Secure Resource Sharing System
Total Page:16
File Type:pdf, Size:1020Kb
DEGREE PROJECT, IN TIDAB , FIRST LEVEL STOCKHOLM, SWEDEN 2015 SecuRES: Secure Resource Sharing System AN INVESTIGATION INTO USE OF PUBLIC LEDGER TECHNOLOGY TO CREATE DECENTRALIZED DIGITAL RESOURCE-SHARING SYSTEMS DANIEL SVENSSON AND PHILIP LEUNG KTH ROYAL INSTITUTE OF TECHNOLOGY ICT TRITA TRITA-ICT-EX-2015:157 www.kth.se Abstract The project aims at solving the problem of non-repudiation, integrity and confidentiality of data when digitally exchanging sensitive resources between parties that need to be able to trust each other without the need for a trusted third party. This is done in the framework of answering to what extent digital resources can be shared securely in a decentralized public ledger-based system compared to trust-based alternatives. A background of existing resource sharing solutions is explored which shows an abundance third party trust-based systems, but also an inter- est in public ledger solutions in the form of the Storj network which uses such technology, but focuses on storage rather than sharing. The proposed solution, called SecuRES, is a communication protocol based on public ledger technology which acts similar to Bitcoin. A prototype based on the protocol has been implemented which proves the ability to share encrypted files with one or several recipients through a decentral- ized public ledger-based network. It was concluded that the SecuRES solution could do away with the requirement of trust in third parties for all but some optional op- erations using external authentication services. This is done while still maintaining data integrity of a similar or greater degree to trust-based solutions and offers the additional benefits of non-repudiation, high con- fidentiality and high transparency from the ability to make source code and protocol documentation openly available without endangering the system. Further research is needed to investigate whether the system can scale up for widespread adoption while maintaining security and rea- sonable performance requirements. Keywords Public ledger, Blockchain, Bitcoin, Non-repudiation, Trust, Secure trans- actions, Resource sharing, Decentralisation, Elliptic curve cryptography, Integrity, Confidentiality. Abstract Projektet ämnar lösa problemen med oförnekbarhet, integritet och kon- fidentialitet när man delar känsligt data mellan parter som behöver lita på varandra utan inblanding av betrodd tredje part. Detta diskuteras för att besvara till vilken omfattning digitala resurser kan delas säk- ert i ett decentraliserat system baserat på publika liggare jämfört med existerande tillitsbaserade alternativ. En undersökning av nuvarande resursdelningslösningar visar att det existerar många tillitsbaserade system men även en växande andel lös- ningar baserade på publika liggare. En intressant lösning som lyfts fram är Storj som använder sådan teknologi men fokuserar på resurslagring mer är delning. Projektets föreslagna lösning, kallad SecuRES, är ett kommunika- tionsprotokoll baserat på en publik liggare likt Bitcoin. En prototyp baserad på protokollet har tagits fram som visar att det är möjligt att dela krypterade filer med en eller flera mottagare genom ett decentralis- erat nätverk baserat på publika liggare. Slutsatsen som dras är att SecuRES klarar sig utan betrodda tredje parter för att dela resurser medan vissa operationer kan göras mer användarvänliga genom externa autentiseringstjänster. Själva lösnin- gen garanterar integritet av data och medför ytterligare fördelar såsom oförnekbarhet, konfidentialitet och hög transparens då man kan göra källkoden och protocoldokumentation fritt läsbar utan att utsätta sys- temet för fara. Vidare forskning behövs för att undersöka om systemet kan skalas upp för allmän användning och alltjämt bibehålla säkerhets- samt pre- standakrav. Nyckelord Publik liggare, Blockkedja, Bitcoin, Oförnekbarhet, Tillit, Säkra transak- tioner, Resursdelning, Decentralisering, Elliptic curve cryptografi, In- tegritet, Konfidentialitet. Glossary Bitcoin A collective term for the entire network, currency and technology behind it.. 12 bitcoin The denomination of the currency. bitcoins can be further divided into millibitcoins etcetera down to the smallest denomination which is a satoshi. 11, 12, 50 block A collection of transactions. Part of the blockchain which constitutes the public ledger containing all the verified transactions in the network. 