Distributed Systems

Security
Security Threats
• Leakage
– Unauthorized access to service or data
– E.g., Someone knows your bank balance
• Tampering
– Unauthorized modification of service or data
– E.g., Someone modifies your bank balance
• Vandalism
– Interference with normal service, without
direct gain to attacker
– E.g., Denial of Service attacks 2
Common Attacks
• Eavesdropping
– Attacker taps into network
• Masquerading
– Attacker pretends to be someone else, i.e.,
identity theft
• Message tampering
– Attacker modifies messages
• Replay attack
– Attacker replays old messages
3
• Denial of service: bombard a port
Addressing the Challenges: CIA Properties

• Confidentiality
– Protection against disclosure to unauthorized
individuals
– Addresses Leakage threat
• Integrity
– Protection against unauthorized alteration or
corruption
– Addresses Tampering threat
• Availability
– Service/data is always readable/writable
– Addresses Vandalism threat 4
Policies vs. Mechanisms

• Many scientists (e.g., Hansen) have argued for a

separation of policy vs. mechanism
• A security policy indicates what a secure system
accomplishes
• A security mechanism indicates how these goals
are accomplished
• E.g.,
– Policy: in a file system, only authorized individuals
allowed to access files (i.e., CIA properties)
– Mechanism: Encryption, capabilities, etc. 5
Mechanisms: Golden A’s
• Authentication
– Is a user (communicating over the network)
claiming to be Alice, really Alice?
• Authorization
– Yes, the user is Alice, but is she allowed to
perform her requested operation on this
object?
• Auditing
– How did Eve manage to attack the system and
breach defenses? Usually done by 6
continuously logging all operations.
Designing Secure Systems

• Don’t know how powerful attacker is

• When designing a security protocol need to
1. Specify Attacker Model: Capabilities of attacker
(Attacker model should be tied to reality)
2. Design security mechanisms to satisfy policy under
the attacker model
3. Prove that mechanisms satisfy policy under
attacker model
4. Measure effect on overall performance (e.g.,
throughput) in the common case, i.e., no attacks 7
Next

• Basic Cryptography

8
Basic Security Terminology

• Principals: processes that carry out

actions on behalf of users
– Alice
– Bob
– Carol
– Dave
– Eve (typically evil)
– Mallory (typically malicious)
– Sara (typically server)
9
Keys

• Key = sequence of bytes assigned to a

user
– Can be used to “lock” a message, and only this key
can be used to “unlock” that locked message

10
Encryption

• Message (sequence of bytes) + Key →

(Encryption) →
Encoded message (sequence of bytes)
• Encoded Message (sequence of bytes) + Key →
(Decryption) →
Original message (sequence of bytes)
• No one can decode an encoded message without
the key

11
Two Cryptography Systems

I. Symmetric Key systems:

– KA = Alice’s key; secret to Alice
– KAB = Key shared only by Alice and Bob
– Same key (KAB) used to both encrypt and decrypt a
message

•E.g., DES (Data Encryption Standard): 56 b key

operates on 64 b blocks from the message

12
Two Cryptography Systems (2)
II. Public-Private Key systems:
– KApriv = Alice’s private key; known only to Alice
– KApub = Alice’s public key; known to everyone
– Anything encrypted with KApriv can be decrypted only with
KApub
– Anything encrypted with KApub can be decrypted only with
KApriv
•RSA and PGP fall into these category
– RSA = Rivest Shamir Adleman
– PGP = Pretty Good Privacy
– Keys are several 100s or 1000s of b long
– Longer keys => harder for attackers to break
13
– Public keys maintained via PKI (Public Key Infrastructure)
Public-Private Key Cryptography

• If Alice wants to send a secret message M that can

be read only by Bob
– Alice encrypts it with Bob’s public key
– KBpub(M)
– Bob only one able to decrypt it
– KBpriv(KBpub(M)) = M
– Symmetric too, i.e., KApub(KApriv(M)) = M

14
Shared/Symmetric vs. Public/Private

• Shared keys reveal too much information

– Hard to revoke permissions from principals
– E.g., group of principals shares one key
→ want to remove one principal from group
→ need everyone in group to change key
• Public/private keys involve costly encryption or
decryption
– At least one of these 2 operations is costly
• Many systems use public/private key system to
generate shared key, and use latter on messages 15
Next

• How to use cryptography to implement

I. Authentication
II. Digital Signatures
III. Digital Certificates

16
I. Authentication

• Two principals verify each others’

identities
• Two flavors
– Direct authentication: directly between two
parties
– Indirect authentication: uses a trusted third-
party server
• Called authentication server
• E.g., A Verisign server 17
 Direct Authentication Using Shared Key
Alice knows Bob is Bob
Alice
(has KAB) KAB(RB) RA = Nonce
= random number Time
A

RB = Nonce
= random number KAB(RA)
Bob
(has KAB) Bob calculates KAB (RB )
and matches with reply.
Alice is the only one
who could have 18
replied correctly.
 Why Not Optimize Number of Messages?
Alice knows Bob is Bob
Alice
KAB(RB)
Time
A, RA

RB, KAB(RA)

Bob
Bob calculates KAB (RB )
and matches with reply.
Alice is the only one
who could have 19
replied correctly.
 Unfortunately, This Subject to Replay Attack
Eve starts 1st session Eve starts 2nd session Eve finishes 1st session
Eve
KAB(RB)
(Malicious)
Time
A, RA A, RB

RB, KAB(RA) RB2, KAB(RB)

Bob
Bob calculates KAB (RB )
and matches with reply.
Bob thinks Eve is Alice.
20
 Indirect Authentication Using Authentication
Server and Shared Keys
Alice
A, KB,AS(KA,B)
Time
A, B

Bob
Alice and Bob only ones who
KA,AS(KA,B), KB,AS(KA,B) can decrypt portions of the ticket
= A Ticket and obtain KA,B
AS 21
II. Digital Signatures

• Just like “real” signatures

– Authentic, Unforgeable
– Verifiable, Non-repudiable
• To sign a message M, Alice encrypts message with her
own private key
– Signed message: [M, KApriv(M)]
– Anyone can verify, using Alice’s public key, that Alice signed it
• To make it more efficient, use a one-way hash function,
e.g., SHA-1, MD-5, etc.
• Signed message: [M, KApriv(Hash(M))]
• Efficient since hash is fast and small; don’t need to 22
encrypt/decrypt full message
III. Digital Certificates

• Just like “real” certificates

• Implemented using digital signatures
• Digital Certificates have
– Standard format
– Transitivity property, i.e., chains of certificates
– Tracing chain backwards must end at trusted
authority (at root)

23
Example: Alice’s Bank Account

1. