Integrity and access control in untrusted content distribution networks by Kevin E. Fu B.S. Computer Science and Engineering, MIT, 1998 M.Eng. Electrical Engineering and Computer Science, MIT, 1999 Submitted to the Department of Electrical Engineering and Computer Science in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Electrical Engineering and Computer Science MASSACHUSETT1S INS E at the OFTECHNOLOGY MASSACHUSETTS INSTITUTE OF TECHNOLOGY MAR 28 2006 September 2005 @2005 Massachusetts Institute of Technology LIBRARIES MIT hereby grants to the author permission to reproduce and distribute publicly paper and electronic copies of this thesis document in whole or in part. Author ..................................... .. .. .................... Department of Electrical Engineering and Computer Science ,Ser5ember 6,,2005 C ertified by ............................ ..... 'M-Frans K-aashoek Professor of Electrical Engineering and Computer Science Thesis Supervisor Certified by .............................. ........ Ronald L. Rivest Andrew and Erna Viterbi Professor of Electrical Engineering and Computer Science Thesis Supervisor A ccepted by ......................................... Arthur C. Smith Chairman, Department Committee on Graduate Students BARKER THIS PAGE INTENTIONALLY LEFT BLANK 2 Integrity and access control in untrusted content distribution networks by Kevin E. Fu Submitted to the Department of Electrical Engineering and Computer Science on September 6, 2005, in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Electrical Engineering and Computer Science Abstract A content distribution network (CDN) makes a publisher's content highly available to readers through replication on remote computers. Content stored on untrusted servers is susceptible to attack, but a reader should have confidence that content originated from the publisher and that the content is unmodified. This thesis presents the SFS read-only file system (SFSRO) and key regression in the Chefs file system for secure, efficient content distribution using untrusted servers for public and private content respectively. SFSRO ensures integrity, authenticity, and freshness of single-writer, many-reader content. A publisher creates a digitally-signed database representing the contents of a source file system. Untrusted servers replicate the database for high availability. Chefs extends SFSRO with key regression to support decentralizedaccess control of private content protected by encryption. Key regression allows a client to derive past versions of a key, reducing the number of keys a client must fetch from the publisher. Thus, key regression reduces the bandwidth requirements of publisher to make keys available to many clients. Contributions of this thesis include the design and implementation of SFSRO and Chefs; a concrete definition of security, provably-secure constructions, and an implementation of key re- gression; and a performance evaluation of SFSRO and Chefs confirming that latency for individual clients remains low, and a single server can support many simultaneous clients. Thesis Supervisor: M. Frans Kaashoek Title: Professor of Electrical Engineering and Computer Science Thesis Supervisor: Ronald L. Rivest Title: Andrew and Erna Viterbi Professor of Electrical Engineering and Computer Science 3 Acknowledgments A USENIX Scholars Fellowship, an Intel PhD Fellowship, and Project Oxygen provided partial support for this research. Part of this research was performed while visiting the Johns Hopkins University. I especially thank my thesis advisors (Frans Kaashoek and Ron Rivest) and my thesis com- mittee readers (Mahesh Kallahalla, David Mazieres, Avi Rubin, and Ram Swaminathan) for their service. Ram Swaminathan and Mahesh Kallahalla provided the early design of the key regression protocols. I thank Ron Rivest and David Mazieres for suggestions on formalizing definitions of security, and Frans Kaashoek for his persistence, guidance, and unending support. Giuseppe Ateniese, Breno de Medeiros, Susan Hohenberger, Seny Kamara, and Yoshi Kohno deserve many thanks for their suggestions on theoretical definitions of security for key regres- sion. Seny and Yoshi in particular deserve the most credit in forming the definitions and proofs of security for key regression. I thank Emmett Witchel for producing the first implementation of the SFS read-only file system. I thank Anjali Prakash, an undergraduate from Johns Hopkins, for implementing the initial version of hash-based key regression and finding statistics about group dynamics. Portions of the thesis appeared in the following publications: "Fast and secure distributed read-only file system" by Kevin Fu, M. Frans Kaashoek, David Mazieres. In ACM Transactions