Database data security through the lens of cryptographic engineering Eugene Pilyankevich, Chief Technical officer, Cossack Labs
Data breaches, annually 1093 783 781 614 447 419 2011 2012 2013 2014 2015 2016
Airplane crashes, annually 46 33 33 29 23 21 2011 2012 2013 2014 2015 2016
Airplane crashes? 1093 783 781 614 447 419 2011 2012 2013 2014 2015 2016
Sensitive data 101 Any data, leakage or tampering of which can lead to damage to data owner, data holder or related third parties.
Naïve security model
Naïve security model Focused on Ops-driven components
Naïve security model Few generic vectors Passive attacks Smash’n’grab
Securing the naïve security model § encryption-at-rest § encryption-in-transit § access distribution & control § event monitoring
Pragmatic security model
Real attackers are : § Smart and resourceful … targeting an old § Multi-skilled vulnerability that § Many vectors of attack you forgot to patch.
Pragmatic security model Poor perimeter
Pragmatic security model Poor perimeter Active and/or persistent attacks
Pragmatic security model Poor perimeter Active and/or persistent attacks Data-specific attacks
Pragmatic security model Poor perimeter Active and/or persistent attacks Data-specific attacks Systematic approach
… anything else?
Idealistic security model
Idealistic security model : Future is now Future is reliable Working as guinea pig is a great idea
Idealistic security model : Less than 10 years in public Assumptions assumptions Not tested in production
Database encryption
What does encryption do? Encryption narrows attack surface from data to keys
Database encryption Modern Classic
Classic attacks § Smash ‘n’ grab § Snapshot attacker § Persistent passive attacker
Сlassic encryption? Row/column/table Database files Full disk encryption
Сlassic encryption? Row/column/table NO DIFFE IFFERENCE Database files Full disk encryption
Сlassic encryption, defeated Leak keys: § Host compromise or snapshot § MiTM to leak from traffic Leak plaintext: § Host compromise § Passive/active MiTM § Source compromise
Extended classic security Protect data Protect database host Protect transport
Typical modern attacks § Flow alternation (SQL Injection) § VM image leak § Full compromise (temporary or persistent)
Emerging DB attacks
Emerging attacks Write inference : § Reconstruct transaction from logs § Time transactions via bin logs to infer data Read inference: § Buffer pool § Slow query log if no full log is present
Emerging attacks SQL Injections to grab contents of diagnostic tables. information_schema.processlist, performance_schema.threads . See also: events_statements_current, events_statements_history
Emerging attacks § Snapshot attacks to get memory contents of: § Adaptive hash index § Query cache § Process heap (surprisingly revealing)
New sources of risk Access patterns Communication volume
Practicalities
Limit leakage § Limit key leakage : fetch keys from remote side, purge from memory before/after encryption § Limit data leakage : many keys, make one leak least problematic
Offload § Encrypt/store keys on HSM . § Proxies! … not without drawbacks.
Client-side encryption § Libraries § Various encryption schemes … not without drawbacks
Encrypted databases Client-side trust • Novel crypto scheme enabling remote • operations on ciphertext Still a bit of a naïve model •
Ideally we want… New ciphers?
Constant failure so exciting! NEW ATTACKS! DISPUTES ON SECURITY! IMPROVED ATTACKS! PROPOSED FIXES! BETTER ATTACKS! EMERGENCY UPDATES! DIFFERENT ATTACKS! NEW PROTOCOLS!
Constant failure so exciting!
Ideally we want boring crypto Crypto that simply works, solidly resists attacks, never needs any upgrades. Daniel J. Bernstein, famous security/crypto scientist
Realistically we need… New ciphers! Better crypto schemes
Practical ideas Use great stuff § Use it correctly §
Practical ideas § Use proven ciphers: ECC, AES, Salsa20 / ChaCha20. § Don’t roll your own crypto: just don’t. § Use good libraries.
Don’t roll your own crypto § Simple AES-GCM, ways to fail
Don’t roll your own crypto § Simple AES-GCM call, ways to fail § Signed symmetric encryption, ways to fail
Don’t roll your own crypto § Simple AES-GCM call, ways to fail § Signed symmetric encryption, ways to fail § Key wrapped symmetric encryption, ways to fail
Don’t roll your own crypto § Buffer breaks here and now, with a memory fault. § Crypto leaks anywhere at any point in time. Silently .
Don’t roll your own crypto JUST DON’T
Practical ideas • Enforce non-leaky model(s). • Configure with query inference in mind.
Practical ideas • Rotate encryption keys timely. • Revoke keys (rotate on compromise)
Practical ideas • Focus on active attacks: SQL injections & full compromise. • Focus on infrastructure around your DB. • Encrypt what is necessary.
Practical ideas • Use native tools, if they’re well audited. • Use good frameworks : • Encryption: NaCl/Libsodium, Themis, KeyCzar, tink • Encrypted shared access: ZeroKit, Hermes, DocRaid
Thank you! cossacklabs.com ivychapel.ink @9gunpi
Links General interest: Why Your Encrypted Database Is Not Secure , https://eprint.iacr.org/2017/468.pdf Cryptographically protected database search , https://arxiv.org/abs/1703.02014 Generic Attacks on Secure Outsourced Databases , http://scholar.harvard.edu/files/gkellaris/files/genericattacks.pdf Recontructing queries, inference, sensitive data leakage and other indirect attacks: InnoDB Database Forensics series: http://ieeexplore.ieee.org/document/5474822, http://ieeexplore.ieee.org/document/6329240/ Breaking Web Applications Built On Top of Encrypted Data , https://eprint.iacr.org/2016/920 Inference attacks Inference Attacks on Property-Preserving Encrypted Databases, https://cs.brown.edu/~seny/pubs/edb.pdf Database encryption: Protecting sensitive information with database encryption , https://www.owasp.org/images/c/c1/Database_Encryption.ppt Cossack Labs blog, Backend security series, https://www.cossacklabs.com/backend- security-series End-to-end data turnover, my talk at UISGCON 12, https://medium.com/@9gunpi/end-to- end-data-turnover-slides-and-notes-144006269863
Recommend
More recommend
