Privacy as a Service Raymond Cheng Build practical cloud services - PowerPoint PPT Presentation

Security Goal: Indistinguishability Any two access sequences from a client look indistinguishable to the adversary Randomness Randomness Randomness Randomness Randomness Randomness Randomness Randomness Randomness Randomness Randomness Randomness 57

Talek Goals Security Goal: Indistinguishability Any two access sequences from a client look indistinguishable to the adversary Systems Goals: • Mobile-friendly: 1 message per request/response • Efficient: Thousands of online users sending a message every 5 seconds • General Purpose: messaging and newsfeeds • Low latency: ~5-10s 58

Limitations Country W Country X Country Y Country Z ● Any unavailable cloud will prevent access ● Host in widely used cloud providers 59

Anytrust Threat Model Country W Country X Country Y Country Z ● Application configured with >1 independent clouds ● Clouds logging everything about users At least 1 non-colluding 60

Talek Threat Model Trusted groups Anytrust: At least 1 non-colluding Mutually distrusting users 61

Private Information Retrieval (PIR) (Chor,1998) B0 B1 B2 B3 B4 B0 B1 B2 B3 B4 B0 B1 B2 B3 B4 Read bucket 2 Client q’=[0,0,1,0,0] 62

Private Information Retrieval (PIR) B0 B1 B2 B3 B4 B0 B1 B2 B3 B4 B0 B1 B2 B3 B4 q0=[1,1,1,0,1] q1=[1,0,1,0,0] Random Random Read bucket 2 Client q’=[0,0,1,0,0] 63

Private Information Retrieval (PIR) B0 B1 B2 B3 B4 B0 B1 B2 B3 B4 B0 B1 B2 B3 B4 q0=[1,1,1,0,1] q1=[1,0,1,0,0] q2=[0,1,1,0,1] =q’ ⊕ q0 ⊕ q1 Read bucket 2 Client q’=[0,0,1,0,0] 64

Private Information Retrieval (PIR) B0 B1 B2 B3 B4 B0 B1 B2 B3 B4 B0 B1 B2 B3 B4 q0=[1,1,1,0,1] q1=[1,0,1,0,0] q2=[0,1,1,0,1] =q’ ⊕ q0 ⊕ q1 B0 ⊕ B1 ⊕ B2 ⊕ B4 B0 ⊕ B2 B1 ⊕ B2 ⊕ B4 Client 65

Private Information Retrieval (PIR) B0 B1 B2 B3 B4 B0 B1 B2 B3 B4 B0 B1 B2 B3 B4 q0=[1,1,1,0,1] q1=[1,0,1,0,0] q2=[0,1,1,0,1] =q’ ⊕ q0 ⊕ q1 B0 ⊕ B1 ⊕ B2 ⊕ B4 B0 ⊕ B2 B1 ⊕ B2 ⊕ B4 B0 ⊕ B1 ⊕ B2 ⊕ B4 ⊕ B0 ⊕ B2 ⊕ B1 ⊕ B2 ⊕ B4 Client = B2 66

PIR Limitations ● Expensive: Read requires scan of database ● Equal-sized buckets ● Consistent snapshots across all servers ● Read-only 67

Client Indistinguishability PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR PIR 68

Talek Overview Write Read write queue read queue subscribe() publish() libtalek Client 69 Application

Talek Overview Oblivious logging enables servers to operate Write Read on noise, while delivering pub/sub functionality write queue read queue subscribe() publish() libtalek Client 70 Application

Oblivious Logging 1. How do we bound the cost of a PIR operation? 2. How do publishers write in a way that looks random? 3. How do subscribers find messages on the server? 4. How do we deal with write conflicts? 5. How do we keep all servers consistent? 71

Fixed Size Server-side State n n n Write Read write queue read queue subscribe() publish() libtalek Client 72 Application

Fixed Size Server-side State n n n 1. PIR Cost Write Read Bound the cost of a PIR by configuring the size of the database write queue read queue subscribe() publish() libtalek Client 73 Application

Oblivious Logging Write(bucket, encryptedMsg) n 1. Remove oldest message 2. Insert message at specified bucket 74

Oblivious Logging Write(bucket, encryptedMsg) n 1. Remove oldest message 2. Insert message at specified bucket 2. Random writes Write encrypted messages to random buckets 75

Topics and Log Trails Write(bucket, encryptedMsg) 3 4 Topic Handle: n { topicId: uint128, encKey: byte[] seed: uint128 2 } Log Trail: 1 PRF(seed, seqNo) mod n 76

