Prototyping an Armored Data Vault

Rights Management on Big Brother’s Computer
  • Alex Iliev
  • Sean Smith
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 2482)


This paper reports our experimental work in using commercial secure coprocessors to control access to private data. In our initial project, we look at archived network traffic. We seek to protect the privacy rights of a large population of data producers by restricting computation on a central authority’s machine. The coprocessor approach provides more flexibility and assurance in specifying and enforcing access policy than purely cryptographic schemes. This work extends to other application domains, such as distributing and sharing academic research data.


Access Policy Cryptographic Scheme Private Information Retrieval Decoder Operation Packet Detection 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Charles Antonelli, Kevin Coffman, J. Bruce Fields, and Peter Honeyman. Cryptographic wiretapping at 100 megabits. In SPIE 16th Annual International Symposium on Aerospace/Defense Sensing, Simulation, and Controls, Orlando, Apr 2002.Google Scholar
  2. 2.
    C.J. Antonelli, M. Undy, and P. Honeyman. The packet vault: Secure storage of network data. In Proc. USENIX Workshop on Intrusion Detection and Network Monitoring, Santa Clara, April 1999.Google Scholar
  3. 3.
    Dmitri Asonov and Johann-Christoph Freytag. Almost optimal private information retrieval. In Proc. Privacy Enhancing Technologies, San Francisco, Apr 2002.Google Scholar
  4. 4.
    Steven Bellovin, Matt Blaze, David Farber, Peter Neumann, and Eugene Spafford. Comments on the Carnivore system technical review., December 2000.
  5. 5.
    M. Blaze, J. Feigenbaum, J. Ioannidis, and A. Keromytis. The KeyNote trustmanagement system version 2. RFC 2704,, Sept 1999.
  6. 6.
    Matt Blaze, Joan Feigenbaum, and Jack Lacy. Decentralized trust management. In Proc. IEEE Conference on Security and Privacy, Oakland, CA, May 1996.Google Scholar
  7. 7.
    Matt Blaze, Joan Feigenbaum, and Martin Strauss. Compliance checking in the PolicyMaker trust management system. In Financial Cryptography. Springer, 1998.Google Scholar
  8. 8.
    Mike Bond and Ross Anderson. API-level attacks on embedded systems. Computer, 34(10):67–75, Oct 2001.Google Scholar
  9. 9.
    E. Etu and J. McIsaac. Bringing PKI to Dartmouth. Class Project, CS88, Dartmouth College, June 2001.Google Scholar
  10. 10.
    FBI. Carnivore diagnostic tool., Mar 2001.
  11. 11.
    Internet Engineeringt Task Force. Simple public key infrastructure (SPKI)., 1997.
  12. 12.
    R. Gennaro, P. Karger, S. Matyas, M. Peyravian, A. Roginsky, D. Safford, M. Willett, and N. Zunic. Two phase cryptographic key recovery system. Computers and Security, 16(6):481–506, 1997.CrossRefGoogle Scholar
  13. 13.
    Amir Herzberg, Yosi Mass, Joris Michaeli, Yiftach Ravid, and Dalit Naor. Access control meets public key infrastructure, or: Assigning roles to strangers. In Proceedings of the 2000 IEEE Symposium on Security and Privacy (S&P 2000), Berkeley, CA, May 2000. IEEE.Google Scholar
  14. 14.
    IBM. IBM 4758 PCI Cryptographic Coprocessor Custom Software Interface Reference,
  15. 15.
    N. Knight. College’ Net security gets $1.5m. The Dartmouth, Feb 1 2002.
  16. 16.
    National Institute of Standards and Technology. Security requirements for cryptographic modules. Federal Information Processing Standards Publication 140-1, 1994.Google Scholar
  17. 17.
    Sandra Payette and Carl Lagoze. Policy-carrying, policy-enforcing digital objects. In J. Borbinha and T. Baker, editors, ECDL 2000, pages 144–157, Lisbon, Portugal, 2000.Google Scholar
  18. 18.
    Martin Roesch. Snort-lightweight intrusion detection for networks. In 13th Systems Administration Conference-LISA’ 99. USENIX, November 1999.Google Scholar
  19. 19.
    Sean W. Smith and Steve Weingart. Building a high-performance, programmable secure coprocessor. Computer Networks, 31:831–860, 1999.CrossRefGoogle Scholar
  20. 20.
    Stephen P. Smith, Jr. Henry H. Perritt, Harold Krent, and Stephen Mencik. Independent technical review of the Carnivore system., Dec 2000.
  21. 21.
    S.W. Smith. Outbound authentication for programmable secure coprocessors. Technical Report TR2001-401, Department of Computer Science, Dartmouth College, March 2001.
  22. 22.
    S.W. Smith, C.J. Antonelli, and Peter Honeyman. Proposal: the armored packet vault. Draft, Sep 2000.Google Scholar
  23. 23.
    S.W. Smith, R. Perez, S.H. Weingart, and V. Austel. Validating a high-performance, programmable secure coprocessor. In 22nd National Information Systems Security Conference. National Institute of Standards and Technology, October 1999.Google Scholar
  24. 24.
    S.W. Smith and D. Safford. Practical server privacy using secure coprocessors. IBM Systems Journal, 40(3), 2001. (Special Issue on End-to-End Security).Google Scholar
  25. 25.
    Statewatch. European parliament and EU governments on a collision course over the retention of data., Nov 2001.
  26. 26.
    Dan Wallach. Copy protection technology is doomed. Computer, 34(10):48–49, Oct 2001.Google Scholar
  27. 27.
    Bennet Yee and J. D. Tygar. Secure coprocessors in electronic commerce applications. In Proc. First USENIX workshop on Electronic Commerce, New York, NY, July 1995.Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2003

Authors and Affiliations

  • Alex Iliev
    • 1
  • Sean Smith
    • 1
  1. 1.Department of Computer Science/Institute for Security Technology StudiesDartmouth CollegeCanada

Personalised recommendations