Scalable Security and Accounting Services for Content-based Publish/Subscribe Systems Himanshu Khurana NCSA, University of Illinois

Introduction B PB SB PB SB B B B B B B B B B B B PB SB B B Border Broker Broker Publisher Subscriber Pub/Sub Infrastructure (e.g., Gryphon, Siena) Applications: software updates, location-based services for wireless networks, supply chain management, traffic control, and stock quote dissemination Three types: Topic-based, type-based, and content-based Content-based considered to be the most general

Security Challenges Addressed for Content-Based Pub/Sub Systems (CBPS) Confidentiality, integrity, and authentication of events Usage-based accounting E.g., for stock quote dissemination Solution Highlights Strong adversarial model: PBs & SBs don’t trust broker network Adversary has access to CBPS network traffic and will attempt to Violate confidentiality of events by observing them Violate integrity and authentication by inserting/modifying fake events and subscriptions No security associations (e.g. keys) needed between PBs and SBs No modifications needed to existing matching & routing algorithms Scales to support an Internet-scale pub/sub infrastructure

Confidentiality Adversary has access to network traffic  contents cannot be disclosed to brokers One approach: perform computations on encrypted data Difficult to implement in practice Require modifications to matching and routing techniques Observation Only selected parts of an event’s content need to be confidential Matching and routing can be accomplished without these parts Our Approach Encode events in XML documents Use Bertino and Ferrari’s XML document dissemination techniques to selectively encrypt sensitive parts of events Distribute keys to authorized subscribers using Jakobsson’s proxy encryption techniques

Confidentiality Examples Encrypted Packages Cleartext Event Contents Message: id 100 YHOO Message: id 100 YHOO E k (70.2) Encrypt Message: id 200 8/5/04 NY-CA 10-3 Message: id 200 8/5/04 NY-CA E k (10-3) Encrypt Enc PK (k) E k ()  symmetric key encryption (e.g., AES) using key k Enc PK ()  El Gamal public key encryption using key PK

Distributing Keys to Authorized Subscribers 123n Proxy Security and Accounting Service (PSAS) … n servers with t of n threshold key sharing Border Broker B 2 PBSB Border Broker B 1 … broker network Register/ Publish RegisterTransform Register/ Receive For each PB, an EG decryption key (x, y): x =  x i where x i is a key share held by any server, y = g x i=1 t RSA Signature Key (K ps, PK ps ): K ps =  K ps i where K ps i is a key share held by any server i=1 t clcl Coordinators c1c1 c2c2 …

Integrity and Authentication Event integrity and authentication Needed to ensure that event contents come from an authentic source and have not been modified We use XML signatures for event integrity and authentication Assume subscribers can verify publisher’s certificates Should signatures be applied on cleartext or encrypted contents? Signing only encrypted contents is considered insecure Signing cleartext contents  intermediate components (e.g. PSAS) can’t verify signature Therefore, use two signatures First one over cleartext, second one over encrypted contents Transformation request integrity and authentication Needed to prevent unauthorized transformations We use XML signatures request integrity and authentication

Protocol Overview PB Register SB Register public key, interests Get Public Key PSAS (n servers, signature key shared in t-of-n manner) B1B1 B2B2 Initialization Co-sign Request Signed Public Key (generate t-of-n decryption key for PB) Publisher and Subscriber Registration

Protocol Overview PB PSAS (transforms event for subscriber) B1B1 B2B2 SB... Publish (pac) Match & Route Deliver (pac’) Transform(pac, PK sb ) Transformation process produces a verifiable certificate Used to provide usage-based accounting Event publication, routing, and delivery

Scalability via multiple PSASs PB PSAS 1 PSAS 2 B1B1 BiBi BjBj SB BtBt... Publish (pac) Match & Route Transform( pac, PK ps2 ) pac’ Forward Match & Route Transform( pac’, PK sb ) pac’’ Deliver (pac’’)

Security Analysis Confidentiality provided by encrypting sensitive contents of events Remain encrypted from publication to delivery Transformation process at PSAS maintains confidentiality Integrity and Authentication provided via digital signatures Subscribers can verify signatures over cleartext contents Brokers and PSAS can verify signatures over encrypted contents Usage- based accounting Publicly verifiable transformation certificates generated by PSAS

Conclusions and Future Work Proposed novel approach for security in CBPS Confidentiality, integrity, and authentication of events Usage-based accounting Future Work Detailed scalability and cost analysis Prototype implementation using Siena (supports XML events) Available threshold cryptographic libraries