Topics and Log Trails Write(bucket, encryptedMsg) 3 4 Topic Handle: n { 3. Zero Coordination topicId: uint128, Publishers and subscribers use secret topic encKey: byte[] seed: uint128 handles to coordinate 2 } Log Trail: 1 PRF(seed, seqNo) mod n 77

Indistinguishable Writes { topicId: uint128, encKey: byte[], seed: uint128 } Write bucket payload Dummy PRF(idleSeed, i | 1) mod b Enc(idleKey, PRF(idle, i | 2)) Legitimate PRF(seed, seqNo) mod b Enc(encKey, message) 78

Handling Conflicts 3 Write(bucket, encryptedMsg) 4 n 2 1 79

Cuckoo Hashing Write(bucket1,bucket2,encryptedMsg) n 80

Cuckoo Evictions Write(bucket1,bucket2,encryptedMsg) n Eviction 81

Cuckoo Hashing 4 Write(bucket1,bucket2,encryptedMsg) 3 Topic Handle: { 4 topicId: uint128, 1 2n encKey: byte[] seed1: uint128 2 seed2: uint128 } 2 Log Trail: PRF(seed1, seqNo) mod n 1 3 PRF(seed2, seqNo) mod n 82

Blocked Cuckoo Table 3 4 2 { topicId: uint128, encKey: byte[] 1 5 seed1: uint128, seed2: uint128 4 } b 3 PRF(seed1, seqNo) mod b 2 5 PRF(seed2, seqNo) mod b 1 d 83

Blocked Cuckoo Table 3 4 2 { topicId: uint128, encKey: byte[] 1 5 seed1: uint128, seed2: uint128 4 } b 3 4. Dense data structures Blocked cuckoo hashing handles writes conflicts with high density PRF(seed1, seqNo) mod b 2 5 PRF(seed2, seqNo) mod b 1 d 84

Consistency Follower Leader Follower Writes globally Read requests ordered encrypted write queue read queue subscribe() publish() libtalek Client 85 Application

Consistency Follower Leader Follower 4. Leaders enforce consistency Writes globally Read requests Timestamp ordering achieves sequential ordered encrypted consistency write queue read queue subscribe() publish() libtalek Client 86 Application

Indistinguishable Writes { topicId: uint128, seed1: uint128, seed2: uint128, encKey: byte[] } Write bucket1 bucket2 payload Dummy PRF(idle, i | 1) mod b PRF(idle, i | 2) mod b Enc(idle, PRF(idle, i | 3)) Legitimate PRF(seed1, seqNo) mod b PRF(seed2, seqNo) mod b Enc(encKey, message) 87

Indistinguishable Reads { topicId: uint128, seed1: uint128, seed2: uint128, encKey: byte[] } Read server0 server1 server2 Dummy Enc(serverKey0, pirVector) Enc(serverKey1, pirVector) Enc(serverKey2, pirVector) Legitimate Enc(serverKey0, pirVector) Enc(serverKey1, pirVector) Enc(serverKey2, pirVector) 88

Scheduling Reads Follower Leader Follower Topic 1 write queue read queue Topic 2 Topic 3 subscribe() publish() libtalek Client 89 Application

Private Notifications Follower Leader Follower GetUpdates() returns Global Interest Vector: Privately which messages readable on the server Topic 1 write queue read queue Topic 2 Topic 3 subscribe() publish() libtalek Client 90 Application

Talek Overview Follower Leader Follower Write GetUpdates Read Topic 1 write queue read queue Topic 2 Topic 3 subscribe() publish() libtalek Client 91 Application

Experiment Setup AWS EC2 Write every 5 sec Read every 5 sec Thousands of Clients write queue read queue subscribe() publish() libtalek 92 Messaging

Comparison to Previous Work 93

Comparison to Previous Work Pung (OSDI 2016): - Stronger threat model - Uses computational PIR 94

Comparison to Previous Work Riposte (Oakland 2015): - Same threat model - Anonymous writes by “PIR in reverse” 95

Scaling Clients 96

https://github.com/privacylab/talek 97

Future Work: Scale Private Cloud Services Scale out architectures 98

Future Work: Support Diverse Functionality Oblivious Cloud Services Machine Storage Pub/Sub Analytics Search Learning Scale out architectures 99

Future Work: Application Integration Oblivious Cloud Services Machine Storage Pub/Sub Analytics Search Learning Scale out architectures Application Integration 100