DOCSLIB.ORG

Design and Analysis Methods for Privacy Technologies

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Design and Analysis Methods for Privacy Technologies Arenberg Doctoral School of Science, Engineering & Technology Faculty of Engineering Department of Electrical Engineering (ESAT) Design and analysis methods for privacy technologies Carmela Troncoso Dissertation presented in partial fulfillment of the requirements for the degree of Doctor in Electrical Engineering April 2011 Design and analysis methods for privacy technologies Carmela Troncoso Jury: Prof. Dr. Ir. Ann Haegemans, chairman Prof. Dr. Ir. Adhemar Bultheel, acting chairman Prof. Dr. Ir. Bart Preneel, promotor Dissertation presented in partial Prof. Dr. Ir. Claudia Diaz, promotor fulfillment of the requirements for Prof. Dr. Ir. Geert Deconinck the degree of Doctor Prof. Dr. Ir. Frank Piessens in Electrical Engineering Prof. Dr. Nikita Borisov (University of Illinois at Urbana-Champaign) Dr. George Danezis (Microsoft Research Cambridge) April 2011 © Katholieke Universiteit Leuven – Faculty of Engineering Arenbergkasteel, B-3001 Leuven-Heverlee, Belgium Alle rechten voorbehouden. Niets uit deze uitgave mag worden vermenigvuldigd en/of openbaar gemaakt worden door middel van druk, fotocopie, microfilm, elektronisch of op welke andere wijze ook zonder voorafgaande schriftelijke toestemming van de uitgever. All rights reserved. No part of the publication may be reproduced in any form by print, photoprint, microfilm or any other means without written permission from the publisher. Legal depot number D/2011/7515/52 ISBN number 978-94-6018-350-8 Acknowledgements People have always told me that writing a thesis is a solo journey. Now I am at the end of the road and when I look back there were hard moments, but I have felt everything but alone in this quest. First of all I want to thank my advisors Bart Preneel and Claudia Diaz, who believed in me from the first day and let me know they trusted me every day of my PhD. I would like to thank Bart for his support; for (almost) never saying no to anything that I asked for no matter how crazy the idea was (and I have had a fair amount of crazy ideas); and for telling me something that changed my life: “Shit happens, you’ll deal with it”. Thanking Claudia for all that she did for me in a few words is very difficult. There are many good advisors out there able to teach their students how to do research, but friends that feel like family there are very few. I am so lucky that I found both of them in one person. I am also very grateful to Prof. Frank Piessens, Prof. Geert Deconinck, Prof. Nikita Borisov and Dr. George Danezis for serving as jury members, and giving me many suggestions to improve this dissertation. I want to thank Prof. Ann Haegemans and Prof. Adhemar Bultheel for chairing the jury. I would not have written this thesis if I had not had the luck of sharing an office not only with Claudia, but also with George. When I knew nothing about security nor privacy he took his time to guide me, always giving me new opportunities to learn. I also thank him for introducing me to the fascinating world of Bayesian inference: the gift that keeps on giving, the Angry Nights, the Rollerkillers, the Filthy Dragon, Indigo’s bagels, for teaching me my first words in Greek,. but above everything I would like to thank him for making me realize why it is worthy to work on privacy. George, I shall not forget: “Girls come and go, traffic analysis is forever not for Christmas.” I would also like to thank all of my co-authors for having the patience to work with me, letting me learn from them, and having made each new paper not only a nice academic experience but also fun. A very special thanks goes to Benedikt, a friend inside and outside of ESAT, always there to support me not only at work but also in life making his home my home (with better breakfast). I cannot imagine my i life in Leuven without sharing dinner, a washing machine, a car, a bbq, garden furniture,. with him. Dude, when are you coming this summer? Not only my co-authors have had an influence on my research. A big thanks goes to all the people that have been part of Cosic during these years and created the best working environment for me. In particular thanks to Josep, the best office mate ever; to Seda and Danny, always eager to help and take care of the little things that make my life so much easier; to Pela, that made the damn paperwork even look nice when I was having a coffee at her desk; and to Fonsi, Orr, Markulf, Elena, Basti, Emily, K˚are,Ero, for so many coffees, laughters, beers, dinners, game evenings, climbing hours, etc. I would also like to thank my office and lunch mates