Cryptographic Enforcement of Segregation of Duty ● “доверяй, но проверяй” – old russian proverb “ rely yet verify ” 17.11.2015 thomas maus ● DeepSec 2015 ● Thomas Maus ◉ thomas.maus alumni.uni-karlsruhe.de
Introduction ● started with IT 1979 – school experiment ● Computer Science, University of Karlsruhe ◉ study + research ◉ EISS = European Institute of System Security ● 1993: self-employed IT security consultant ● some representive talks: ◉ risk analysis + mgmt (DECUS 2003 + others) 17.11.2015 thomas maus ◉ eHealth (in)security (21C3+22C3, various others) ◉ crypto-analytic password quality measures (various) ◉ RFID (in)security (various) ◉ Tale Telling Timings (various)
Introduction … ● home-town: Trier ◉ situated between Eifel and Hunsrück ◉ low population density ➜ scarce public transport facilities ● hitchhiking? ◉ too dangerous … 17.11.2015 thomas maus
Introduction … ● IT supported + secured hitchhiking? ● objectives: ◉ anonymity as far as possible ◎ at least strong pseudonymity ◎ no tracking ◉ crime prevention + prosecution ◎ mutually verifiable registration status ◎ “on-line” transaction registry 17.11.2015 thomas maus ◎ tracking of missing persons by police + next of kin ◉ coordination + matching of travel opportunities and wishes ◉ integration into public transport system ◎ tickets ◎ payment of transport providers
Introduction … ● school administration SW of federal state ◉ developed by participants of school experiment ◉ i.e. mostly by pupils! ◉ chosen by proven computer versatility ◉ e.g. successful hacking of school computer ;-) ● challenge: ◉ forestall impeachment of pupil programmer's 17.11.2015 thomas maus graduation diploma ◉ build confidence in correctness → reliance
Introductory Conclusions ● multi-lateral security needed ● multiple security dimensions ◉ “classical”: confidentiality+integrity+availability ◉ correctness ◉ verifiability / auditability ◉ separation of duties ◉ non-repudation / proof of volition vs. error 17.11.2015 thomas maus ◉ privacy ◎ transparency + control for subject ◎ non-traceability / data minimization ◎ robustness against inference and extrapolation ◉ …
Example for Illustration: Data Retention ● soft or social Science Fiction ◉ “how a technology could transform a society” ◉ hard science core = cryptography ◎ ¼ century around: public-key cryptography ◎ construct of ideas open for debate ◉ soft socio-political outer shell ◎ fictional stances of society and various personas ◎ only for demonstration purposes 17.11.2015 thomas maus ◎ suspense of disbelief requested
Visualization of Cryptographic Instruments ● asymmetric keys of cyan persona (Alice) ◉ private key ◉ public key ● asymmetric keys of red persona (Bob) ● usage examples ◉ sealed (signed) with red private key content- ⚜ ⚜ ◉ encrypted with cyan public key content 17.11.2015 thomas maus ◉ first sealed, then encrypted content- ⚜ ⚜ ◉ first encrypted, then sealed content ⚜ ⚜ ◉ typically implicit and invisible: symmetric keys ◉ decryption possible by Alice or Bob, with detached seal by Carol content ⚜ ⚜
Our fictitious Society: Dramatis Personae ● civil society ◉ constitutional democracy ◉ politically participating citizens (citoyen) ◉ civil rights organisations ● investigative authorities ◉ police detectives ◉ public prosecutor 17.11.2015 thomas maus ● examining magistrate (=Ermittlungsrichter) ● (federal) privacy commissioner ● telecommunication service providers
Civil Rights Dramatis Personae: Civil Society ● ultimate democratic sovereign ◉ votes + referenda ◉ political parties ◉ NGOs ● objectives ◉ active political participation ◉ protect ◎ 17.11.2015 thomas maus constitutional democracy ◎ fundamental human + civil rights ◉ vigilant about ◎ panopticon effect ◎ correct exercise of office by representatives + officials ◉ crime prevention + prosecution
Dramatis Personae: Investigative Authorities ● obligations ◉ crime investigation for prevention + prosecution ● conflicting interests ◉ fundamental civil rights ◎ privacy of correspondence, posts + telecommunications ◎ privacy of the home ◎ … ● intentions 17.11.2015 thomas maus ◉ tactical secrecy of investigation ◉ earning + keeping public confidence ◉ auditability ◉ exoneration capabilities ● public prosecutor's keys
