privacy and identity management in cloud
DESCRIPTION
Privacy and Identity Management in Cloud. Rohit Ranchal, Bharat Bhargava, Pelin Angin, Noopur Singh, Lotfi Ben Othmane, Leszek Lilien Department of Computer Science Purdue University, Western Michigan University {rranchal, bbshail}@purdue.edu, [email protected] Mark Linderman - PowerPoint PPT PresentationTRANSCRIPT
Privacy and Identity Privacy and Identity Management in CloudManagement in Cloud
Rohit Ranchal, Bharat Bhargava, Pelin Angin, Noopur Singh, Lotfi Ben Othmane, Leszek Lilien
Department of Computer SciencePurdue University, Western Michigan University
{rranchal, bbshail}@purdue.edu, [email protected]
Mark [email protected]
Air Force Research LaboratoryRome, NY, USA
This research was supported by AFRL Rome, USA and NGC
OutlineOutlineMotivationIdentity Management (IDM)Goals of Proposed User-Centric IDMMechanismsDescription of proposed solutionAdvantages of the Proposed
SchemeConclusion & Future WorkReferencesQuestions?
MotivationMotivation
User on Amazon Cloud
• Name• E-mail• Password• Billing Address• Shipping Address• Credit Card
• Name• E-mail• Shipping Address
• Name• Billing Address• Credit Card
• Name• E-mail• Password• Billing Address• Shipping Address• Credit Card
• Name• E-mail• Shipping Address
MotivationMotivation
User on Amazon Cloud
• Name• E-mail• Password• Billing Address• Shipping Address• Credit Card
• Name• Billing Address• Credit Card
MotivationMotivation The migration of web applications to Cloud computing
platform has raised concerns about the privacy of sensitive data belonging to the consumers of cloud services.
How can consumers verify that a service provider conform to the privacy laws and protect consumer’s digital identity.
The username/password security token used by most service providers to authenticate consumers, leaves the consumer vulnerable to phishing attacks.
The solution to address the above problems can be the use of an Identity Management (IDM) System. The solution should help the consumer in making a proactive choice about how and what personal information they disclose, control how their information can be used, cancel their subscription to the service, and monitor to verify that a service provider applies required privacy policies.
Identity Management Identity Management (IDM)(IDM) IDM in traditional application-centric IDM model
◦ Each service keeps track of identifying information of its users.
Existing IDM Systems◦ Microsoft Windows CardSpace [W. A. Alrodhan]◦ OpenID [http://openid.net]◦ PRIME [S. F. Hubner, Karlstad Univ]
These systems require a trusted third party trusted third party and do not work on
an untrusted hostuntrusted host..
If Trusted Third Party is compromised, all the identifying information
of the users is also compromised leading to serious problems likeIdentity Theft.Identity Theft.
[AT&T iPad leakAT&T iPad leak]
Identity Management Identity Management (IDM)(IDM) Microsoft Windows CardSpace
Windows CardSpace is an Identity-metasystem which provides a way, for managing multiple digital identities of a user. It is claims based access platform/ architecture, developed for windows XP. It uses a plug-in for Internet explorer 7 browser.
OpenID
With OpenID a user uses one username and one password to access many web applications. The user authenticate to an OpenID server to get his/her OpenID token in order to authenticate itself to web applications.
PRIME (Privacy and Identity Management for Europe)
PRIME, is an application -the PRIME Console middleware running on a user’s machine, It handles management and disclosure of personal data for the user.
IDM in Cloud ComputingIDM in Cloud ComputingCloud introduces several issues to IDM
◦ Collusion between Cloud Services Users have multiple accountsmultiple accounts associated with multiple multiple
service providers.service providers. Sharing sensitive identity information between services can
lead to undesirable mapping of the identities to the mapping of the identities to the user.user.
