1 / 20

Offline Untrusted Storage with Immediate Detection of Forking and Replay Attacks

Offline Untrusted Storage with Immediate Detection of Forking and Replay Attacks. Marten van Dijk, Jonathan Rhodes, Luis Sarmenta Srini Devadas MIT Computer Science and A.I. Laboratory ACM Workshop on Scalable Trusted Computing 2007 November 2007. Overview.

larue
Télécharger la présentation

Offline Untrusted Storage with Immediate Detection of Forking and Replay Attacks

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Offline Untrusted Storage with Immediate Detection of Forking and Replay Attacks Marten van Dijk, Jonathan Rhodes, Luis Sarmenta Srini Devadas MIT Computer Science and A.I. Laboratory ACM Workshop on Scalable Trusted Computing 2007 November 2007

  2. Overview • Goal: Trusted Storage using Untrusted Servers • Constraints • User has several devices • Devices can be online/offline at different times • Devices cannot depend on communicating directly with each other • Examples: • User with multiple mobile devices • Multiple mobile users sharing some data • Problem: How do you immediately detect forking and replay attacks? • Our Paper: How to minimize trusted computing base • and specifically, implement it using TPM 1.2 (without trusted OS) Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  3. The Goal: multiple clients with multiple devices, storing data on multiple untrusted servers Note to self!I owe Bob$500 Note to self!I owe Bob$500 Note to self!I owe Bob$500 Trusted Storage on Untrusted Servers Untrusted Virtual Storage Server store/update retrieve Hash(“… $500” ) Hash(“… $500” ) Hash(“… $500” ) Alice’s device 1 Alice’s device 2 Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  4. The Goal: multiple clients with multiple devices, storing data on multiple untrusted servers Note to self!I owe Bob$100 Note to self!I owe Bob$100 Note to self!I owe Bob$100 Note to self!I owe Bob$500 Trusted Storage on Untrusted Servers Untrusted Virtual Storage Server (old note) store/update retrieve Hash(“… $100” ) Hash(“… $100” ) Hash(“… $100” ) Alice’s device 1 Alice’s device 2 Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  5. The Goal: multiple clients with multiple devices, storing data on multiple untrusted servers Problem: privacy authenticity Freshness ? Note to self!I owe Bob$100 Note to self!I owe Bob$100 Note to self!I owe Bob$100 Note to self!I owe Bob$500 Trusted Storage on Untrusted Servers Untrusted Virtual Storage Server (old note) store/update retrieve Hash(“… $100” ) Hash(“… $100” ) Hash(“… $100” ) Alice’s device 1 Alice’s device 2 Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  6. The Goal: multiple clients with multiple devices, storing data on multiple untrusted servers Problem: privacy authenticity Freshness ? Note to self!I owe Bob$100 Note to self!I owe Bob$100 Note to self!I owe Bob$500 Note to self!I owe Bob$500 Trusted Storage on Untrusted Servers Untrusted Virtual Storage Server (old note) store/update retrieve Hash(“… $100” ) Hash(“… $500” ) Hash(“… $100” ) Alice’s device 1 Alice’s device 2 Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  7. The Goal: multiple clients with multiple devices, storing data on multiple untrusted servers Problem: privacy authenticity Freshness ? How do you guarantee freshness if client’s devices are offline and can’t communicate with each other? Note to self!I owe Bob$100 Note to self!I owe Bob$100 Note to self!I owe Bob$500 Note to self!I owe Bob$500 Trusted Storage on Untrusted Servers Untrusted Virtual Storage Server (old note) store/update retrieve Hash(“… $100” ) Hash(“… $500” ) Hash(“… $100” ) Alice’s device 1 Alice’s device 2 Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  8. Note to self!At time t5,I owed Bob $100 Note to self!At time t5,I owed Bob $100 Note to self!At time t5,I owed Bob $100 Note to self!At time t2,I owed Bob $500 Solution: “Time-stamping” usingMonotonic Counters • Trick: Dedicate a monotonic counter for Alice • For each update, client device (e.g., device 1) • increments counter • Signs note with new counter value • To read and verify,client device (e.g., device 2) • gets current counter value • gets signed note • Verifies that counter value is same as value in signed note • This ensures client receives most recent note Untrusted Virtual Storage Server retrieve: data store/update Alice’s device 2 Alice’s device 1 Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  9. Note to self!At time t5,I owed Bob $100 Note to self!At time t5,I owed Bob $100 Note to self!At time t5,I owed Bob $100 Note to self!At time t2,I owed Bob $500 Current SecureClock Time ist5 Solution: “Time-stamping” using Monotonic Counters • Trick: Dedicate a monotonic counter for Alice • For each update, client device (e.g., device 1) • increments counter • Signs note with new counter value • To read and verify,client device (e.g., device 2) • gets current counter value • gets signed note • Verifies that counter value is same as value in signed note • This ensures client receives most recent note Untrusted Virtual Storage Server retrieve: data + current time store/update Alice’s device 2 Alice’s device 1 Server can’t replay because timestampwill not match current time Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  