Vanish: Increasing Data Privacy with Self-Destructing Data Roxana Geambasu Yoshi Kohno Amit Levy Hank Levy University of Washington.

Slides:



Advertisements
Similar presentations
P2P data retrieval DHT (Distributed Hash Tables) Partially based on Hellerstein’s presentation at VLDB2004.
Advertisements

Clayton Sullivan PEER-TO-PEER NETWORKS. INTRODUCTION What is a Peer-To-Peer Network A Peer Application Overlay Network Network Architecture and System.
Managing NymBoxes for Identity and Tracking Protection David Wolinsky, Daniel Jackowitz, and Bryan Ford Yale University.
Computer viruses Hardware theft Software Theft Unauthorized access by hackers Information Theft Computer Crimes.
Click to edit Master title style Defeating Vanish with Low-Cost Sybil Attacks Against Large DHTs Scott Wolchok 1 Owen S. Hofmann 2 Nadia Heninger 3 Edward.
Project in Computer Security Integrating TOR’s attacks into the I2P darknet Chen Avnery Amihay Vinter.
Comet: An Active Distributed Key-Value Store Roxana Geambasu Amit Levy Yoshi Kohno Arvind Krishnamurthy Hank Levy University of Washington.
TrustMe: Anonymous Management of Trust Relationships in Decentralized P2P Systems Aameek Singh and Ling Liu Presented by: Korporn Panyim.
V ANISHING D OCUMENTS I MPACT ON P RIVACY George B. Dobbs Chief Architect & Director Shared Services, Knights of Columbus Supreme Council.
S EMINAR A SELF DESTRUCTING DATA SYSTEM BASED ON ACTIVE STORAGE FRAMEWORK ONON P RESENTED BY S HANKAR G ADHVE G UIDED BY P ROF.P RAFUL P ARDHI.
Locking the Backdoor: Computer Security and Medical Office Practice Dr. Maury Pinsk, FRCPC University of Alberta Division of Pediatric Nephrology.
Outline for today Structured overlay as infrastructures Survey of design solutions Analysis of designs.
1 Cryptography and Network Security Third Edition by William Stallings Lecturer: Dr. Saleem Al_Zoubi.
Peer-to-Peer Networks João Guerreiro Truong Cong Thanh Department of Information Technology Uppsala University.
Peer-to-Peer Networks as a Distribution and Publishing Model Jorn De Boever (june 14, 2007)
Paul Solomine Security of P2P Systems. P2P Systems Used to download copyrighted files illegally. The RIAA is watching you… Spyware! General users become.
The University of Hull Centre For Internet Computing Spam ‘n’ chips A discussion of internet crime Angus M. Marshall BSc CEng MBCS FRSA.
Key Management/Distribution. Administrivia Snafu on books Probably best to buy it elsewhere Paper assignment and first homework Next week (9/24)
By: Bryan Carey Randy Cook Richard Jost TOR: ANONYMOUS BROWSING.
An Authentication Service Against Dishonest Users in Mobile Ad Hoc Networks Edith Ngai, Michael R. Lyu, and Roland T. Chin IEEE Aerospace Conference, Big.
CMSC 414 Computer and Network Security Lecture 19 Jonathan Katz.
Chord-over-Chord Overlay Sudhindra Rao Ph.D Qualifier Exam Department of ECECS.
Freenet A Distributed Anonymous Information Storage and Retrieval System I Clarke O Sandberg I Clarke O Sandberg B WileyT W Hong.
Wide-area cooperative storage with CFS
SybilGuard: Defending Against Sybil Attacks via Social Networks Haifeng Yu, Michael Kaminsky, Phillip B. Gibbons, and Abraham Flaxman Presented by Ryan.
Hippocratic Databases Paper by Rakesh Agrawal, Jerry Kiernan, Ramakrishnan Srikant, Yirong Xu CS 681 Presented by Xi Hua March 1st,Spring05.
The Study of Security and Privacy in Mobile Applications Name: Liang Wei
Freenet. Anonymity  Napster, Gnutella, Kazaa do not provide anonymity  Users know who they are downloading from  Others know who sent a query  Freenet.
1 Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm T. Holz, M. Steiner, F. Dahl, E. Biersack, and F. Freiling - Proceedings.
Defeating Vanish with Low-Cost Sybil Attacks Against Large DHTs The University of Michigan Scott Wolchok J. Alex Halderman The University of Texas at Austin.
P EER - TO -P EER N ETWORKS Michael Fine 1. W HAT ARE P EER -T O -P EER N ETWORKS ? Napster Social networking spawned from this concept. Emerged in the.
Privacy in P2P based Data Sharing Muhammad Nazmus Sakib CSCE 824 April 17, 2013.
Privacy-Preserving P2P Data Sharing with OneSwarm -Piggy.
By Shobana Padmanabhan Sep 12, 2007 CSE 473 Class #4: P2P Section 2.6 of textbook (some pictures here are from the book)
