1. Protection of Identity Information in Cloud Computing without Trusted Third Party 作者 :Rohit Ranchal, Bharat Bhargave, Lotfi Ben Othmane, Leszek Lilien, Anya Kim, Myong Kang, Mark Linderman IEEE International Symposium on Reliable Distributed System 報告日期 :12.13 報告者 : 許睿中

2. Outline Introduction Relate works Select research problems Proposed schemes ◦ Multi-party computing ◦ Predicate encryption scheme ◦ Active Bundle Scheme Conclusions

3. Introductions In cloud computing, entities may have multi accounts associate with a single or multi service provider(SP). Share sensitive identity information(Personal identifiable information or PII) along with associated attributes of the same entity across services can be lead to mapping of the identity to the entity, tantamount to privacy loss.

4. Introductions Identity management(IDM) is one of the core components in cloud privacy and security and can help alleviate some of the problems associated with cloud computing. To used a cloud service, a user need to authenticate herself to it. The user has to give away some private information, which uniquely identifies the user to SP. That is user’s PII(Personal identifiable information).

5. Introductions Obtaining the user’s PII gives some assurance to SPs about the user’s identity, which helps SP to decide whether to permit to its service or not. The propose of an IDM system is to decide upon the disclosure of this information in a secure manner. The main problem for Bob is to decide which portion of his PII should he disclose, and how do disclose it in a secure way.

6. Relate works Different solutions use different ways of sending user’s PII for negotiation with the SPs. The common ways are: ◦ Use of a Trusted Third Party(TTP). The major issue with such approach in cloud computing are:  (a) TTP could be a cloud service, so SP could be TTP ; therefore, TTP may not be an independent trusted entity anymore.  (b) Using a single TTP.

7. Relate works Different solutions use different ways of sending user’s PII for negotiation with the SPs. The common ways are: ◦ Prohibiting untrusted host. A client application holding PII must be executed on trusted host to prevent malicious host from accessing PII.

8. Select Research Problems Authenticating without disclosing PII ◦ When a user sends PII to authenticate for a service, the user may encrypt it. However, PII is decrypted before an SP uses it. As soon as PII is decrypted, it becomes prone to attacks. Using services on untrusted host ◦ The available IDM solutions require user to execute IDM from a trusted host. They do not recommend using IDM on untrusted hosts, such as public host

9. Proposed scheme The goal in the paper is to assure that IDM does not use TTP for verifying credentials. This implies that IDM could use TTPs for other purpose, such as the use of a TTP by IDM for management of decryption key.

10. Proposed scheme Proposed an approach for IDM in cloud computing that: ◦ Does not require TTPS  This is achieved through the use of multi-party computing, in which secret are split into shares distributed to different hosts.

11. Proposed scheme Proposed an approach for IDM in cloud computing that: ◦ Can be used for an untrusted or unknown hosts  This is achieved though the use of the active bundle scheme. An active bundle has a self-integrity check mechanism, which triggers apoptosis(a complete self- destruction) or evaporation(a partial self-destruction) when the check fails.

12. Proposed scheme Proposed an approach for IDM in cloud computing that: ◦ Uses encrypted data when negotiating the use of PII for authentication to services in cloud computing  This is achieved by using predicate over encrypted data.

13. Multi-party computing Threshold secret sharing ◦ First, a secret data item D is divided into n shares D 1, D 2, …, D n, then a threshold k is chosen, so that:  To recover D, k or more of arbitrary D i ’s are required.  Using any k-1 or fewer D i ’s leaves D completely undetermined.

14. A function f using secret input from all the party. Involves n party, which calculate only partial function output. One of the player is selected as the dealer(DLR), and is provide the partial function outputs to find out the full results of function computation. Let f be a linear function of degree n known to each of the n party, and t be an arbitrary threshold value, and P i denote Party i, and x i denote the secret input of P i for f. Multi-party computing

15. Let a 1, a 2, …,a n be distinct non-zero elements in the domain of f. Player P i is assigned the point a i. DLR will receive from the n parties the partial outputs of f calculated by the n parties using their respective secret inputs x 1, x 2,…, x n. Each party P i generates a polynomial h i of degree t such that h i (0)=x i Multi-party computing

16. Each party P i send to each P j one s i,j =h i (a j ) of P j ’s input. Then, each P i computes a portion of function f using share s i,j of the input that it has or received from n-1 other parties.