10. Multi-User System • Data is stored in untrusted server(s) • signed and timestamped • Each User (or file) has its own counter • Problem: • Who keeps the counter? • Some possible solutions • use a trusted device that is always online • require majority of devices to be always online • only guarantee fork consistency Storage Server (Untrusted) File Records (in untrusted storage) Alice: … dataA … ctrIDA ctrValA SignSKA(…) Bob: … dataB … ctrIDB ctrValB SignSKB(…) Charlie: … dataC … ctrIDC ctrValC SignSKC(…) … timestamp … Retrieve and Update Requests … Device A1 Device A2 Device A3 Device B1 Device B2 (SKA,PKA) (SKA,PKA) (SKA,PKA) (SKB,PKB) (SKB,PKB) CounterAmaintained by Alice’s trusted device(s) CounterBmaintained by Bob’s trusted device(s) Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  11. Our Approach • Use untrusted Virtual Counter Manager, but with a Trusted Timestamping Device (TTD) • software and hardware of manager need not be trusted • Our technique • allows single TTD to implement many “virtual” counters (for different users) • can be implemented with TPM 1.2 Storage Server(s) Device A2 Device A3 Device A1 Device B2 Device B1 (SKA,PKA) (SKA,PKA) (SKA,PKA) (SKB,PKB) (SKB,PKB) … Read and Increment Requests … Virtual Counter Manager (Untrusted) PKAIK Virtual Counter Records(in untrusted storage) Logs CounterA: ctrValA confirmA … CounterB: confirmB ctrValB … … … TPM (Trusted) monotonic counter AIK (SKAIK,PKAIK) Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  12. Our Approach • Idea: • for each increment (of any virtual counter), TTD does an IncSign(X), where X contains counter ID of counter being incremented • To prove freshness of counter value, VCM must produce a log of increment certificates up to the current time • Basic idea was presented in STC 06 • New • implementation and experimental results • use of sharing, time-multiplexing to improve performance • fast-read and fast-increment vs. read/increment with validation Storage Server(s) Device A2 Device A3 Device A1 Device B2 Device B1 (SKA,PKA) (SKA,PKA) (SKA,PKA) (SKB,PKB) (SKB,PKB) … Read and Increment Requests … Virtual Counter Manager (Untrusted) PKAIK Virtual Counter Records(in untrusted storage) Logs CounterA: ctrValA confirmA … CounterB: confirmB ctrValB … … … TPM (Trusted) monotonic counter AIK (SKAIK,PKAIK) Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  13. T+1 ctrID ≠ D ctrID ≠ D ctrID ≠ D ctrID ≠ D confirmation certificate for D increment certificate for D increment certificate for D other increment certificates other increment certificates ……. ……. t1 t2 t1+1 t1-1 t2-1 glbClk = T ctrID = D ctrVal = t0 ctrID = D ctrVal = t0 ctrID = D ctrVal = t1 At glbClk =T counter D’s value is equal to t0 t0 is counter D’s most recent value, counter D’s value after its increment is equal to t1 t1 is counter D’s most recent value, counter D’s value after its increment is equal to t2 Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  14. tn-1+1 ctrID ≠ D ctrID ≠ D ctrID ≠ D ctrID ≠ D increment certificate for D increment certificate for D read certificate for global clock other increment certificates other increment certificates ……. ……. tn-1 tn tnow tn+1 tn-1 tnow-1 ctrID = D ctrVal = tn-2 ctrID = D ctrVal = tn-1 tn-2 is counter D’s most recent value, counter D’s value after its increment is equal to tn-1 tn-1 is counter D’s most recent value, counter D’s value after its increment is equal to tn counter D did not increment for tn < glbClk ≤ tnow Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  15. New Variations • Time Multiplexing • A virtual monotonic counter can only be incremented during certain slots of the global counter in the TTD • Sharing • The same value of the global counter can be used for (shared among) multiple virtual counters • Validation • If not critical, then a client may not yet need a validation • If a client wants to validate, then he can immediately do so and immediately detect any forking and replay attacks that may have happened now or in the past Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  16. Experimental Results (a) No multiplexing Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  17. Experimental Results (b) Multiplexing with period 8 Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  18. Experimental Results (c) Multiplexing with period 16 Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  19. Conclusions • We can do trusted storage on untrusted servers and be able to immediately detect forking and replay attacks by using an untrusted server with a trusted timestamping device • TTD can be implemented using existing TPM 1.2 • Sharing, multiplexing, and validation allow for performance improvement • Our experiments showed a single server with a single TPM was able to handle 100’s of virtual counters Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

  20. For more info • Web site: • http://projects.csail.mit.edu/tc • TPM/J (Java-based programming tools for the TPM): http://projects.csail.mit.edu/tc/tpmj/ • Papers • paper in ACM Scalable Trusted Computing Workshop (STC ’06) (under CCS) • MIT CSAIL TR 2006-064 (Sept. 2006) has some more details • http://hdl.handle.net/1721.1/33966 Offline Untrusted Storage w/ Immediate Detection of Replay Attacks

More Related