on Computer Systems 20(1), February 2002, pages 1- 24. (Originally published in the Proceedings of the 4th Symposium on Operating System Design & Implementation (OSDI). San Diego, California, October, 2000.) "Plutus: Scalable secure file sharing on untrusted storage" by Mahesh Kallahalla, Erik Riedel, Ram Swaminathan, Qian Wang, Kevin Fu. In Proceedings of the 2nd USENIX Conference on File and Storage Technologies (FAST), 2003. "Improved proxy re-encryption schemes with applications to secure distributed storage" by Giuseppe Ateniese, Kevin Fu, Matthew Green, Susan Hohenberger. In Proceedings of the 12th Annual Network and Distributed System Security Symposium (NDSS). San Diego, CA, February 2005. "Key regression: Enabling efficient key distribution for secure distributed storage" by Kevin Fu, Seny Kamara, Tadayoshi Kohno. Manuscript, August 2005. Academic acknowledgments Over the years many people have answered my relentless questions. I thank the many members of CSAIL, PDOS, NMS, and my now defunct MIT Applied Security Reading Group for their feedback on paper submissions and general mayhem: Daniel Aguayo (superman!), David An- dersen (always scavenging for free food), Sameer Ajmani (always willing to have discussions), 4 Magdalena Balazinska ("milk pool" makes research happen), John Bicket (roof-scaling office- mate), Sanjit Biswas (another roofnet hacker), Chuck Blake (dealing with my computer hardware woes and wearing tank tops), Josh Cates (the quiet officemate), Benjie Chen (golfing with alliga- tors), Russ Cox (bottomless source of knowledge and boy scout mishaps), Frank Dabek (golfing at Shoreline, hacking SFS code, even Latin scholarship), Doug De Couto (sailing sailing...), Nick Feamster (working on the cookie paper and reminiscing about Latin/JCL), Bryan Ford (I'll never forget Orgazmo), Simson Garfinkel (likes to argue, but that's what science requires), Thomer Gil (a Dutchman who can bake), Michel Goraczko (for computing support and even automobile sup- port), John Jannotti (easy going but always able to precisely shoot down stupid ideas), Jaeyeon Jung (security and sushi along with Stuart Schechter), Michael Kaminsky (SFS forever!), Eddie Kohler (Metapost!), Max Krohn (your SCI paper is better organized than my paper), Chris T. Lesniewski-Laas (SIPB can be smart and have style), Jingyang Li (my virtual officemate), Anna Lysyanskaya (theory of cryptography), David Mazieres (always the docile, well-behaved child), Allen Miu (HP Labs marches on), Robert Morris (graduate if you should be so lucky), Athicha Muthitacharoen (fun in Palo Alto at HP Labs too), Emil Sit (our work on cookies never seems to die), Alex Snoeren (for camaraderie and hosting me at UCSD), Jacob Strauss (for letting me steal office space), Jeremy Stribling (for voluntarily disabling SCIgen [114] so that I could benchmarks Chefs), Godfrey Tan (Intel fellowship), Michael Walfish (I hesitate to use improper grammar in front of you), Alex Yip (former student who could teach me a thing or two). Thank you to Abhi Shelat and Thien-Loc Nguyen for making 6.857 (Network and Computer Security) a great course to TA. Jerry Saltzer was a welcome source of computing history. Upon my presenting an idea, he quickly recalls related work from decades ago. Thanks to Sam Hartman, my undergraduate roommate, for perhaps unintentionally steering me into the field of computer security. Be "Super Be" Blackburn and Neena Lyall deserve an ACM award for all their help assisting with administration. Thanks go to Paula Michevich and Maria Sensale for their help locating hard-to-find research papers available only in the LCS-now-CSAIL reading room. Thanks to the folks at the Johns Hopkins University and the SPAR Lab in the Information Security Institute for making my two year visit enjoyable: Giuseppe Ateniese, Kenneth Berends, Lucas Ballard, Steve Bono, Randal Burns, Reza Curtmola, Darren Davis, Breno de Medeiros, Sujata Doshi, Matt Green, Seny Kamara, Mike LaBarre, Gerald Masson, Fabian Monrose, Zachary Peterson, Jackie Richardson, Avi Rubin, Robin Shaw, Christopher Soghoian, Adam Stubblefield, Sophie Qiu, Jing Wang, and Charles Wright. Prof. Herb Dershem at Hope College in Holland, Michigan deserves thanks for letting me take computer science courses while still enrolled in high school. Alan Parker from Chapel Hill, NC first got me interested in computing on the IBM PC Jr., and the late Kenneth Glupker taught my first computer programming courses at West Ottawa High School. Pat Seif (English and broadcast journalism) and the late Mary Jo LaPlante (Latin) did their best to guide my creative energies in my formative years. Whoever says we do not need more English majors is wrong. 5 Industrial acknowledgments I thank Avi Rubin and