1 Applied Cryptography in CyberTA Brent Waters Work with Dan Boneh and Amit Sahai

2 Role of Applied Crypto  Introduce new capabilities  Address needs of Data + Traffic Privacy Crypto Data Privacy Crypto Tools CyberTA problems

3 An Alert Detection System Data Generation Alert Analysis

4 NetFlow Logs  Record TCP Flows  Search for exfiltration,…  Ignore non-alert entries SRC IP SPORT DST IP DPORT PACKETS BYTES SECS

5 NetFlow Logs SRC IP SPORT DST IP DPORT PACKETS BYTES SECS Classified system Chinese IPLarge Data

6 System Goals  Analyze Abnormal Events  Minimal Disclosure  Simple Data Generation  Flexible Searching Rules

7 Available Options  Completely Trust Data Collector Violates Minimal Disclosure  Push Policy to Data Generators Simplicity Flexibility, Policy Changes  Conclusion => Need new Mechanism

8 Identity-Based Encryption (IBE) IBE: [BF’01] Public key encryption scheme where public key is an arbitrary string ( ID ).  Examples: user’s address, current-date, … encrypted using public key: master-key CA/PKG I am Private key

9 Limitations of IBE  Lack of Expressivity Just a string  Require Encrypting with Structure Reflects Application Build Policy

10 Attribute-Based Encryption (ABE) encrypted using public key: master-key CA/PKG Priority= Urgent AND Subj = CyberTA Private key  Attributes Describe Data  Keys Identified with Policies Attributes To: Bob Subj: CyberTA Priority: Urgent

11 ABE Features  Encryption labels data w/ attributes Simple Application Aware  Authority gives policy keys Expressive Late-Binding

12 ABE on NetFlow Logs  Each category is simply an attribute  Make keys for exfiltration, etc.  (SRC_IP=Top Secret) OR (bytes >100KB AND DestIP = Foreign) SRC IP SPORT DST IP DPORT PACKETS BYTES SECS

13 An Alert Detection System Data Generation Alert Analysis Authority ABE enc. data ABE Keys

14 Progress  Developed ABE Crypto System  Delegation  Efficiency Improvements

15 Challenges Ahead  Build a “Blinded IDS”  Make an Intermediate Language E.g. How to Express numbers as attributes  Combine App. Domain Knowledge and Crypto

16 THE END