Keypad: an Auditing File System for Theft-Prone Devices
Total Page：16
File Type：pdf, Size：1020Kb
Keypad: An Auditing File System for Theft-Prone Devices Roxana Geambasu John P. John Steven D. Gribble Tadayoshi Kohno Henry M. Levy University of Washington roxana, jjohn, gribble, yoshi, [email protected] Abstract annually in U.S. airports alone [Ponemon Institute 2008], This paper presents Keypad, an auditing file system for theft- and dry cleaners in the U.K. found over 4,000 USB sticks prone devices, such as laptops and USB sticks. Keypad pro- in pockets in 2009 [Sorrel 2010]. The loss of such devices vides two important properties. First, Keypad supports fine- is most concerning for organizations and individuals storing grained file auditing: a user can obtain explicit evidence that confidential information, such as medical records, social se- no files have been accessed after a device’s loss. Second, curity numbers (SSNs), and banking information. a user can disable future file access after a device’s loss, Conventional wisdom suggests that standard encryption even in the absence of device network connectivity. Key- systems, such as BitLocker, PGP Whole Disk Encryption, pad achieves these properties by weaving together encryp- and TrueCrypt, can protect confidential information. Un- tion and remote key storage. By encrypting files locally but fortunately, encryption alone is sometimes insufficient to storing encryption keys remotely, Keypad requires the in- meet users’ needs, for two reasons. First, traditional en- volvement of an audit server with every protected file access. cryption systems can and do fail in the world of real users. By alerting the audit server to refuse to return a particular As described in the seminal paper “Why Johnny Can’t En- file’s key, the user can prevent new accesses after theft. crypt” [Whitten 1999], security and usability are often at We describe the Keypad architecture, a prototype imple- odds. Users find it difficult to create, remember, and manage mentation on Linux, and our evaluation of Keypad’s perfor- passphrases or keys. As an example, a password-protected mance and auditing fidelity. Our results show that Keypad USB stick containing private medical information about overcomes the challenges posed by slow networks or discon- prison inmates was lost along with a sticky note revealing nection, providing clients with usable forensics and control its password [Savage 2009]. Encrypted file systems often for their (increasingly) missing mobile devices. rely on a locally stored key that is protected by a user’s passphrase. User passphrases are known to be insecure; a Categories and Subject Descriptors D.4.6 [Operating Sys- recent study of consumer Web passwords found the most tems]: Security and Protection common one to be “123456” [Imperva 2010]. Finally, in the hands of a motivated data thief, devices are open to physical General Terms design, performance, security attacks on memory or cold-boot attacks [Halderman 2008] Keywords Keypad, auditing, file system, theft-prone to retrieve passphrases or keys. Even physical attacks on TPMs and “tamper-resistant” hardware are possible [Ander- 1. Introduction son 1996, Robertson 2010]. Second, when encryption fails, it fails silently; an attacker Laptops, USB memory sticks, and other mobile comput- might circumvent the encryption without the data owner ever ing devices greatly facilitate on-the-go productivity and the learning of the access. The use of conventional encryption transport, storage, sharing, and mobile use of information. can therefore lead mobile device owners into a false sense Unfortunately, their mobile nature and small form factors of protection. For example, a hospital losing a laptop with also make them highly susceptible to loss or theft. As ex- encrypted patient information might not notify patients of ample statistics, one in ten laptops is lost or stolen within its loss, even if the party finding the device has circumvented a year of purchase [Nusca 2009], 600,000 laptops are lost the encryption and accessed that information. This paper presents the design, implementation, and eval- uation of Keypad, a file system for loss- and theft-prone Permission to make digital or hard copies of all or part of this work for personal or mobile devices that addresses these concerns. The principal classroom use is granted without fee provided that copies are not made or distributed goal of Keypad is to provide explicit evidence that protected for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute data in a lost device either has or has not been exposed af- to lists, requires prior specific permission and/or a fee. ter loss. Specifically, someone who obtains a lost or stolen EuroSys’11, April 10–13, 2011, Salzburg, Austria. Keypad device cannot read or write files on the device with- Copyright c 2011 ACM 978-1-4503-0634-8/11/04. $10.00 1 out triggering the creation of