PRIVACY AND INTEGRITY PRESERVING COMPUTATION IN DISTRIBUTED SYSTEMS By Fei Chen A DISSERTATION Submitted to Michigan State University in partial fulfillment of the requirements for the degree of DOCTOR OF PHILOSOPHY Computer Science 2011 ABSTRACT PRIVACY AND INTEGRITY PRESERVING COMPUTATION IN DISTRIBUTED SYSTEMS By Fei Chen Preserving privacy and integrity of private data has become core requirements for many distributed systems across different parties. In these systems, one party may try to compute or aggregate useful information from the private data of other parties. However, this party is not be fully trusted by other parties. Therefore, it is important to design security protocols for preserving such private data. Furthermore, one party may want to query the useful information computed from such private data. However, query results may be modified by a malicious party. Thus, it is important to design query protocols such that query result integrity can be verified. In this dissertation, we study four important privacy and integrity preserving problems for different distributed systems. For two-tiered sensor networks, where storage nodes serve as an intermediate tier between sensors and a sink for storing data and processing queries, we proposed SafeQ, a protocol that prevents compromised storage nodes from gaining informa- tion from both sensor collected data and sink issued queries, while it still allows storage nodes to process queries over encrypted data and the sink to detect compromised storage nodes when they misbehave. For cloud computing, where a cloud provider hosts the data of an organization and replies query results to the customers of the organization, we propose novel privacy and integrity preserving schemes for multi-dimensional range queries such that the cloud provider can process encoded queries over encoded data without knowing the actual values, and customers can verify the integrity of query results with high probability. For dis- tributed firewall policies, we proposed the first privacy-preserving protocol for cross-domain firewall policy optimization. For any two adjacent firewalls belonging to two different admin- istrative domains, our protocol can identify in each firewall the rules that can be removed because of the other firewall. For network reachability, one of the key factors for capturing end-to-end network behavior and detecting the violation of security policies, we proposed the first cross-domain privacy-preserving protocol for quantifying network reachability. ACKNOWLEDGMENTS I am extremely grateful to my advisor Dr. Alex X. Liu. He is not only an excellent advisor, an outstanding researcher, but also a great friend. This thesis would not be possible without his tremendous help. He always tries his best to guide me through every perspective of my graduate study, and give tremendous support to make me successful in both study and research. He not only teaches me how to identify problems, how to solve problems, and how to build systems, but also helps me improve my writing skills, speaking skills, and communication skills. Numerous times, he helps me set milestones together, and guides me to make progress steadily. When I meet difficult problems in my research, his encouragement help me to gain more confidence, and to come up with solutions. I would like to thank other members in my thesis committee, Dr. Eric Torng, Dr. Richard Enbody, and Dr. Hayder Radha. Dr. Torng not only guided my thesis, but also gave me great help on finding travel funds such that I can present my papers in many conferences. Dr. Enbody and Dr. Radha gave me many valuable suggestions and feedbacks on my qualifying report and comprehensive proposal, which helped improve my thesis significantly. I thank my collaborator and friend Bezawada Bruhadeshwar. He makes significant con- tributions to this thesis work. My work with him is both happy and fruitful. He actively discussed with me the works of privacy preserving firewall optimization and privacy preserv- ing network qualifications and provide significant help to move the project forward. I really thank my wife Xiaoshu Wu and my parents for her great love and tremendous support in every aspect of my life in Michigan State University. They support me to pursue my own goals with confidence and to overcome obstacles with courage. I extremely grateful for my wife taking great care of me when I had serious health problems and stayed in hospital. This thesis is dedicated to my wife and my parents. iv TABLE OF CONTENTS LIST OF TABLES ix LIST OF FIGURES x 1 Introduction 1 1.1 Privacy and Integrity Preserving Queries for SensorNetworks.................................. 2 1.2 Privacy and Integrity Preserving Queries for CloudComputing................................. 