Prototyping an Armored Data Vault
This paper reports our experimental work in using commercial secure coprocessors to control access to private data. In our initial project, we look at archived network traffic. We seek to protect the privacy rights of a large population of data producers by restricting computation on a central authority’s machine. The coprocessor approach provides more flexibility and assurance in specifying and enforcing access policy than purely cryptographic schemes. This work extends to other application domains, such as distributing and sharing academic research data.
KeywordsAccess Policy Cryptographic Scheme Private Information Retrieval Decoder Operation Packet Detection
Unable to display preview. Download preview PDF.
- 1.Charles Antonelli, Kevin Coffman, J. Bruce Fields, and Peter Honeyman. Cryptographic wiretapping at 100 megabits. In SPIE 16th Annual International Symposium on Aerospace/Defense Sensing, Simulation, and Controls, Orlando, Apr 2002.Google Scholar
- 2.C.J. Antonelli, M. Undy, and P. Honeyman. The packet vault: Secure storage of network data. In Proc. USENIX Workshop on Intrusion Detection and Network Monitoring, Santa Clara, April 1999.Google Scholar
- 3.Dmitri Asonov and Johann-Christoph Freytag. Almost optimal private information retrieval. In Proc. Privacy Enhancing Technologies, San Francisco, Apr 2002.Google Scholar
- 4.Steven Bellovin, Matt Blaze, David Farber, Peter Neumann, and Eugene Spafford. Comments on the Carnivore system technical review. http://www.crypto.com/papers/carnivore_report_comments.html, December 2000.
- 5.M. Blaze, J. Feigenbaum, J. Ioannidis, and A. Keromytis. The KeyNote trustmanagement system version 2. RFC 2704, http://www.crypto.com/papers/rfc2704.txt, Sept 1999.
- 6.Matt Blaze, Joan Feigenbaum, and Jack Lacy. Decentralized trust management. In Proc. IEEE Conference on Security and Privacy, Oakland, CA, May 1996.Google Scholar
- 7.Matt Blaze, Joan Feigenbaum, and Martin Strauss. Compliance checking in the PolicyMaker trust management system. In Financial Cryptography. Springer, 1998.Google Scholar
- 8.Mike Bond and Ross Anderson. API-level attacks on embedded systems. Computer, 34(10):67–75, Oct 2001.Google Scholar
- 9.E. Etu and J. McIsaac. Bringing PKI to Dartmouth. Class Project, CS88, Dartmouth College, June 2001.Google Scholar
- 10.FBI. Carnivore diagnostic tool. http://www.fbi.gov/hq/lab/carnivore/carnivore.htm, Mar 2001.
- 11.Internet Engineeringt Task Force. Simple public key infrastructure (SPKI). http://www.ietf.org/html.charters/spki-charter.html, 1997.
- 13.Amir Herzberg, Yosi Mass, Joris Michaeli, Yiftach Ravid, and Dalit Naor. Access control meets public key infrastructure, or: Assigning roles to strangers. In Proceedings of the 2000 IEEE Symposium on Security and Privacy (S&P 2000), Berkeley, CA, May 2000. IEEE.Google Scholar
- 14.IBM. IBM 4758 PCI Cryptographic Coprocessor Custom Software Interface Reference, http://www-3.ibm.com/security/cryptocards/html/library.shtml.
- 15.N. Knight. College’ Net security gets $1.5m. The Dartmouth, Feb 1 2002. http://www.thedartmouth.com/.
- 16.National Institute of Standards and Technology. Security requirements for cryptographic modules. Federal Information Processing Standards Publication 140-1, 1994.Google Scholar
- 17.Sandra Payette and Carl Lagoze. Policy-carrying, policy-enforcing digital objects. In J. Borbinha and T. Baker, editors, ECDL 2000, pages 144–157, Lisbon, Portugal, 2000.Google Scholar
- 18.Martin Roesch. Snort-lightweight intrusion detection for networks. In 13th Systems Administration Conference-LISA’ 99. USENIX, November 1999.Google Scholar
- 20.Stephen P. Smith, Jr. Henry H. Perritt, Harold Krent, and Stephen Mencik. Independent technical review of the Carnivore system. http://www.usdoj.gov/jmd/publications/carniv_final.pdf, Dec 2000.
- 21.S.W. Smith. Outbound authentication for programmable secure coprocessors. Technical Report TR2001-401, Department of Computer Science, Dartmouth College, March 2001. http://www.cs.dartmouth.edu/~pkilab/oatr.pdf.
- 22.S.W. Smith, C.J. Antonelli, and Peter Honeyman. Proposal: the armored packet vault. Draft, Sep 2000.Google Scholar
- 23.S.W. Smith, R. Perez, S.H. Weingart, and V. Austel. Validating a high-performance, programmable secure coprocessor. In 22nd National Information Systems Security Conference. National Institute of Standards and Technology, October 1999.Google Scholar
- 24.S.W. Smith and D. Safford. Practical server privacy using secure coprocessors. IBM Systems Journal, 40(3), 2001. (Special Issue on End-to-End Security).Google Scholar
- 25.Statewatch. European parliament and EU governments on a collision course over the retention of data. http://www.statewatch.org/news/2001/nov/15eudata.htm, Nov 2001.
- 26.Dan Wallach. Copy protection technology is doomed. Computer, 34(10):48–49, Oct 2001.Google Scholar
- 27.Bennet Yee and J. D. Tygar. Secure coprocessors in electronic commerce applications. In Proc. First USENIX workshop on Electronic Commerce, New York, NY, July 1995.Google Scholar