in Vigo for making going to work a pleasant experience in my last months of writing. A more than special thanks go to Elketje. I would need to write a whole new book to really express all that I am thankful for, but in few words: thank you not only for letting me see the different sides of Elke, and teach me that there is more than one point of view in life and thus there is not only one definition for right and wrong; but more than anything for being there every day to remind me. Then there are all those people that do not know a word about security or maths, but that have been as important for my PhD as those whom I worked with. The warmest thanks to Alba and OneC de Montalvo, for never letting me give up, for making pancakes when they were needed, for understanding how cool it would be to introduce a car in a DVD, and for always being ready to give up a bit of their happiness to help me. Thanks to Mil Amigos, each and one of them, because no matter how far they are they always sound near and with them I always know that whatever it is, it is going to be “chichi!”. Thanks to Fra and Sarah for reminding me I actually enjoy going out, and having a life. I would never have written this thesis without Hayd´eeand Who, always there to calm me down on the other side of the phone. And a very special thanks to Eva, for always encouraging me to follow my dreams even when they were not aligned with hers. I would not have a PhD without her. Finally, I am deeply thankful to my family. Thanks to my parents for building a safety net such that I could run around catching dreams without fear to fall, and to my sister for being green and listen to me and always being so keen in telling me I am overreacting. I also thank my aunt Arita, my godmother Celia, and the whole Quiroga clan for always have their door open to me, ready to give me exactly what I need without ever making questions. To all those I have mentioned, and all those that are not mentioned but have been by my side all these years: Thank you for being a part of this! I would like to acknowledge the K.U.Leuven, the Fundaci´onPedro Barri´ede la Maza, and the Fund for Scientific Research in Flanders (FWO) for funding my research. Abstract As advances in technology increase data processing and storage capabilities, the collection of massive amounts of electronic data raises new challenging privacy concerns. Hence, it is essential that system designers consider privacy requirements and have appropriate tools to analyze the privacy properties offered by new designs. Nevertheless, the privacy community has not yet developed a general methodology that allows engineers to embed privacy-preserving mechanisms in their designs, and test their efficacy. Instead, privacy-preserving solutions are designed and analyzed in an ad hoc manner, and hence it is difficult to compare and combine them in real-world solutions. In this thesis we investigate whether general methodologies for the design and analysis of privacy-preserving systems can be developed. Our goal is to lay down the foundations for a privacy engineering discipline that provides system designers with tools to build robust privacy-preserving systems. We first present a general method to quantify information leaks in any privacy- preserving design that can be modeled probabilistically. This method allows the designer to evaluate the degree of privacy protection provided by the system. Using anonymous communication systems as case study we find that Bayesian inference and the associated Markov Chain Monte Carlo sampling techniques form an appropriate framework to evaluate the resistance of these systems to traffic analysis. The Bayesian approach provides the analyst with a neat procedure to follow, starting with the definition of a probabilistic model that is inverted and sampled to estimate quantities of interest. Further, the analysis methodology is not limited to specific quantities such as “who is the most likely receiver of Alice’s message?,” but can be used to answer arbitrary questions about the entities in the system. Finally, our methodology ensures that systematic biases in information analysis are avoided and provides accurate error estimates. In the second part of this thesis we tackle the design of privacy-preserving systems, using pay-as-you-drive applications as case study. We propose two pay-as-you-drive architectures that preserve privacy by processing personal data locally to the users, and only communicating billing information to the provider. v Local processing enhances privacy, but may be detrimental to other security properties such as service integrity (e.g., the provider has access to less data when verifying the correctness of the bill).