HomeViews: P2P Middleware for Personal Data Sharing Applications Roxana Geambasu, Magdalena Balazinska, Steve Gribble, Hank Levy University of Washington.
M i SMob i S Mob i Store - Mobile i nternet File Storage Platform Chetna Kaur.
Peer to Peer Research survey TingYang Chang. Intro. Of P2P Computers of the system was known as peers which sharing data files with each other. Build.
Overlay network concept Case study: Distributed Hash table (DHT) Case study: Distributed Hash table (DHT)
Click to edit Master title style Fall, Privacy&Security - Virginia Tech – Computer Science Cryptographic Security Secret Sharing, Vanishing Data.
| nectar.org.au NECTAR TRAINING Module 5 The Research Cloud Lifecycle.
1 Distributed Hash Tables (DHTs) Lars Jørgen Lillehovde Jo Grimstad Bang Distributed Hash Tables (DHTs)
Exercises for Chapter 10: Peer-to-Peer Systems Peer-to-Peer Systems
Network Computing Laboratory Scalable File Sharing System Using Distributed Hash Table Idea Proposal April 14, 2005 Presentation by Jaesun Han.
Vanish: Increasing Data Privacy with Self-Destructing Data Roxana Geambasu, Tadayoshi Kohno, Amit Levy, et al. University of Washington USENIX Security.
Cryptographic Security Secret Sharing, Vanishing Data 1Dennis Kafura – CS5204 – Operating Systems.
Vanish: Increasing Data Privacy with Self-Destructing Data Roxana Geambasu Tadayoshi Kohno Amit A. Levy Henry M. Levy University of Washington.
Peer-to-Peer Name Service (P2PNS) Ingmar Baumgart Institute of Telematics, Universität Karlsruhe IETF 70, Vancouver.
Vanish: Increasing Data Privacy with Self-Destructing Data Roxana Geambasu | Tadayoshi Kohno | Amit A. Levy | Henry M. Levy Presented by: Libert Tapia.
1 Peer-to-Peer Technologies Seminar by: Kunal Goswami (05IT6006) School of Information Technology Guided by: Prof. C.R.Mandal, School of Information Technology.
Paper Survey of DHT Distributed Hash Table. Usages Directory service  Very little amount of information, such as URI, metadata, … Storage  Data, such.
Paper by: Roxana Geambasu, Tadayoshi Kohno, Amit A. Levy, Henry M. Levy University of Washington Vanish: Increasing Data Privacy with Self-Destructing.
COEN 350: Network Security Authentication. Between human and machine Between machine and machine.
1 Secure Peer-to-Peer File Sharing Frans Kaashoek, David Karger, Robert Morris, Ion Stoica, Hari Balakrishnan MIT Laboratory.
Computer Networking P2P. Why P2P? Scaling: system scales with number of clients, by definition Eliminate centralization: Eliminate single point.
A Cooperative SIP Infrastructure for Highly Reliable Telecommunication Services BY Sai kamal neeli AVINASH THOTA.
BY: REBECCA NAVARRE & MICHAEL BAKER II Persea: Making Networks More Secure Since Early 2013.
| nectar.org.au NECTAR TRAINING Module 5 The Research Cloud Lifecycle.
Aug 22, 2002Sigcomm 2002 Replication Strategies in Unstructured Peer-to-Peer Networks Edith Cohen AT&T Labs-research Scott Shenker ICIR.
Peer-to-Peer Systems: An Overview Hongyu Li. Outline  Introduction  Characteristics of P2P  Algorithms  P2P Applications  Conclusion.
INTERNET TECHNOLOGIES Week 10 Peer to Peer Paradigm 1.
P2P Search COP6731 Advanced Database Systems. P2P Computing  Powerful personal computer Share computing resources P2P Computing  Advantages: Shared.
P2P Search COP P2P Search Techniques Centralized P2P systems  e.g. Napster, Decentralized & unstructured P2P systems  e.g. Gnutella.
P2P Networking: Freenet Adriane Lau November 9, 2004 MIE456F.
NGMAST Mobile DHT Energy1 Optimizing Energy Consumption of Mobile Nodes in Heterogeneous Kademlia-based Distributed Hash Tables Imre Kelényi Budapest.
[FUNCTIONALITY AND SAFETY OF A MODERN TECHNOLOGY] [CLOUD COMPUTING FOR INDIVIDUAL CONSUMERS]
Department of Computer Science Chapter 5 Introduction to Cryptography Semester 1.
1 Anonymity. 2 Overview  What is anonymity?  Why should anyone care about anonymity?  Relationship with security and in particular identification 
Cyber Attacks on Businesses 43% of cyber attacks target small business Only 14% of small business rate their ability to mitigate cyber risk highly.
Computer Security Computer viruses Hardware theft Software Theft Unauthorized access by hackers Information Theft Computer Crimes.
Vanish: Increasing Data Privacy with Self-Destructing Data
Presentation transcript:

Vanish: Increasing Data Privacy with Self-Destructing Data Roxana Geambasu Yoshi Kohno Amit Levy Hank Levy University of Washington

Outline Part 1: Introducing Self-Destructing Data Part 2: Vanish Architecture and Implementation Part 3: Evaluation and Applications 2

Outline Part 1: Introducing Self-Destructing Data Part 2: Vanish Architecture and Implementation Part 3: Evaluation and Applications 3

How can Ann delete her sensitive ? She doesn’t know where all the copies are Services may retain data for long after user tries to delete Motivating Problem: Data Lives Forever This is sensitive stuff. This is sensitive stuff. This is sensitive stuff. This is sensitive stuff. 4 Ann Carla Sensitive ISP Sensitive Senstive Sensitive Senstive Sensitive Senstive Sensitive Senstive Sensitive This is sensitive stuff. This is sensitive stuff. This is sensitive stuff. This is sensitive stuff.

Archived Copies Can Resurface Years Later 5 ISP Sensitive Senstive Sensitive Senstive Sensitive Some time later… Subpoena, hacking, … Sensitive Senstive Sensitive Senstive Sensitive Carla Ann This is sensitive stuff. This is sensitive stuff. This is sensitive stuff. This is sensitive stuff. This is sensitive stuff. This is sensitive stuff. This is sensitive stuff. Retroactive attack on archived data

The Retroactive Attack 6 Time User tries to delete Copies archived Retroactive attack begins Upload data months or years

Subpoena, hacking, … Why Not Use Encryption (e.g., PGP)? ISP Sensitive Senstive Sensitive Senstive Sensitive Carla Ann This is sensitive stuff. This is sensitive stuff. This is sensitive stuff. This is sensitive stuff. 7

Why Not Use a Centralized Service? 8 Backdoor agreement ISP Carla Ann Centralized Service “Trust us: we’ll help you delete your data on time.”

The Problem: Two Huge Challenges for Privacy 1. Data lives forever  On the web: s, Facebook photos, Google Docs, blogs, …  In the home: disks are cheap, so no need to ever delete data  In your pocket: phones and USB sticks have GBs of storage 2. Retroactive disclosure of both data and user keys has become commonplace  Hackers  Misconfigurations  Legal actions  Border seizing  Theft  Carelessness 9

Question: Can we empower users with control of data lifetime? Answer: Self-destructing data 10 Time User tries to delete Copies archived Retroactive attack begins Upload data months or years Timeout (all copies self destruct)

Self-Destructing Data Model 1. Until timeout, users can read original message 2. After timeout, all copies become permanently unreadable 2.1. even for attackers who obtain an archived copy & user keys 2.2. without requiring explicit delete action by user/services 2.3. without having to trust any centralized services 11 Ann Carla This is sensitive stuff. This is sensitive stuff. This is sensitive stuff. This is sensitive stuff. ISP Sensitive Goals self-destructing data (timeout)

Outline Part 1: Introducing Self-Destructing Data Part 2: Vanish Architecture and Implementation Part 3: Evaluation and Applications 12

Vanish: Self-Destructing Data System Traditional solutions are not sufficient for self-destructing data goals:  PGP  Centralized data management services  Forward-secure encryption  … Let’s try something completely new! 13 Idea: Leverage P2P systems

A system composed of individually-owned computers that make a portion of their resources available directly to their peers without intermediary managed hosts or servers. [~wikipedia] Important P2P properties (for Vanish): Huge scale – millions of nodes Geographic distribution – hundreds of countries Decentralization – individually-owned, no single point of trust Constant evolution – nodes constantly join and leave P2P 101: Intro to Peer-To-Peer Systems 14

Distributed Hashtables (DHTs) 15 Hashtable data structure implemented on a P2P network  Get and put (index, value) pairs  Each node stores part of the index space DHTs are part of many file sharing systems:  Vuze, Mainline, KAD  Vuze has ~1.5M simultaneous nodes in ~190 countries Vanish leverages DHTs to provide self-destructing data  One of few applications of DHTs outside of file sharing DHT Logical structure