3 1.3 Privacy Preserving Optimization for Firewall Policies....................................... 4 1.4 Privacy Preserving Quantification of Network Reachability.................................... 4 1.5 Structureofthepaper .............................. 5 2 Privacy and Integrity Preserving Range Queries in Sensor Networks 7 2.1 Introduction.................................... 7 2.1.1 Motivation................................. 7 2.1.2 TechnicalChallenges ........................... 8 2.1.3 Limitations of Prior Art . 9 2.1.4 OurApproachandKeyContributions . 9 2.1.5 SummaryofExperimentalResults. 10 2.2 ModelsandProblemStatement . .. .. 10 2.2.1 SystemModel............................... 10 2.2.2 ThreatModel ............................... 12 2.2.3 ProblemStatement ............................ 13 2.3 Privacyfor1-dimensionalData . 13 2.3.1 PrefixMembershipVerification . 14 2.3.2 TheSubmissionProtocol. .. .. 16 2.3.3 TheQueryProtocol ........................... 17 2.3.4 QueryProcessing ............................. 18 2.4 Integrityfor1-dimensionalData . .. 19 2.4.1 Integrity Scheme Using Merkle Hash Trees . 20 2.4.2 Integrity Scheme Using Neighborhood Chains . 23 2.5 Queries over Multi-dimensional Data . 24 2.5.1 Privacy for Multi-dimensional Data . 25 2.5.2 Integrity for Multi-dimensional Data . 26 v 2.6 SafeQOptimization................................ 29 2.7 QueriesinEvent-drivenNetworks . 32 2.8 Complexity and Security Analysis . 34 2.8.1 Complexity Analysis . 34 2.8.2 PrivacyAnalysis ............................. 35 2.8.3 IntegrityAnalysis............................. 36 2.9 ExperimentalResults............................... 36 2.9.1 EvaluationMethodology . .. .. 36 2.9.2 EvaluationSetup ............................. 37 2.9.3 EvaluationResults ............................ 38 3 Privacy and Integrity Preserving Range Queries for Cloud Computing 47 3.1 Introduction.................................... 47 3.1.1 Motivation................................. 47 3.1.2 TechnicalChallenges ........................... 48 3.1.3 Limitations of Previous Work . 49 3.1.4 OurApproach............................... 49 3.1.5 KeyContributions ............................ 50 3.1.6 SummaryofExperimentalResults. 50 3.2 ModelsandProblemStatement . .. .. 51 3.2.1 SystemModel............................... 51 3.2.2 ThreatModel ............................... 51 3.2.3 ProblemStatement ............................ 52 3.3 Privacy Preserving for 1-dimensional Data . ... 52 3.3.1 The Order-Preserving Hash-based Function . 54 3.3.2 The Privacy-Preserving Scheme . 56 3.3.3 Optimization of the Order-Preserving Hash-based Function . .... 57 3.3.4 Analysis of Information Leakage . 58 3.4 Integrity Preserving for 1-dimensional Data . .... 59 3.4.1 Bit Matrices and Local Bit Matrices . 61 3.4.2 The Integrity-Preserving Scheme . 62 3.5 FindingOptimalParameters........................... 64 3.5.1 Detection Probability . 65 3.5.2 OptimalBucketPartition ........................ 66 3.6 Query Over Multi-dimensional Data . 68 3.6.1 Privacy for Multi-dimensional Data . 68 3.6.2 Integrity for Multi-dimensional Data . 69 3.7 Evaluation..................................... 72 3.7.1 EvaluationSetup ............................. 72 vi 3.7.2 Resultsfor1-dimensionalData . 73 3.7.3 Results for Multi-dimensional Data . 75 4 Privacy Preserving Cross-Domain Cooperative Firewall Optimization 78 4.1 Introduction.................................... 78 4.1.1 BackgroundandMotivation . 78 4.1.2 Limitation of Prior Work . 79 4.1.3 Cross-domain Inter-firewall Optimization . 80 4.1.4 Technical Challenges and Our Approach . 81 4.1.5 KeyContributions ............................ 82 4.2 SystemandThreatModels............................ 83 4.2.1 SystemModel............................... 83 4.2.2 ThreatModel ............................... 84 4.3 Privacy-Preserving Inter-Firewall Redundancy Removal . ........ 84 4.3.1 Privacy-Preserving Range Comparison . 85 4.3.2 Processing Firewall F W1 ......................... 87 4.3.3 Processing Firewall F W2 ......................... 90 4.3.4 Single-Rule Coverage Redundancy Detection . 93 4.3.5 Multi-Rule Coverage Redundancy Detection . 95 4.3.6 Identification and Removal of Redundant Rules . 98 4.4 Firewall Update After Optimization . 100 4.5 Security and Complexity Analysis . 100 4.5.1 SecurityAnalysis ............................. 100 4.5.2 Complexity Analysis . 102 4.6 ExperimentalResults............................... 103 4.6.1 EvaluationSetup ............................. 103 4.6.2 Methodology ............................... 104 4.6.3 Effectiveness and Efficiency on Real Policies . 105 4.6.4 Efficiency on Synthetic Policies . 111 5 Privacy Preserving Cross-Domain Network Reachability Quantification 113 5.1 Introduction.................................... 113