Dramatis Personae: Examining Magistrate ● obligations ◉ individual decisions within legal framework ◉ crime investigation ↔ fundamental rights ● conflicting interests ◉ enable optimal crime investigation ◉ protect fundamental civil rights ● intentions 17.11.2015 thomas maus ◉ tactical secrecy of investigation ◉ earning + keeping public confidence ◉ auditability ◉ exoneration capabilities ● examining magistrate's keys
☂ Dramatis Personae: Federal Privacy Commissioner ● obligations ◉ formal control of disclosure requests ◉ official auditing + statistics + reporting ◉ investigation + information in special cases: e.g. medical doctors, lawyers, priests, … ◉ official investigation of complaints ◉ destruction of own private key in certain cases ● intentions 17.11.2015 thomas maus ◉ protection of fundamental rights within statutes ◉ earning + keeping public confidence ● federal privacy commissioner's keys
Dramatis Personae: Telecommunication ✆ Service Providers ● obligations ◉ provide legally required data structures to investigation authorities ● intentions ◉ compliance ◉ minimal involvement ◉ exoneration capabilities 17.11.2015 thomas maus ➜ rapid erasure of cleartext connection data ● telecommunication provider's keys (pars pro toto)
Manifold Imaginable Socio-Political Decisions ● much flexibility needed within framework! ● creative leeway + areas of decisions ◉ initial data for investigation services? ◉ keeper of data? ◉ sequence of workflows? ◉ veto powers? ◉ … 17.11.2015 thomas maus
Initial Data for Investigation Services ● selection of data to be disclosed ● general data structure ◉ “handle” → “opaque protected data” ◉ “handle” = ◎ information freely available to investigators ◎ not perceived as impairing fundamental rights ◉ “opaque protected data” = ◎ information pertaining to fundamental rights 17.11.2015 thomas maus ◎ accessible only via safeguarded procedure ○ crypto-enforced ○ segregation of duty ○ review + control ○ auditability
Initial Data: The “Handle” ● subset of communication data as selector ● example of inappropriate handles ◉ (calling id, precise start time, precise end time) ◉ (called id, precise start time, precise end time) ☢ correlate time stamps → infere speaking parties ● dilution of precision / obscuration of handles! ◉ protection against inference + extrapolation 17.11.2015 thomas maus ◉ balanced with specificity ● example of diluted handles ◉ (calling id, diluted start time, diluted duration) ◉ (called id, diluted start time, diluted duration) ◉ (diluted location, diluted time period)
Initial Data: The “Handle” ● subset of communication data as selector ● example of inappropriate handles ◉ (calling id, precise start time, precise end time) ◉ (called id, precise start time, precise end time) e.g. ☢ correlate time stamps → infere speaking parties ● per minute ● ⌊5 minutes⌋ ● dilution of precision / obscuration of handles! ● ⌊¼ hours⌋ ◉ protection against inference + extrapolation ● … 17.11.2015 thomas maus ◉ balanced with specificity ● depending on time-of-day ● example of diluted handles ◉ (calling id, diluted start time, diluted duration) ◉ (called id, diluted start time, diluted duration) ◉ (diluted location, diluted time period)
Initial Data: The “Handle” ● subset of communication data as selector ● example of inappropriate handles ◉ (calling id, precise start time, precise end time) ◉ (called id, precise start time, precise end time) ☢ correlate time stamps → infere speaking parties e.g. ● dilution of precision / obscuration of handles! ● per minute ◉ protection against inference + extrapolation ● {<1, <2, <3, <5, <10, <15, …} minutes 17.11.2015 thomas maus ◉ balanced with specificity ● example of diluted handles ◉ (calling id, diluted start time, diluted duration) ◉ (called id, diluted start time, diluted duration) ◉ (diluted location, diluted time period)
Initial Data: The “Handle” ● subset of communication data as selector ● example of inappropriate handles ◉ (calling id, precise start time, precise end time) ◉ (called id, precise start time, precise end time) ☢ correlate time stamps → infere speaking parties ● dilution of precision / obscuration of handles! e.g. ◉ protection against inference + extrapolation ● cell base station 17.11.2015 thomas maus ● precinct ◉ balanced with specificity ● geo coord ⌊arc minute⌋ ● example of diluted handles ● … ◉ (calling id, diluted start time, diluted duration) ● depending on area ◉ (called id, diluted start time, diluted duration) ◉ (diluted location, diluted time period)
Recommend
More recommend
