Thor: The Hybrid Online Repository Tim van der Horst and Kent Seamons Internet Security Research Lab Brigham Young University http://isrl.cs.byu.edu Good afternoon. Today, I am presenting Thor: The Hybrid Online Repository First IEEE/CreateNet International Conference on Security and Privacy for Emerging Areas in Communication Networks Athens, Greece 5th-9th September 2005

Digital Repositories Repository – a place to store and protect valuable objects Digital credential repository stores and protects digital credentials Important service to applications and protocols that use credentials Many repositories have been created and successfully deployed Not designed with the mobile environment in mind What is a repository? –Give Def Digital CRED repository – Give Def This is a valuable support service for apps and protocols that use creds Many digital repositories have been created and successfully deployed. However, many of these repositories were not designed with the mobile environment in mind.

Purpose Identify the requirements of a mobile environment Evaluate existing repositories in light of these requirements Present the design of a repository that meets these requirements The purpose of this research is to…

Requirements Physical Security Connectivity Manageability The loss of the mobile device must not equate to a loss of the user’s credentials Connectivity A user-defined subset of credentials must be accessible regardless of the current communications topology Manageability Provide an interface to manage and maintain credentials across all participating devices R1 R2 We have identified 3 requirements for secure credential repositories in a mobile environment The first requirement has to do with physical security. Due to the small size of mobile devices and their use outside a trusted domain, they are more prone to loss, theft, and destruction. As such, our first requirement is that: --Give R1 The second requirement has to do with connectivity. Due to the transient nature of mobile devices, they can experience a variety of both connect and disconnected topologies. As such, our second requirement states: -- Give R2 Our third requirement has to do with manageability. Management, replication, and synchronization of credentials is a critical task. As such, our third requirement states: --Give R3 R3

Existing Repositories Application Local R1 R2 R3 Local Repository Now that we have a set of requirements to evaluate repositories in the context of a mobile environment, lets do so. Existing repositories fall into two different types: Local and remote Local – Existing entirely on-device, as such if the device is destroyed, so is the repository and its contents and thus does not satisfy our first requirement. Also, since the repository is contained completely on-device it doesn’t have the facilities to interact with the repositories on the user’s other participating devices. Remote – resides completely off-device. Because of this, when the device is destroyed the credentials remain safe. This type of repository can be shared by all of a user’s participating devices, thus providing satisfaction for the third requirement. Notice that the requirements satisfied by these two types of repositories are complimentary. That is to say, if we were to combine the correct elements of these repositories we should get I repository that does satisfy all of these requirements. Application R1 R2 R3 Remote The Internet Remote Repository

Hybrid Repository R1 R2 R3 Application The Internet Remote Repository Local Repository This is in fact what a hybrid repository does. It combines local and remote elements in order to satisfy all three requirements.

Thor A design for a hybrid repository Design Goals Leverages existing repositories, rather than creating a new one Design Goals All three requirements for a secure credential repository in a mobile environment must be satisfied There must be no modifications required to the existing repository implementations Where possible, increase usability and security of existing repositories without modifying them G1 G2 G3

Thor – Repository Interface Creates an additional layer of abstraction All repositories have three basic operations: Put Get Delete

Thor – Design Root repository constraints Must be a remote repository ? Leaf Leaf Leaf R2   

Centralized Management Provides a single location to manage credentials Local agent Stores and manages meta-data in the repositories Contains additional information about the credentials Used to manage credentials Meta-data is stored as an encrypted credential in the repository R3

Thor – Enhancements Credential organization Create a virtual organization Credential identifier obfuscation Password management Create a mapping of secure passwords to credentials, encrypt with a single password 145c01342ee13a015954fefe01 Credit card credential 4fe4c30f4a2466f52a591071dd CIA agent credential

Central Management Transparent features

Evaluation Does Thor meet its goals? All three requirements for a secure credential repository in a mobile environment must be satisfied There must be no modifications required to the existing repository implementations Where possible, increase usability and security of existing repositories without modifying them G1 G1 G2 G2 G3 G3

Conclusions Delineated a set of requirements for a repository in a mobile environment Evaluated existing repositories based on those requirements Designed and implemented a hybrid repository Satisfies requirements of a mobile environment Leverages existing repositories Provides transparent features that enhance the protection of its contents

Future Work Incorporate more repositories into this system Email-based repository No need for a specialized credential server Context-aware application interface Create a virtual smart card interface for each type of application Usability