◦Lack of trust Cloud hosts are untrusted Use of Trusted Third Party is not an
option ◦Loss of control Service-centric IDM Model
IDM in Cloud needs to be user-centric
Goals of Proposed User-Goals of Proposed User-Centric IDM for the CloudCentric IDM for the Cloud
1.Authenticate without disclosing identifying information
2.Ability to securely use a service while on an untrusted host (VM on the cloud)
3.Minimal disclosure and minimized risk of disclosure during communication between user and service provider (Man in the Middle, Side Channel and Correlation Attacks)
4.Independence of Trusted Third Party for identity information
Mechanisms in Proposed Mechanisms in Proposed IDMIDM
Active Bundle [L. Othmane, R. Ranchal]Anonymous Identification [A. Shamir]Computing Predicates with encrypted
data [E. Shi]Multi-Party Computing [A. Shamir]Selective Disclosure [B. Laurie]
Active BundleActive Bundle• Active bundle Active bundle (ABAB)
– An encapsulating mechanism protectingprotecting datadata carried withinwithin it
– Includes datadata– Includes metadatametadata used for managing confidentiality
• Both privacy of data and privacy of the whole AB
– Includes Virtual Machine (VM)• performing a set of operationsoperations
• protectingprotecting its confidentialityconfidentiality
• Active Bundles—OperationsActive Bundles—Operations– Self-Integrity checkSelf-Integrity check
E.g., Uses a hash function
– Evaporation/ FilteringEvaporation/ FilteringSelf-destroys (a part of) AB’s sensitive data when threatened with a disclosure
– ApoptosisApoptosisSelf-destructs AB’s completely
Active Bundle SchemeActive Bundle Scheme– Metadata:Metadata:
• Access control policies• Data integrity checks• Dissemination policies• Life duration• ID of a trust server• ID of a security server• App-dependent information• …
– Sensitive Data:Sensitive Data:• Identity
Information• ...
– Virtual Machine Virtual Machine (algorithm):(algorithm):
• Interprets metadata• Checks active bundle
integrity• Enforces access and
dissemination control policies
• …
• E(Name)• E(E-mail)• E(Password)• E(Shipping Address)• E(Billing Address)• E(Credit Card)• …
* E( ) - Encrypted Information
Anonymous IdentificationAnonymous Identification
User on Amazon Cloud
1. E-mail2. Password
1. E-mail2. Password
User Request for service
Function f and number k
fk(E-mail, Password) = R
ZKP Interactive Protocol
Authenticated
• Use of Zero-knowledge proofing for user authentication without disclosing its identifier.
Interaction using Active Interaction using Active Bundle Bundle
ActiveBundle (AB)
Security ServicesAgent (SSA)
Active Bundle Services
User Application
Active Bundle Coordinator
Active Bundle Creator
DirectoryFacilitator
Active Bundle Destination
Trust EvaluationAgent (TEA)
Audit ServicesAgent (ASA)
Active Bundle
AB information disclosure
Predicate over Encrypted Predicate over Encrypted DataData
• Verification without disclosing unencrypted identity data.
• E-mail• Password• E(Name)• E(Shipping Address)• E(Billing Address)• E(Credit Card)
• E(Name)• E(Billing Address)• E(Credit Card)
Predicate Request*
*Age Verification Request*Credit Card Verification Request
Multi-Party ComputingMulti-Party Computing• To become independent of a trusted third party
• Multiple Services hold shares of the secret key
• Minimize the risk
• E(Name)• E(Billing Address)• E(Credit Card)
Key Management Services
K’1 K’
2 K’3 K’
n
Predicate Request
* Decryption of information is handled by the Key Management services
Multi-Party ComputingMulti-Party Computing• To become independent of a trusted third party
• Multiple Services hold shares of the secret key
• Minimize the risk
• Name• Billing Address• Credit Card
Key Management Services
K’1 K’
2 K’3 K’
n
Predicate Reply*
*Age Verified*Credit Card
Verified
Selective DisclosureSelective Disclosure
• E-mail• Password• E(Name)• E(Shipping Address)• E(Billing Address)• E(Credit Card)
Selective disclosure*
• E-mail• E(Name)• E(Shipping Address)
• User Policies in the Active Bundle dictate dissemination
*e-bay shares the encrypted information based on the user policy
Selective DisclosureSelective Disclosure
• E-mail• E(Name)• E(Shipping Address)
Selective disclosure*
• E(Name)• E(Shipping Address)
*e-bay seller shares the encrypted information based on the user policy
Selective DisclosureSelective Disclosure
• E-mail• E(Name)• E(Shipping Address)
Selective disclosure
• Name• Shipping Address
• Decryption handled by Multi-Party Computing as in the previous slides
Selective DisclosureSelective Disclosure
• E-mail• E(Name)• E(Shipping Address)
Selective disclosure
• Name• Shipping Address
• Fed-Ex can now send the package to the user
Identity in the CloudIdentity in the Cloud
User on Amazon Cloud
• Name• E-mail• Password• Billing Address• Shipping Address• Credit Card
• Name• Shipping Address
• Name• Billing Address• Credit Card
• E-mail• Password
Characteristics and Characteristics and AdvantagesAdvantages
Ability to use Identity data on untrusted hosts• Self Integrity Check
• Integrity compromised- apoptosis or evaporation
• Data should not be on this host
Establishes the trust of users in IDM ◦ Through putting the user in control of who has his
data and how is is used ◦ Identity is being used in the process of
authentication, negotiation, and data exchange. Independent of Third Party for Identity
Information◦ Minimizes correlation attacks
Minimal disclosure to the SP◦ SP receives only necessary information.
