1. © 2006 Ravi Sandhu www.list.gmu.edu Secure Information Sharing Enabled by Trusted Computing and PEI * Models Ravi Sandhu (George Mason University and TriCipher) Kumar Ranganathan (Intel System Research Center, Bangalore) Xinwen Zhang (George Mason University) * PEI: Policy, Enforcement, Implementation

2. © 2005 Ravi Sandhu www.list.gmu.edu 2 Three Megatrends Fundamental changes in Cyber-security goals Cyber-security threats Cyber-security technology

3. © 2005 Ravi Sandhu www.list.gmu.edu 3 Cyber-security goals have changedCyber-security goals electronic commerce information sharing etcetera multi-party security objectives fuzzy objectives INTEGRITY modification AVAILABILITY access CONFIDENTIALITY disclosure USAGE purpose USAGE

4. © 2005 Ravi Sandhu www.list.gmu.edu 4 Cyber-security attacks have changed The professionals have moved in Hacking for fun and fame Hacking for cash, espionage and sabotage

5. © 2005 Ravi Sandhu www.list.gmu.edu 5 Basic premise Software alone cannot provide an adequate foundation for trust Old style Trusted Computing (1970 – 1990s) Multics system Capability-based computers –Intel 432 vis a vis Intel 8086 Trust with security kernel based on military-style security labels –Orange Book, eliminate trust from applications Whats new (2000s) Hardware and cryptography-based root of trust –Ubiquitous availability –Trust within a platform –Trust across platforms Rely on trust in applications –No Trojan Horses or –Mitigate Trojan Horses and bugs by legal and reputational recourse Cyber-security technology has changed Massive paradigm shift Prevent information leakage by binding information to Trusted Viewers on the client

6. © 2005 Ravi Sandhu www.list.gmu.edu 6 PEI Models Framework Cannot do security without analyzing the application space in business terms Cannot do security without understanding the target platform and its limitations Divide and conquer AND confront and deal with issues at the correct layer }

7. © 2005 Ravi Sandhu www.list.gmu.edu 7 What is Information Sharing The mother of all security problems Share but protect Requires controls on the client Server-side controls do not scale to high assurance Different from Retail DRM (Digital Rights Management) Enterprise DRM Integrity of information on the client can be crypto- guaranteed to very high assurance by digital signatures. Guarantee of confidentiality on the client needs mechanisms beyond crypto alone.

8. © 2005 Ravi Sandhu www.list.gmu.edu 8 Classic Approaches to Information Sharing Discretionary Access Control (DAC), Lampson 1971 Fundamentally broken Controls access to the original but not to copies (or extracts) Mandatory Access Control (MAC), Bell-LaPadula 1971 Solves the problem for coarse-grained sharing –Thorny issues of covert channels, inference, aggregation remain but can be confronted Does not scale to fine-grained sharing –Super-exponential explosion of security labels is impractical –Fallback to DAC for fine-grained control (as per the Orange Book) is pointless Originator Control (ORCON), Graubart 1989 Propagated access control lists: let copying happen but propagate ACLs to copies (or extracts) Park and Sandhu 2002 discuss an approach based on Trusted Viewers

9. © 2005 Ravi Sandhu www.list.gmu.edu 9 PEI Models Framework

10. © 2005 Ravi Sandhu www.list.gmu.edu 10 Scoping Information Sharing: Big Issues Secure information sharing rather than Digital Rights Management (DRM) Sensitivity of information content is the issue not revenue potential of retail entertainment content Open system as opposed to closed Enterprise DRM Read-only versus read-write secure information sharing Read-only is a useful subset Avoids some of the complexities of read-write such as –Extraction of pieces of information –Aggregation of several sources –Version control –Ability to overwrite versus annotate Content-independent authorization versus content-dependent authorization Content-independent is a useful subset Content-dependent is more complex since it requires Trusted Viewers to parse and understand the content

11. © 2005 Ravi Sandhu www.list.gmu.edu 11 PEI Models Framework

12. © 2005 Ravi Sandhu www.list.gmu.edu 12 Scoping Information Sharing One Decomposition at the Policy Layer Password based Device based Credential based Just one possibility Determined by business objectives

13. © 2005 Ravi Sandhu www.list.gmu.edu 13 Scoping Information Sharing: Detailed Issues Detailed issues include Revocation Policy Usage Policy Re-dissemination Policy Distribution Policy Accessibility Policy

14. © 2005 Ravi Sandhu www.list.gmu.edu 14 PEI Models Framework

15. © 2005 Ravi Sandhu www.list.gmu.edu 15 Password-based encryption: traditional approach Insecure due to off-line dictionary attacks GuessVerify

16. © 2005 Ravi Sandhu www.list.gmu.edu 16 Trusted Viewer Seal with Password Authentication

17. © 2005 Ravi Sandhu www.list.gmu.edu 17 Trusted Viewer Seal with Password Authentication and Encryption

18. © 2005 Ravi Sandhu www.list.gmu.edu 18 Trusted Viewer Seal with Device Encryption

19. © 2005 Ravi Sandhu www.list.gmu.edu 19 Trusted Viewer Seal with Credential Authentication

20. © 2005 Ravi Sandhu www.list.gmu.edu 20 Trusted Viewer Seal with Credential Encryption

21. © 2005 Ravi Sandhu www.list.gmu.edu 21 PEI Models Framework

22. © 2005 Ravi Sandhu www.list.gmu.edu 22 Trusted Viewer Seal with Password Authentication On-line password guessing Need a throttling mechanism Many possibilities

23. © 2006 Ravi Sandhu www.list.gmu.edu Secure Information Sharing Enabled by Trusted Computing and PEI * Models Ravi Sandhu (George Mason University and TriCipher) Kumar Ranganathan (Intel System Research Center, Bangalore) Xinwen Zhang (George Mason University) * PEI: Policy, Enforcement, Implementation Questions ??