PWidener-ACSAC03

Abstract

Wepresent amechanism forproviding differential data protection topublish/subscribe distrib uted systems, suchas those used inpeer-to-peer computing ,grid environments, andother s.This mechanism, termed “security overlays”, incorpor atescredential-based communication channel cre- ation, subscription andextension. Wedescribe aconcep- tualmodel ofpublish/subscribe services thatismade con- cretebyourmechanism. Wealso present anapplication, Active Video Streams, whose reimplementation using secu- rityoverlays allows ittoreact tohigh-le velsecurity poli- ciesspecified inXML without significant performance loss orthenecessity forembedding policy-specific code intothe application. 1Introduction Distrib uted applications andendusers interact bydy- namically sharing data, exchanging information, and us- ingorcontrolling remote devices. Inscientific endea v- ors, forinstance, researchers remotely access resources likemicroscopes[4 ],3Ddisplays[28 ,12],and may even wish tooperate sophisticated components liketheToko- mac fusion facility .Inindustry ,companies share parts designs[10 ]orother data critical totheir operation. Ex- amples include Schlumber ger’soilexploration processes where reserv oirsimulation data produced incomputer cen- tersshould beshared with ’onsite’ personnel conducting drilling[32 ],andwhere simulations should usewell logs to refine current drilling procedures. Another example isthe airline industry ,aswith Delta AirLines’ sharing offlight andpassenger information with third parties who distrib ute such data toselect passengers forcellphone-based passen- gernotification[26 ].Finally ,inremote sensing andcontrol, radar orcamera data ortelemetry/biometric information is captured, forw arded to,analyzed, andused byinterested re- mote parties, sometimes involving remote control loops, as intelesur gery andtargeting.Inmanysuch applications, remote users arenotinter- ested inand/or should notseeallofthedata allofthe time. Also, thecriteria forthese “which/whether” deci- sions canchange rapidly .Infact,dynamic interest changes sometimes help maketheimplementation ofsuch sys- tems orapplications feasible, byenabling dynamic data reduction[35 ],ortheyareused tooptimize implementa- tions, aswith lossy multimedia[22 ].Consequently ,there areconceptual models forsuch changes, including conte xt sensiti vity[14 ]inhuman-centered ubiquitous applications, spatial ortemporal locality inpervasiveand distrib uted systems[36 ,6],andcurrent focus orviewpoint inremote sensing, graphics, andvisualization[21 ].Finally ,whether implicitly determined orexplicitly captured byquality of service expressions[29 ,30,3],theoccurrence ofdynamic interest changes inapplications andsystems isaccompa- nied bythewide range ofeffects theycanhave,starting with simple changes indata selecti vity applied toongo- inginformation exchanges[21 ],continuing with theneed toapply varying transformations todata[22 ,28,24],and also including real-time control reactions asindynamic sensor repositioning orintelepresence[9 ]orteleimmersi ve applications[31 ]. SecurityandProtectioninDynamicDataSystems. The general problem addressed inthispaper is:Howcanappropriate security andprotection canbeas- sociated with thedata exchanges thattakeplace indy- namic systems andapplications? Inremote instrumentation andsensing, forinstance, costly physical infrastructure must beprotected from unauthorized orinappropriate access. Inremote telemetry ,privacycon- cerns may preventusfrom implementing keysafety func- tionality ,asevidenced byapplications likesmart cars[20 ] orremote biometric monitoring. Incooperati vescientific andengineering endea vors,endusers wish toprotect cer- tainelements ofthedata being shared, such asthehigh res- olution reserv oirmodeling data Schlumber gercannot make available toitscompetitors, orcertain materials properties which parts designers donotwanttodisclose. Similarly , inremote monitoring ande-commerce, itiscritical toen- sure that only certain elements ofdata streams aremade available toremote parties, aswith airlines’ caterers who should notrecei vedata about passenger identities butmust knowabout their food preferences, oraswith thedisclosure ofpassenger ortracking information tofederal agencies in cases ofpotential criminal activities. DifferentialDataProtectioninDynamicDataSystems. The targetsystems and applications addressed byour workaredistrib uted applications inwhich continuous data streams areproduced orcaptured, distrib uted, transformed, and filtered, inorder tomakeappropriate data available where andwhen itisneeded[28 ,24].Thespecific problem weaddress forsuch applications isthat:developers