Load more

Recommended publications
  • Curriculum Vitae – Ross Anderson
    Curriculum Vitae – Ross Anderson I am Professor of Security Engineering at Cambridge University, and a Fellow of Churchill College. Security Engineering is about building systems to remain depend- able in the face of malice, error or mischance. As a discipline, it focuses on the tools, processes and methods needed to design, implement and test complete systems, and to adapt existing systems as their environment evolves. My mission has been building security engineering into a discipline. Twenty-five years ago, some parts of it – cryptography, protocols and operating system security – had well-developed theory, but the experts mostly didn’t talk to each other. Other aspects, such as software security, were a practitioners’ art, while yet other aspects such as hardware security were just black magic. Since 1992 I’ve started research programs in neglected areas, ranging from hard- ware security through API security and signal processing to security economics. I’ve worked on applications from payments through online medical records to curfew tags, and documented their failure modes so that engineers can learn from them. I wrote the standard textbook, ‘Security Engineering – A Guide to Building Dependable Dis- tributed Systems’ of which the first edition came out in 2001 [88] and the second in 2008 [157]; I’m working on the third which should ship in 2020 (most of the chapters are already online on my website). Along the way I’ve contributed to the design of a number of widely-deployed systems, from the STS specification for prepayment utility meters (with 60 million installed) to the HomePlug standard for power-line communi- cations (widely used to extend wifi).
    [Show full text]
  • No Right to Remain Silent: Isolating Malicious Mixes Hemi Leibowitz, Bar-Ilan University, IL; Ania M
    No Right to Remain Silent: Isolating Malicious Mixes Hemi Leibowitz, Bar-Ilan University, IL; Ania M. Piotrowska and George Danezis, University College London, UK; Amir Herzberg, University of Connecticut, US https://www.usenix.org/conference/usenixsecurity19/presentation/leibowitz This paper is included in the Proceedings of the 28th USENIX Security Symposium. August 14–16, 2019 • Santa Clara, CA, USA 978-1-939133-06-9 Open access to the Proceedings of the 28th USENIX Security Symposium is sponsored by USENIX. No Right to Remain Silent: Isolating Malicious Mixes Hemi Leibowitz Ania M. Piotrowska George Danezis Bar-Ilan University, Israel University College London, UK University College London, UK Amir Herzberg University of Connecticut, US Abstract network is an example of anonymity systems that protect the meta-data. Tor is currently the most popular system offering Mix networks are a key technology to achieve network anonymity, attracting almost 2 million users daily. However, anonymity and private messaging, voting and database as research has shown [47, 40, 42, 41], Tor offers limited lookups. However, simple mix network designs are vulner- security guarantees against traffic analysis. able to malicious mixes, which may drop or delay packets The need for strong anonymity systems resulted in re- to facilitate traffic analysis attacks. Mix networks with prov- newed interest in onion mixnets [12]. In an onion mixnet, able robustness address this drawback through complex and sender encrypts a message multiple times, using the public expensive proofs of correct shuffling but come at a great cost keys of the destination and of multiple mixes. Onion mixnets and make limiting or unrealistic systems assumptions.
    [Show full text]
  • Phd Thesis, ETH Z¨Urich, 1997
    Guessing human-chosen secrets Joseph Bonneau University of Cambridge Churchill College May 2012 This dissertation is submitted for the degree of Doctor of Philosophy Declaration This dissertation is the result of my own work and includes nothing which is the outcome of work done in collaboration except where specifically indicated in the text. No parts of this dissertation have been submitted for any other qualification. This dissertation does not exceed the regulation length of 60; 000 words, including tables and footnotes. To Fletcher, for teaching me the value of hard work. I'm glad you're back. |Joseph Bonneau, May 2012 Acknowledgements I am grateful to my supervisor Ross Anderson for help every step of the way, from answering my emails when I was a foreign undergraduate to pushing me to finally finish the dissertation. He imparted countless research and life skills along the way, in addition to helping me learn to write in English all over again. I was also fortunate to be surrounded in Cambridge by a core group of \security people" under Ross' leadership willing to ask the sceptical questions needed to understand the field. In particular, I've benefited from the mentorship of Frank Stajano and Markus Kuhn, the other leaders of the group, as well as informal mentorship from Richard Clayton, Bruce Christianson, Mike Bond, George Danezis, Claudia Diaz, Robert Watson and Steven Murdoch amongst many others. I thank Arvind Narayanan for his support and mentorship from afar. I am most appreciative of the personal mentorship extended to me by Saar Drimer through my years in the lab, which always pushed me to be more honest about my own work.