World-Wide DHT How Vanish Works: Data Encapsulation Vanish Encapsulate (data, timeout) Vanish Data Object VDO = {C, L} Secret Sharing (M of N) k1k1 k2k2 kNkN... k3k3 Random indexes k1k1 k2k2 k3k3 kNkN Ann C = E K (data) L K k1k1 k3k3 kNkN k2k2 16 VDO = {C, L} Carla

How Vanish Works: Data Decapsulation 17 Vanish Encapsulate (data, timeout) Random indexes Ann C = E K (data) World-Wide DHT Vanish Decapsulate (VDO = {C, L}) data Carla Secret Sharing (M of N)... Random indexes k1k1 k3k3 kNkN data = D K (C) kNkN k3k3 k1k1 LL K Secret Sharing (M of N) X VDO = {C, L} k2k2 k2k2 Vanish Data Object VDO = {C, L}

How Vanish Works: Data Timeout The DHT loses key pieces over time  Natural churn: nodes crash or leave the DHT  Built-in timeout: DHT nodes purge data periodically Key loss makes all data copies permanently unreadable 18 World-Wide DHT Vanish Secret Sharing (M of N)... Random indexes k1k1 k3k3 kNkN data = D K (C) L K X kNkN k3k3 k1k1 18 X X

Outline Part 1: Introducing Self-Destructing Data Part 2: Vanish Architecture and Implementation Part 3: Evaluation and Applications 19

Evaluation Experiments to understand and improve: 1. data availability before timeout 2. data unavailability after timeout 3. performance 4. security Highest-level results:  Secret sharing parameters (N and M) affect availability, timeout, performance, and security  Tradeoffs are necessary 20 In the paper Discussed next

Threat Model Goal: protect against retroactive attacks on old copies  Attackers don’t know their target until after timeout  Attackers may do non-targeted “pre-computations” at any time Communicating parties trust each other  E.g., Ann trusts Carla not to keep a plain-text copy 21 Pre-computation Time Copies archived Retroactive attack begins Upload data months or years Timeout

22 Attack Analysis Retroactive AttackDefense Obtain data by legal means (e.g., subpoenas) P2P properties: constant evolution, geographic distribution, decentralization Gmail decapsulates all VDO s Compose with traditional encryption (e.g., PGP) ISP sniffs traffic Anonymity systems (e.g., Tor) DHT eclipse, routing attack Defenses in DHT literature (e.g., constraints on routing table) DHT Sybil attack Defenses in DHT literature; Vuze offers some basic protection Intercept DHT “get” requests & save results Vanish obfuscates key share lookups Capture key pieces from the DHT (pre-computation) P2P property: huge scale More (see paper)

AttackDefense Obtain data by legal means (e.g., subpoenas) P2P properties: constant evolution, geographic distribution, decentralization Gmail decapsulates all VDO s Compose with traditional encryption (e.g., PGP) ISP sniffs traffic Anonymity systems (e.g., Tor) DHT eclipse, routing attack Defenses in DHT literature (e.g., constraints on routing table) DHT Sybil attack Defenses in DHT literature; Vuze offers some basic protection Intercept DHT “get” requests & save results Vanish obfuscates key share lookups Capture key pieces from the DHT and persist them P2P property: huge scale More (see paper) Retroactive Attacks Capture any key pieces from the DHT (pre-computation) P2P property: huge scale Vanish Secret Sharing (M of N) k1k1 k2k2 kNkN... k3k3 K Direct put Replication Given the huge DHT scale, how many nodes does the attacker need to be effective? Current estimate:  Attacker must join with ~8% of DHT size, for 25% capture  There may be other attacks (and defenses)

Vanish Applications Self-destructing data & Vanish support many applications Example applications: Firefox plugin  Included in our release of Vanish Thunderbird plugin  Developed by the community two weeks after release Self-destructing files Self-destructing trash-bin … 24

25 Encapsulate text in any text area in self-destructing VDOs Firefox Plugin For Vanishing Web Data Effect: Vanish empowers users with seamless control over the lifetime of their Web data

Conclusions Two formidable challenges to privacy:  Data lives forever  Disclosures of data and keys have become commonplace Self-destructing data empowers users with lifetime control Vanish:  Combines global-scale DHTs with secret sharing to provide self-destructing data  Firefox plugin allows users to set timeouts on text data anywhere on the web Vanish ≠ Vuze-based Vanish  Customized DHTs, hybrid approach, other P2P systems  Further extensions for security in the paper 26