access control and key distribution) State Encrypted state Encrypted state

Verify integrity Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/128 Client Server Provider Client Clients verify that the provider: Hasnt corrupted individual updates Hasnt equivocated Enforced access control on writes

Scalability challenges Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/129 Long histories; only want tail Many objects (walls, comment threads, photos, etc.) Many friends and FoFs Dont verify whole history each time Support sharding O(log n) (un)friending …

Server 1 Frientegrity overview Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1210 Server 2 Bobs profile Server n Bob Read Alices wall Verify & decrypt Alices wall Alices photo album Alices ACL Comment thread Alices profile Optionally entangled Checked for equivocatio n 3.Proof of ACL enforcement 4.Decryption keys 3.Proof of ACL enforcement 4.Decryption keys 1.Latest updates 2.Proof of no equivocation 1.Latest updates 2.Proof of no equivocation

Detecting equivocation Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1211 Honest server: linearizability Malicious server: Alice and Bob detect equivocation after exchanging 2 messages Compare histories Provider can still fork the clients, but cant unfork Alice 123 Enforce fork* consistency [LM07]

Comparing histories Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1212 op 0 op 1 op 2 op 3 op 4 op 5 op 6 op 7 h n = H(h n-1 || op n ) Hash chains are O(n) (and must download the whole history) Previously: use a hash chain

Objects in Frientegrity Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1213 op 0 op 1 op 2 op 3 op 4 op 5 op 6 op 7 op 8 op 9 op 10 op 11 op 12 op 13 op 14 op 15 History tree [CW09] h root commits to entire history Let C 15 be a server- signed commitment to h root up to op 15 h i = H(h leftChild(i) || h rightChild(i) )

Objects (cont.) Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1214 op 0 op 1 op 8 op 9 op 14 op 15 C 15 Is C 8 consistent with C 15 ?

Verifying an object Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1215 op 0 op 1 op 2 op 3 op 4 op 5 op 6 op 7 op 8 op 9 op 10 op 11 op 12 op 13 op 14 op 15 C11C11 Is C 11 consistent with C 15 ? C8C8 C4C4 C0C0 Alices ops Bobs ops Charlies ops Clients collaborate to verify the history

Tolerating malicious users Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1216 op 0 op 1 op 8 op 9 op 10 op 11 op 12 op 13 op 14 op 15 C11C11 Alices ops Bobs ops Charlies ops C9C9 Tolerate up to f malicious users

Server Access control Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1217 Bob Verify & decrypt Alices wall Alices photo album Alices ACL Comment thread Prove ACL enforcement Efficient key distribution O(log n) (un)friending

Server Proving ACL enforcement Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1218 Bob Verify & decrypt Alices wall Alices photo album Alices ACL Comment thread AliceCharlie Bob Emma Sean David h i = H(h leftChild(i) || h rightChild(i) ) h root signed by Alice Persistent authenticated dictionary [AGT01] Persistent authenticated dictionary [AGT01]

Server Efficient key distribution Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1219 Bob Verify & decrypt Alices wall Alices photo album Alices ACL Comment thread AliceCharlie Bob Emma Sean David Key graph [WGL98] Key graph [WGL98] k 0 = k alice_friend E k3 (k 1 ) || E k4 (k 1 ) David, k 0 Bob, k 1 Sean, k 2 Alice, k 3 Charlie, k 4 Emma, k 5 E charlie_pk (k 4 )

Server Adding a friend Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1220 Bob Verify & decrypt Alices wall Alices photo album Alices ACL Comment thread David, k 0 Bob, k 1 Sean, k 2 Alice, k 3 Charlie, k 4 Emma, k 5 E k5 (k 2 ) || E k6 (k 2 ) E zack_pk (k 6 ) Zack, k 6

Server Removing a friend Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1221 Bob Verify & decrypt Alices wall Alices photo album Alices ACL Comment thread David, k 0 Bob, k 1 Sean, k 2 Alice, k 3 Charlie, k 4 Emma, k 5 Zack, k 6 Bob, k 1 David, k 0 k 0 = k alice_friend

Efficient enough in practice? Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1222 Setup Java client & server Simulate basic Facebook features (each user has wall & ACL) 2048-bit RSA sign & verify batched via spliced signatures [CW10] Experiments on LAN (8-core 2.4 GHz Intel Xeon E5620s, Gigabit network) Measurements Latency of reads & writes to objects Latency of ACL changes Throughput (in paper) Effect of tolerating malicious users

Object read & write latency Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1223 Frientegrity (collaborative verification) Hash chain Constant cost of signatures dominates

Latency of ACL changes Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1224

Tolerating malicious users Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/ writers 5000 operations

Summary Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1226 Both confidentiality & integrity need protection Benefit from centralization, but provider is untrusted Clients collaborate to defend against equivocation Scalable, verifiable access control & key distribution

Social Networking with Frientegrity Ariel J. Feldman Usenix Security 8/10/1227 Thank you Questions?