    [Show full text]
  • Better Anonymous Communications
    Better Anonymous Communications George Danezis University of Cambridge Computer Laboratory Queens' College January 2004 This dissertation is submitted for the degree of Doctor of Philosophy Declaration This dissertation is the result of my own work and includes nothing which is the outcome of work done in collaboration except where speci¯cally indi- cated in the text and summarised in section 1.3. This dissertation does not exceed the regulation length of 600001 words, including tables and footnotes. 1using detex thesis.tex | wc Acknowledgements \No man is an island, entire of itself; every man is a piece of the continent, a part of the main." Meditation 17, Devotions Upon Emergent Occasions | John Donne I am deeply indebted to my supervisor and teacher Ross Anderson, for al- lowing me to join his research group, and helping me at key points during the last three years. I hope this document shows that his trust in me was justi¯ed. I am also grateful to Robin Walker, my director of studies, for his support during the last six years and for giving me the opportunity to study in Cambridge. These years of research would have been considerably less productive without the local scienti¯c community, my colleagues in the computer secu- rity group of the Computer Laboratory, but also my colleagues from around the world. I would like to specially thank my co-authors, Richard Clayton, Markus Kuhn, Andrei Serjantov, Roger Dingledine, Nick Mathewson and Len Sassaman. This research would not have been possible without my parents. At every stage of my academic life they acted as role models, provided moral and ¯nancial support.
    [Show full text]
  • Prof. George Danezis, B.A. (Hons), M.A. (Cantab), Ph.D., FBCS
    Prof. George Danezis, B.A. (Hons), M.A. (Cantab), Ph.D., FBCS Contact Information University College London, Voice: { Twitter: @gdanezis Dept. of Computer Science, E-Mail: [email protected] LinkedIn: gdanezis London WC1E 6BT, U.K. Web: http://danez.is Skype: george danezis Research Interests Computer security, privacy technologies, traffic analysis, peer-to-peer networking & distributed ledgers, inference and probabilistic modelling, applied cryptography, smart grids and transportation security. Employment Dept. of Computer Science, University College London, UK Oct. 2016 { present Professor of Security and Privacy Engineering Oct. 2016 { Nov. 2020 Turing Institute Faculty Fellow Oct. 2013 { Oct. 2016 Reader in Security and Privacy Engineering Full-time research in security and privacy, teaching duties and holding grants funding 8 doctoral and 2 post-doctoral researchers. Facebook & Novi, London, UK Feb. 2019 { Jul. 2021 Research Scientist Chainspace.io, London, UK Sept. 2018 { Feb. 2019 Co-founder & Head of Research Co-founded the blockchain start-up and acted as Head of Research. Successful exit, with the team moving to Facebook. Microsoft Research, Cambridge, UK Sept. 2009 { Sept. 2013 Researcher Sept. 2007 { Aug. 2009 Post-doctoral researcher Researcher in security and privacy, under Andy Gordon, Byron Cook, Luca Cardelli and Tuomas Aura: full time research; managing post-doctoral researchers and interns; and privacy lead for the lab. ESAT, Katholieke Universiteit Leuven, Belgium Oct. 2005 { Sept. 2007 Post-doctoral visiting fellow Post-doctoral fellowship funded by the Flemish research council (FWO) and the Katholieke Universiteit Leuven, at the COSIC group headed by Prof. Bart Preneel. Computer Laboratory, University of Cambridge, UK June 2004 { Oct.