access log entries on a remote techniques from cryptography, including identity-based en- server. This property holds even if the person finding the de- cryption [Boneh 2001, Shamir 1985]. vice also finds a note with the device’s encryption password. We begin with a description of Keypad’s motivation and Keypad’s forensic logs are detailed and fine grained. For goals in the following section. Keypad’s architecture is pre- example, a curious individual who finds a laptop at the cof- sented in Section 3 and its implementation in Section 4. Sec- fee shop and seeks to learn its owner might register audit tion 5 provides a detailed evaluation of our prototype and records for files in the home directory, but not for unaccessed Section 6 discusses its security. Section 7 reviews related confidential medical records also stored on the device. How- work and we conclude in Section 8. ever, the professional data thief will register accesses to all of the specific confidential medical files that they view. Fur- 2. Motivation and Goals thermore, Keypad lets device owners disable access to files Keypad is designed to increase assurances offered to owners on the mobile devices once they realize their devices have of lost or stolen mobile devices. The mobile devices might been lost or stolen, even if the devices have no network con- have computational capabilities (e.g., laptops and phones) or nectivity, such as USB memory sticks (in contrast to systems might be simple storage devices (e.g., USB sticks). We view like Apple’s MobileMe). Keypad as particularly valuable to users storing personal or Keypad’s basic technique is simple yet powerful: it tightly corporate documents, banking information, SSNs, medical entangles the process of file access with logging on a remote records, and other highly sensitive data. auditing server. To do this, Keypad encrypts protected files with file-specific keys whose corresponding decryption keys Examples. We provide two brief motivating examples. Al- are located on the server. Users never learn Keypad’s de- ice is a businesswoman who carries a corporate laptop that cryption keys and thus they cannot choose weak passwords stores documents containing trade secrets. Alice’s IT depart- or accidentally reveal them; it is therefore computationally ment installs Keypad on the laptop, configuring it to track all infeasible for an attacker to decrypt a file without leaving ev- accesses to files in her “corporate documents” folder. After idence in the log. When a file operation is invoked, Keypad returning to her hotel from a two-hour dinner, Alice notices logs the file operation remotely, temporarily downloads the that her laptop is missing. She immediately reports the loss key to access the file, and securely erases it shortly thereafter. to her IT department, which disables any future access to Keypad is implemented on top of a traditional encrypted file files in the corporate documents folder. The IT department system; obviously users should choose strong passwords (or also produces an audit log of all files accessed within the use secure tokens, etc.) for that underlying file system, but two-hour window since she last controlled her laptop, con- Keypad provides a robust forensic trail of files accessed even firming that no sensitive files were accessed. if users choose weak passwords or the traditional system’s As a second example, at tax preparation time, Bob scans keys are otherwise compromised. all of his tax documents, places them on a USB stick, en- While conceptually simple, making this vision practical crypts it with a password, and physically hands the stick and presents significant technical challenges and difficult trade- password to his accountant. A few weeks later, Bob can no offs. For example, neither the user nor Keypad can pre- longer find his thumb drive and can’t remember whether his dict when a device will be lost or stolen. As a result, the accountant kept it or whether he lost it in the intervening system must provide both an accurate fine-grained forensic weeks. Fortunately, Bob’s stick was protected with Keypad record, which is critical after loss, and acceptable perfor- and Bob uses a Web service provided by his drive manufac- mance, which is critical prior to loss. turer to view an audit log of all accesses to the drive. He sees The tension between performance and forensics is per- that there were many accesses to his tax files over the pre- vasive. As an example, consider the creation of a file. For vious week and he learns the IP addresses from which those forensic purposes, a na¨ıve Keypad architecture might first accesses were made. Bob therefore places fraud alerts on his pre-register newly created files and their corresponding keys financial accounts and notifies the appropriate authorities. with the remote server prior to writing any new data to those In these scenarios, users benefit from additional advan- files.