17. Predicate encryption scheme Predicate encryption scheme allows evaluating predicate with encrypted data. ◦ For example, Alice can compute the predicate using encrypted data. ◦ Alice uses a Setup algorithm scheme that generate a public key PK and a secret key MSK. 1.Setup PK,MSK 2.Encrypt(PK,PII) CT 3.KeyGen(PK,MSK,p) TK P 4.Query(PK,CT,TKp) p(PII)

18. Predicate encryption scheme Predicate encryption scheme allows evaluating predicate with encrypted data. ◦ For example, Alice can compute the predicate using encrypted data. ◦ Alice uses PK to encrypt her PII and gets ciphertext CT. 1.Setup PK,MSK 2.Encrypt(PK,PII) CT 3.KeyGen(PK,MSK,p) TK P 4.Query(PK,CT,TKp) p(PII)

19. Predicate encryption scheme Predicate encryption scheme allows evaluating predicate with encrypted data. ◦ For example, Alice can compute the predicate using encrypted data. ◦ Alice has the function p representing a predicate that she wishes to evaluate for her CT. ◦ She uses the KeyGen algorithm, PK,MAK and p to output the token TK P. 1.Setup PK,MSK 2.Encrypt(PK,PII) CT 3.KeyGen(PK,MSK,p) TK P 4.Query(PK,CT, TK P ) p(PII)

20. Predicate encryption scheme Predicate encryption scheme allows evaluating predicate with encrypted data. ◦ For example, Alice can compute the predicate using encrypted data. ◦ She gives TK P to the host that evaluates the token for CT, and returns the result p(PII) to Alice. 1.Setup PK,MSK 2.Encrypt(PK,PII) CT 3.KeyGen(PK,MSK,p) TK P 4.Query(PK,CT, TK P ) p(PII)

21. Proposed schemes An owner O encrypts PII using algorithm Encrypt and O’s public key PK. Encrypt outputs CT-the encrypted PII. The secret key MSK is spilt between n parties. SP transform his request for PII to a predicate represented by function P. SP send share of p to the n parties who hold the shares of MSK.

22. Proposed schemes The n parties execute together KeyGen using PK, MSK, and P and return TK P to SP. SP call the algorithm Query that take as input PK, CT, TK P and produces p(PII) which is evaluation of the predicate. The owner O is allow to use the service only when the predicate evaluate to “true”.

23. Include: ◦ Identity data:  Data used for authentication, getting service, using service  The data are encrypted ◦ Metadata : Describe active bundle and its privacy policy  (a) integrity check metadata  (b) access control metadata  (c) dissemination control metadata Active Bundle Scheme

24. Includes: ◦ Virtual machine(VM):manages and controls the program code enclosed in a bundle.  Enforcing bundle access control policies through apoptosis, evaporation  Enforcing bundle dissemination policies  Validate bundle integrity ◦ Disclosure policy:  A set of rule for choosing which identity data to disclose

25. Active Bundle Scheme Active bundle send from a source host to the destination. An active bundle ascertain the host’s trust level through a TTP. Using its disclosure policy, it decides whether the host may be eligible to access all or part of bundle’s data, and which portion of sensitive data can be revealed to it.

26. Active Bundle Scheme The remaining data may be evaporated as specified in the access control polies, protecting the data. An active bundle may realize its security is about to be compromised. ◦ It may discover that its self-integrity check fail ◦ Or the trust level of its host is to low The active bundle may choose to apoptosize, that is perform atomically a clean self-destruction.

27. Active Bundle Scheme

29. Conclusions It is very likely that user end up having multiple identities in multiple service providers security repositories, as well as multiple credential and multiple access permissions for different services provided by different SPs. There is a strong need for an efficient and effective privacy-preserving system that is independent of TTPs, able to unambiguously identify users that can be trusted.