    [Show full text]
  • Security Engineering: a Guide to Building Dependable Distributed Systems, Second Edition Published by Wiley Publishing, Inc
    Security Engineering A Guide to Building Dependable Distributed Systems Second Edition Ross J. Anderson Wiley Publishing, Inc. Security Engineering: A Guide to Building Dependable Distributed Systems, Second Edition Published by Wiley Publishing, Inc. 10475 Crosspoint Boulevard Indianapolis, IN 46256 Copyright © 2008 by Ross J. Anderson. All Rights Reserved. Published by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: 978-0-470-06852-6 Manufactured in the United States of America 10987654321 No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Legal Department, Wiley Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317) 572-4355, or online at http://www.wiley.com/go/permissions. Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation.
    [Show full text]
  • Infrastructure-Based Anonymous Communication Protocols in Future Internet Architectures
    Infrastructure-based Anonymous Communication Protocols in Future Internet Architectures Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Electrical and Computer Engineering Chen Chen B.S., Department of Automation, Tsinghua University M.S., Electrical and Computer Engineering, Carnegie Mellon University Carnegie Mellon University Pittsburgh, PA August 2018 c 2018 Chen Chen. All rights reserved. iii Acknowledgments I would like to thank every person who helped me throughout my Ph.D. journey. First and foremost, I would like to express my deepest gratefulness to my dearest advisor, Dr. Adrian Perrig, for his mentoring, insights, and inspiration. His dedication and enthusiasm for research always motivate me to dive into new research areas and face new challenges. His guidance on both my academic and everyday life navigates me through difficult times. His insights and constructive criticism inspire me to conquer doubts and live up to my full potential. I would also like to thank my thesis committee members for all their assistance and insightful feedback: Dr. Lujo Bauer, Dr. George Danezis, Dr. Vyas Sekar. I’m also deeply indebted to all my collaborators: Daniele E. Asoni, Dr. Fan Bai, Dr. David Barrera, Dr Hsu-Chun Hsiao, Dr. Petros Maniatis, Dr. Steve Matsumoto, Dr. Himanshu Raj, Dr. Stefan Saroiu, Dr. Ahren Studer, Dr. Carmela Troncoso, Dr. Amit Vasudevan, Dr. Alec Wolman, Dr. James Zeng. I’m extremely fortunate to have worked with so many talented and hardworking researchers. I’m particularly grateful to Dr. Stefan Saroiu, my mentor at Microsoft research, who taught me about essential skills on critical thinking, which greatly benefits my journey.
    [Show full text]
  • Trustworthy and Scalable Anonymous Communication
    c 2012 Prateek Mittal TRUSTWORTHY AND SCALABLE ANONYMOUS COMMUNICATION BY PRATEEK MITTAL DISSERTATION Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Electrical and Computer Engineering in the Graduate College of the University of Illinois at Urbana-Champaign, 2012 Urbana, Illinois Doctoral Committee: Assistant Professor Nikita Borisov, Chair Assistant Professor Matthew Caesar Dr. George Danezis, Microsoft Research Adjunct Professor P. R. Kumar Professor Nitin Vaidya ABSTRACT The architectures of deployed anonymity systems such as that of the Tor net- work suffer from the problems of (a) limited scalability, (b) reliance on a few central points of trust, and (c) trust issues due to Sybil attack. In this thesis, we investigate the design of novel approaches to anonymous communication that are scalable, decentralized, and Sybil-resilient. First, we begin by investigating security vulnerabilites in existing P2P anonymity systems, and find fundamental limitations in their designs. Sec- ond, we propose novel protocols for P2P anonymous communication that can successfully overcome these limitations. Third, we describe a protocol for detecting malicious Sybil identities using information about social network trust relationships. Fourth, we present protection mechanisms for DHTs that also leverage social network trust relationships to defend against the Sybil attack while preserving the privacy of social contacts and providing a basis for pseudonymous communication. Finally, we describe a protocol for trust- worthy and scalable anonymous communication that can directly leverage users’ trusted social contacts. We evaluate the effectiveness of our proto- cols using theoretical analysis, simulations, implementations and a Facebook application. ii To my family iii ACKNOWLEDGMENTS This dissertation would not have been possible without the help of my advisor Nikita Borisov.
    [Show full text]