12 blockchain The public ledger that contains all the verified transactions in the network.. 12 business logic The model of a system where calculations and manipulation of data occurs. 39, 40 confidentiality Confidentiality means that only those that are supposed to be able to read something are able to do so. 31 DAO Database Access Object. 67 DMZ De-militarized zone. 27 DTO Data Transfer Object, A data container without logic. 44, 67 ECC Elliptic Curve Cryptography. 13, 32, 33, 68 Git A distributed version control system. 47 GUI Graphical User Interface. 69 IDS Intrusion Detection System. 27 JPA Java Persistence API. 44, 45, 67 JUnit Testing framework for Java. 44 JVM Java Virtual Machine, the virtual machine constituting the environment wherein java code execute. 44 LATEX Typesetting system. 47 markdown Markup language for typesetting text with the possibility to export to many different formats. 47 MySQL Popular relational database. 68 non-functional requirements Requirements that describe not what feature to implement but rather how it should perform. 46 OpenPGP Encryption standard for email. 28 P2P Peer-To-Peer. 17 POM Project Object Model. 45 public interface The accessors controlling access to entities within a class. Enti- ties prefixed by modifiers such as public and protected are part of this interface. 39 RIPEMD160 RACE Integrity Primitives Evaluation Message Digest which pro- duce 160-bit output. 34 RSA Public-key encryption algorithm. 32, 33, 66–68 Scrum Iterative agile software development methodology. 8, 45, 46 secp256k1 Standard defining a specific elliptic curve and mathematical constants. 32, 33 SecuRES Secure Resource sharing protocol. 8, 49–56, 66–68, 71–73, 76–79 SHA256 Secure Hashing Algorithm that produce 256-bit output. 19, 21, 34 SPV Simple Payment Verification. Does not depend on the entire blockchain. 17, 18, 23, 65, 78 UML Unified Modeling Language. 41 UTXO Unspent Transaction Output. 15–18 Preface The authors would like to thank: • Sead Muftic, our examiner, for giving us this opportunity • Nazri Abdullah for acting as discussion partner for our designs • Christian Gotare, our corporate supervisor, for his experienced insights • Anders Sjögren, our head of programme, for always taking the time to answer our questions • Our loved ones for their patience with us while we were absent during this project Contents 1 Introduction 1 1.1 Background . 1 1.1.1 Sharing a sensitive Contract . 1 1.1.2 Secure Email . 2 1.1.3 Cloud Storage . 2 1.1.4 Public Ledgers . 2 1.2 Problem . 2 1.3 Purpose . 4 1.4 Goal . 5 1.4.1 Expected Deliverables . 5 1.4.2 Benefits . 6 1.4.3 Ethics . 6 1.4.4 Sustainability . 7 1.5 Methodology Overview . 7 1.5.1 Feasibility Phase . 7 1.5.2 Design and Implementation Phases . 7 1.6 Delimitations . 8 1.7 Outline . 8 1.8 Contributions . 9 2 Theoretical Background 11 2.1 Bitcoin . 11 2.1.1 Overview, [1, p.1-2] . 11 2.1.2 Transactions . 13 2.1.3 Decentralized Peer-To-Peer Network . 17 2.1.4 The Blockchain . 19 2.1.5 Alternative Chains, Currencies and Applications . 22 2.1.6 Conclusion . 23 2.2 Storj . 24 2.2.1 Storage . 24 2.2.2 Heartbeats . 24 2.2.3 Implementation . 24 2.2.4 Sharing . 25 2.2.5 Ownership Verification . 25 2.2.6 Conclusion . 25 2.3 Dropbox . 25 2.3.1 Product Features . 25 2.3.2 Architecture . 26 2.3.3 Reliability . 26 2.3.4 Security . 27 2.3.5 Conclusion . 27 2.4 Secure Email . 28 2.4.1 Confidentiality . 28 2.4.2 Authentication . 29 2.4.3 Conclusion . 29 2.5 Git . 29 2.5.1 Snapshots . 29 2.5.2 Branching . 30 2.5.3 Conclusion . 30 2.6 Cryptography . 30 2.6.1 Symmetric Cryptography . 31 2.6.2 Asymmetric Cryptography . 31 2.6.3 Hashing . 33 2.6.4 Digital Signatures . 34 2.6.5 Public-Key Certificates . 34 2.6.6 Digital Envelopes . 34 2.6.7 Conclusion . 35 2.7 Summary . 35 3 Methodology 37 3.1 Literature Study . 37 3.2 Development . 38 3.2.1 Analysis . 38 3.2.2 Design . 38 3.2.3 Coding . 42 3.2.4 Implementation . 44 3.2.5 Development Methodology . 45 3.3 Project management . 46 3.3.1 Project . 46 3.3.2 Documentation . 47 3.3.3 Collaboration . 47 4 Solution 49 4.1 Requirements . 49 4.1.1 Functional Requirements . 49 4.1.2 Security Requirements . 50 4.2 Network . 50 4.3 Concepts . 50 4.3.1 Sharing a File . 50 4.3.2 Confidentiality and Integrity . 51 4.3.3 File Slice . 51 4.3.4 File Crumb . 51 4.3.5 Updating a File . 51 4.3.6 File Management . 52 4.3.7 Slice Verification . 52 4.3.8 Access Permissions . 53 4.3.9 Branching . 53 4.3.10 Splitting . 53 4.3.11 Joining . 54 4.3.12 Double Spending . 54 4.3.13 Transaction Verification . 54 4.3.14 Transactions . ..