Conclusion & Future Work Conclusion & Future Work Problems with IDM in Cloud
Computing◦Collusion of Identity Information◦Prohibited Untrusted Hosts◦Usage of Trusted Third Party
Proposed Approaches◦ IDM based on Anonymous Identification◦ IDM based on Predicate over Encrypted
data◦ IDM based on Multi-Party Computing
Future work◦Develop the prototype, conduct
experiments and evaluate the approach
ReferencesReferences[1] C. Sample and D. Kelley. Cloud Computing Security: Routing and DNS
Threats, http://www.securitycurve.com/wordpress/, June 23,2009.
[2] W. A. Alrodhan and C. J. Mitchell. Improving the Security of CardSpace, EURASIP Journal on Information Security Vol. 2009, doi:10.1155/2009/167216, 2009.
[3] OPENID, http://openid.net/, 2010.
[4] S. F. Hubner. HCI work in PRIME, https://www.prime-project.eu/, 2008.
[5] A. Gopalakrishnan, Cloud Computing Identity Management, SETLabsBriefings, Vol7, http://www.infosys.com/research/, 2009.
[6] A. Barth, A. Datta, J. Mitchell and H. Nissenbaum. Privacy and Contextual Integrity: Framework and Applications, Proc. of the 2006 IEEE Symposium on Security and Privacy, 184-198.
[7] L. Othmane, Active Bundles for Protecting Confidentiality of Sensitive Data throughout Their Lifecycle, PhD Thesis, Western Michigan Univ, 2010.
[8] A. Fiat and A. Shamir, How to prove yourself: Practical Solutions to Identification and Signature Problems, CRYPTO, 1986.
[9] A. Shamir, How to Share a Secret, Communications of the ACM, 1979.
[10] M. Ben-Or, S. Goldwasser and A. Wigderson, Completeness theorems for non-cryptographic fault-tolerant distributed computation, ACM Symposium on Theory of Computing, 1988.
[11] E. Shi, Evaluating Predicates over Encrypted Data, PhD Thesis, CMU, 2008.
Thank you!
Any question?
Approach - 1Approach - 1
IDM Wallet: ◦ Use of AB scheme to protect PII from
untrusted hosts.
Anonymous Identification: ◦ Use of Zero-knowledge proofing for
authentication of an entity without disclosing its identifier.
Components of Active Components of Active Bundle (Approach – 1)Bundle (Approach – 1)
Identity data: Data used during authentication, getting service, using service (i.e. SSN, Date of Birth).
Disclosure policy: A set of rules for choosing Identity data from a set of identities in IDM Wallet.
Disclosure history: Used for logging and auditing purposes.
Negotiation policy: This is Anonymous Identification, based on the Zero Knowledge Proofing.
Virtual Machine: Code for protecting data on untrusted hosts. It enforces the disclosure policies.
Anonymous Identification Anonymous Identification (Approach – 1)(Approach – 1)
Anonymous Identification (Shamir's approach for Credit Cards)
IdP provides Encrypted Identity Information to the user and SP.
SP and User interact Both run IdP's public function on
the certain bits of the Encrypted data.
Both exchange results and agree if it matches.
Usage Scenario (Approach Usage Scenario (Approach – 1)– 1)
Approach - 2Approach - 2 Active Bundle schemeActive Bundle scheme to protect
PII from untrusted hosts Predicates over encrypted dataPredicates over encrypted data
to authenticate without disclosing unencrypted identity data.
Multi-party computingMulti-party computing to be independent of a trusted third party
Usage Scenario (Approach Usage Scenario (Approach – 2)– 2)
Owner O encrypts Identity Data(PII) using algorithm Encrypt and O’s public key PK. Encrypt outputs CT—the encrypted PII.
SP transforms his request for PII to a predicate represented by function p.
SP sends shares of p to the n parties who hold the shares of MSK.
n parties execute together KeyGen using PK, MSK, and p, and return TKp to SP.
SP calls the algorithm Query that takes as input PK, CT, TKp and produces p(PII) which is the evaluation of the predicate.
The owner O is allowed to use the service only when the predicate evaluates to “true”.
Representation of identity Representation of identity information for negotiationinformation for negotiation
Token/Pseudonym Identity Information in clear plain textActive BundleActive Bundle
Motivation: Motivation: Authentication Process using Authentication Process using
PIIPII
Problem: Which information to disclose and how to disclose it.