Decentralized Authorization with Private Delegation by Michael P Andersen a Dissertation Submitted in Partial Satisfaction of Th
Total Page：16
File Type：pdf, Size：1020Kb
Decentralized Authorization with Private Delegation by Michael P Andersen A dissertation submitted in partial satisfaction of the requirements for the degree of Doctor of Philosophy in Computer Science in the Graduate Division of the University of California, Berkeley Committee in charge: Professor David E. Culler, Chair Associate Professor Deirdre Mulligan Assistant Professor Raluca Ada Popa Summer 2019 Decentralized Authorization with Private Delegation Copyright 2019 by Michael P Andersen 1 Abstract Decentralized Authorization with Private Delegation by Michael P Andersen Doctor of Philosophy in Computer Science University of California, Berkeley Professor David E. Culler, Chair Authentication and authorization systems can be found in almost every software system, and consequently affects every aspect of our lives. Despite the variety in the software that relies on authorization, the authorization subsystem itself is almost universally architected following a com- mon pattern with unfortunate characteristics. The first of these is that there usually exists a set of centralized servers that hosts the set of users and their permissions. This results in a number of security threats, such as permitting the operator of the authorization system to view or even change the permission data for all users. Secondly, these systems do not permit federation across administrative domains, as there is no safe choice of system operator: any operator would have visibility and control in all administrative domains, which is unacceptable. Thirdly, these systems do not offer transitive delegation: when a user grants permission to another user, the permissions of the recipient are not predicated upon the permissions of the granter. This makes it very difficult to reason about permissions as the complexity of the system grows, especially in the federation across domains case where no party can have absolute visibility into all permissions. Whilst several other systems, such as financial systems (e.g. blockchains) and communication systems (e.g. Signal / WhatsApp) have recently been reinvented to incorporate decentralization and privacy, there has been little attention paid to improving the authorization systems. This work aims to address that by asking the question “How can we construct an authorization system that supports first-class transitive delegation across administrative domains without trusting a central authority or compromising on privacy?” We survey several models for authorization and find that Graph Based Authorization, where principals are vertices in a graph and delegation between principals are edges in the graph, is capa- ble of capturing transitive delegation as a first class primitive, whilst also retaining compatibility with existing techniques such as Discretionary Access Control or Role Based Access Control. A proof of permission in the Graph Based Authorization model is represented by a path through the graph formed from the concatenation of individual edges. Whilst prior implementations of Graph Based Authorization do not meet the decentralization or privacy-preserving goals, we find that this is not intrinsic, and can be remedied by introducing two new techniques. The first is the con- 2 struction of a global storage tier that cryptographically proves its integrity, and the second is an encryption technique that preserves the privacy of attestations in global storage. The horizontally-scalable storage tier is based on a new data structure, the Unequivocable Log Derived Map, which is composed of three Merkle trees. Consistency proofs over these trees allow a server to prove that objects exist or do not exist within storage, as well as proving that the storage is append-only (no previously inserted objects have been removed). Our scheme advances prior work in this field by permitting efficient auditing that scales with the number of additions to the storage rather than scaling with the total number of stored objects. By utilizing cryptographic proofs of integrity, we force storage servers to either behave honestly, or become detected as compromised. Thus, even though the architecture is centralized for availability and performance, it is does not introduce any central authorities. The design of the storage does not ensure the privacy of the permission data stored within it. We address this through the introduction of Reverse Discoverable Encryption. This technique uses the objects representing grants of permission as a key dissemination channel, thus operating without communication between participants. By using Wildcard Key Derivation Identity Based Encryption in a non-standard way (with no central Private Key Generator) we allow for permission objects to be encrypted using the authorization policy as a key. Thus, RDE permits the recipient of some permissions to decrypt other compatible permissions granted to the grantee that could be concatenated together to form a valid proof. RDE therefore protects the privacy of permission objects in storage whilst still permitting decryption of those objects by authorized parties. We construct an implementation of these techniques, named WAVE, and evaluate its perfor- mance. We find that WAVE has similar performance to the widely used OAuth system and per- forms better than the equally widely used LDAP system, despite offering significantly better se- curity properties. We present an advancement to Graph Based Authorization which efficiently represents complex authorization proofs as a compact subgraph rather than a sequence of linear paths, and present a technique for efficient discovery of such proofs. To validate our techniques and ensure their efficacy in practice, we pose an additional question: “How can we leverage WAVE to improve the security of IoT communications?” We present a microservice architecture that abstracts the interfaces of IoT devices to permit a uniform security policy to be applied to heterogeneous devices of similar function. This is achieved by enforcing security policy at the communication bus and using hardware abstraction microservices to adapt the interfaces that devices expose on this communication bus. We construct and evaluate an instance of this communication bus, WAVEMQ and find that, with appropriate caching, its performance is comparable to that of prior publish/subscribe information busses. We discover that by enforcing WAVE’s security model in the core of the network, we gain a resistance to denial of service attacks. This is particularly valuable in the IoT context where devices are typically resource constrained or connected by a bandwidth-limited link. i Dedication To my soon-to-be wife, Soo Hyun Kim, who supported me throughout my PhD, and to my family, friends, and advisors, who made this possible. ii Contents Contents ii List of Figures v List of Tables vii 1 Introduction 1 1.1 Authentication and Authorization . 1 1.2 Centralization . 2 1.3 Federation Across Administrative Domains . 3 1.4 Transitive Delegation . 5 1.5 Motivation and Thesis Question . 6 1.6 Solution Overview . 7 1.7 Generalization . 10 1.8 Roadmap . 11 2 Background 13 2.1 Requirements for a Decentralized Authorization System . 13 2.2 Trust Management . 15 2.3 SDSI & SPKI . 17 3 Decentralized Graph Based Authorization 19 3.1 Concepts . 19 3.2 Entities . 20 3.3 Attestations . 21 3.4 Underlying System Requirements . 22 3.5 Revocation . 23 3.6 Proofs . 23 3.7 Common Authorization Modes . 24 3.8 Graph Based Authorization Evaluation . 28 3.9 Name Resolution . 31 3.10 Summary . 32 iii 4 Secure Storage 33 4.1 Operational and Security Requirements . 33 4.2 Abstract Implementation of Operational Requirements . 36 4.3 Blockchain Storage . 38 4.4 Blockchain Scalability Concerns . 51 4.5 Unequivocable Log Derived Map . 55 4.6 ULDM Storage Evaluation . 59 4.7 Storage Through DNS . 60 4.8 Storage Conclusions . 60 5 Private Delegation 63 5.1 Private Delegation Requirements . 64 5.2 Structural Reverse Discoverable Encryption . 64 5.3 Policy-Aware Reverse Discoverable Encryption . 65 5.4 Efficient Discoverability . 69 5.5 Reducing Leakage in Proofs . 70 5.6 Discovering an Attestation . 71 5.7 Extensions . 72 5.8 Privacy Micro Benchmarks . 73 5.9 Generalization to Other Policy Types . 74 5.10 Anonymous Proof Of Authorization . 75 5.11 Multicast End To End Encryption . 77 5.12 Protecting Name Declarations . 79 5.13 Summary . 79 6 System Design And Implementation 81 6.1 WAVE 3 System Overview . 81 6.2 System Integration Pattern . 82 6.3 Internal API Provider . 83 6.4 External API . 86 6.5 State Engine . 86 6.6 Indexed Local Storage . 87 6.7 Global Storage . 88 6.8 Serialization and Representation . 89 6.9 Proof Building Optimization . 91 6.10 Profiled Evaluation . 98 6.11 Summary . 101 7 Microservices in the Built Environment 103 7.1 Building Operating Systems Background . 103 7.2 An eXtensible Building Operating System . 106 7.3 A Secure Building Operating System . 108 iv 7.4 Summary . 111 8 Secure Syndication for IoT 112 8.1 Resource Design For Syndication Security . 113 8.2 Denial Of Service Resistance . 114 8.3 Intermittent Connectivity . 115 8.4 WAVEMQ System Overview . 116 8.5 WAVE in WAVEMQ . 118 8.6 Caching in WAVEMQ . 118 8.7 WAVEMQ Performance Evaluation . 119 8.8 Hiding Proofs From The Router . 120 8.9 Summary . 122 9 Concerns and Implications 123 9.1 Auditability . 123 9.2 Cryptographic Handoff . 124 9.3 Liberty . 127 9.4 Summary . 128 10 Related Work 129 10.1 Graph Based Authorization . ..