UNIVERSITY OF CALIFORNIA, IRVINE User-Centric Security and Privacy Approaches in Untrusted Environments DISSERTATION submitted in partial satisfaction of the requirements for the degree of DOCTOR OF PHILOSOPHY in Computer Science by Mamadou Hassimiou Diallo Dissertation Committee: Professor Sharad Mehrotra, Chair Professor Ardalan Amiri Sani Professor Nalini Venkatasubramanian Professor Lubomir Bic Professor Farzin Zareian 2018 Portion of Chapter 3 c 2015 IEEE Portion of Chapter 3 c 2016 Springer Portion of Chapter 4 c 2012 IEEE All other materials c 2018 Mamadou Hassimiou Diallo DEDICATION To my parents, my beloved wife Fatoumata Binta Diallo, and my three children Djienabou, Djoubairou, and Ibrahim for their patience and unfaltering support. ii TABLE OF CONTENTS Page LIST OF FIGURES vi LIST OF TABLES vii LIST OF ALGORITHMS viii ACKNOWLEDGMENTS ix CURRICULUM VITAE xi ABSTRACT OF THE DISSERTATION xiv 1 Introduction 1 1.1 Motivation . .1 1.2 Thesis Problem and Challenges . .4 1.3 Thesis Scope . .6 1.4 Thesis Contributions and Organization . .7 2 Related Work 9 2.1 Data Security and Privacy in Untrusted Cloud Systems . .9 2.2 Data Security and Privacy in Untrusted Cloud Applications (SaaS) . 10 2.3 Trust in IoT Systems and Applications . 14 3 Nomad: Managing Data Privacy in Cloud Systems (IaaS and PaaS) 17 3.1 Introduction . 17 3.2 Nomad Framework Overview . 21 3.2.1 Client Management Service . 23 3.2.2 Cloud Storage Service . 24 3.2.3 Operational Overview . 25 3.3 Homomorphic Encryption Background . 29 3.3.1 BGV Scheme . 30 3.3.2 HElib . 31 3.4 GPU-based Acceleration of BGV FHE . 33 3.5 Application: CallForFire . 35 3.6 Implementation . 38 3.7 Experiments . 40 iii 3.7.1 Performance of the GPU-based Parallelization . 41 3.7.2 CallForFire Performance . 44 3.8 Summary and Future Research Challenges . 46 4 CloudProtect: Managing Data Privacy in Cloud Applications (SaaS) 49 4.1 Introduction . 49 4.2 CloudProtect Framework . 53 4.2.1 Initialization Phase . 53 4.2.2 Function Model . 55 4.2.3 Data Confidentiality Policy . 56 4.2.4 Operational Phase . 58 4.2.5 Policy Rebalancing Phase . 61 4.3 Overview of Protection Techniques . 62 4.3.1 Text-based Transformation Techniques . 63 4.3.2 Numerical-based Transformation Techniques . 65 4.4 Balancing Privacy, Usability, and Efficiency . 67 4.4.1 Privacy Policy Relaxation/Specialization . 68 4.4.2 Minimizing Interruptions and Costs . 68 4.4.3 Solution for the MinRelax Problem . 70 4.5 CloudProtect Implementation . 74 4.6 CloudProtect Evaluation . 75 4.6.1 Integration of Google Calendar and Google Docs into CloudProtect . 76 4.6.2 CloudProtect Performance . 77 4.6.3 Tradeoff Analysis . 78 4.7 Conclusion and Future Work . 81 5 IoTtrust: Trustworthy Sensing in Untrusted IoT Environments 84 5.1 Introduction . 84 5.2 Emerging IoT Systems . 87 5.2.1 Current IoT Systems Data Collection Practices . 87 5.2.2 Privacy Regulations for IoT Systems . 88 5.2.3 IoT System Reference Architectures . 89 5.2.4 Trust Issues . 90 5.3 Use Cases . 91 5.3.1 Smart Campus . 91 5.3.2 Smart Mall . 92 6 IoTtrust: Contracts Translation and Attestation 93 6.1 Introduction . 93 6.2 IoT System Model . 97 6.2.1 Device Model . 97 6.2.2 Domain Model . 99 6.2.3 Application Model . 99 6.3 Policy and Contract Models . 100 6.3.1 Policy Model . 100 iv 6.3.2 Contract Model . 108 6.4 Contracts Translation . 109 6.4.1 Contract Translation Approach . 110 6.5 System Overview . 115 6.5.1 Architecture . 115 6.5.2 Threat Model . 117 6.6 Attestation of Contract Translation Scheme . 121 6.6.1 Setup Phase . 122 6.6.2 Device States and Actions Logs Collection . 123 6.6.3 Attestation of Domain Knowledge Integrity . 123 6.6.4 Attestation of Contract Translation . 124 6.7 Attestation of Contract Enforcement Scheme . 125 6.7.1 Setup Phase . 126 6.7.2 Data and Audit Logs Collection, and Storage Phase . 127 6.7.3 Attestation of Contract Enforcement Phase . 128 6.7.4 Security Analysis . 133 6.8 Implementation and Evaluation . 135 6.8.1 IoTtrust Implementation . 135 6.8.2 Experiments . 136 6.9 Conclusion and Future Work . 142 7 Conclusions and Future Work 143 7.1 Conclusions . 143 7.2 Future Work . 145 Bibliography 147 v LIST OF FIGURES Page 1.1 Cloud Service Models with Examples for Cloud and IoT Services . .2 3.1 Nomad Framework High-level Architecture . 22 3.2 A block diagram of the Homomorphic-Encryption library. Reprinted with permission from Halevi S. An Implementation of homomorphic encryption. GitHubRepository, https://github com/shaih/HElib. 2013. 32 3.3 Screenshot of the CallForFire application in a web browser . 40 4.1 CloudProtect Architecture . 54 4.2 CloudProtect Architecture . 75 4.3 Varying interruption threshold . 78 4.4 Varying execution cost threshold . 79 4.5 Varying interruption & execution cost thresholds . 80 4.6 Running time of algorithms . 80 6.1 Policy Translation Example . 111 6.2 IoTtrust Architecture . 117 6.3 Device registration. 126 6.4 Activity log collection. 129 6.5 Contract attestation via log manager. 130 6.6 WiFi Connections . 141 vi LIST OF TABLES Page 3.1 Test Environment . 41 3.2 HElib Profiling Results . 42 3.3 Timing Comparison of BluesteinInit() CPU and GPU Implementation (256 Threads Per Block) . 42 3.4 Comparison of BluesteinFFT() CPU and GPU Implementation (256 Threads Per Block) . 42 3.5 GPU Overhead . 43 3.6 Comparison of CPU and GPU BluesteinInit/FFT Implementation Combina- tions (256 Threads Per Block) . 43 3.7 Comparison of Workload Execution Time when Varying the Number of Threads Per Block Using GPU BluesteinInit/FFT Implementation . 44 3.8 Average Computation Overhead in Seconds with Fixed p=9576890767 (10 digits) . 45 3.9 Average Computation Overhead in Second with Fixed p=1000000000039 (13 digits) . 46 4.1 Operations Log . 74 4.2 Operations Selection . 74 6.1 Notations. ..