typically organize the data being ex- changed tomeet functional needs, whereassecurity requirements may require different data orga- nizations, distrib uted, andaccess patterns. Asimple example isadistrib uted sensor application in which data captured from multiple remote sensors iscom- bined intoalargercomposite stream, asneeded forsensor fusion orsimply totakeadvantage ofbandwidth impro ve- ments derivedfrom theuseoflargermessages, forexample. Programs operating onthecomposite stream canaccess all ofthecaptured data, thereby increasing thepotential dam- agefrom security violations. Inthiscase, theproblem tobe solvedistoprotect thecomposite stream such thatitsdata canonly beaccessed andused differentially . Differential data protection foradata stream isdefined astheability to:(1)giveonly certain users orprograms access tothedata being transported orstored, (2)protect individual entries indata items, aswhen anairline provides caterers access toselect portions ofpassenger records (e.g., indications offood preferences), and(3)limit thetransfor - mations andmanipulations (i.e., services) thatmay beap- plied todata, aswhen preventing certain data manipulations that canextract orderivesensiti vedata (e.g., identifying faces incaptured video). The data exchanges explored in detail inthispaper derivefrom ourongoing research insen- sorsystems[2, 30,37]andinadapti vesecurity[33 ],where itisimportant tonotonly protect access todata, butalso tooperate onthedata itself topreventitsinappropriate use, aswhen sensor images thatcontain some highly secure data (e.g., persons’ faces, identified military objects) are‘fuzzed out’or‘black edout’prior todistrib ution toothers. Insummary ,foranygivendata stream, thekeyques- tionweaskishowtoprotect andsecure certain data inthat stream, distinguished bydata type (e.g., ‘passenger id’fieldofthe‘passenger’ event)and/or data content (e.g., data val- uesandpositions associated with facerecognition). Asec- ondquestion ishowtoenforce such differential protection across multiple such streams inadistrib uted environment, where enforcement concerns theimposition limitations on certain stream manipulations byspecific endusers, aswell astheability toaccess specific stream data. SecurityOverlaysinDataDistributionMiddlewar e. Our approach toattaining differential data protection aug- ments data distrib ution middle warewith additional security mechanisms, where security meta-information isautomati- cally associated with thedata being exchanged. Such meta- information isthen used bymiddle waretoguarantee that data isonly accessible toandmanipulable byauthorized parties andthatthemanipulations bythose parties areau- thorized aswell. Essentially ,weoverlay onto existing data exchanges thesecurity andprotection currently needed. Se- curity overlays areentirely dynamic, meaning thattheycan bechanged andupdated independently ofthedata streams theyaffect, where overlays may bealtered while data ex- changes areongoing. The intent istomakesecurity over- lays asdynamic astheunderlying systems being used and theapplications being targeted. Our current implementation ofsecurity overlays isin middle warerunning onstandard operating system plat- forms. This implies thatdifferential data protection isen- forced only within theconfines ofthemiddle wareinfras- tructure, anditrequires thatinaddition tothedata protec- tionimplied bysecurity overlays, middle waremust utilize authentication methods toensure thatdata isnotmanipu- lated inunauthorized ways. The specific mechanism used iscredentials, early examples ofwhich arecapabilities in systems likeHydra[23 ].Acredential isapplied tosome data stream, named byachannel identifier .This creden- tialencapsulates areference toasetoftyped objects in thedata stream andrights tothese objects. Thecredential also servestoidentify itsbearer asanauthenticated client. Based onthecredential’ smeta-information (i.e., thetype information), twoactions may betakenwith respect tothe data stream. First, ahandler may beapplied tothestream, andthehandler’ soperations canextractfrom thestream data ofacertain type (e.g., oftype ‘passenger food pref- erence’) ortransform thestream’ sdata intoanewform by applying computations toit(e.g., computing statistical in- formation). Second, thenewlycreated data canberouted totheclient identified inthecredential, thelatter identi- fiedbyaclient description .This description currently con- tains anauthenticated client identifier ,butitcanalso use amore general wayofidentifying clients, such astrust levels,client roles, orgroup memberships (e.g., through community-based authentication[27 ,5]). Anewdata stream created byahandler isnotactually 2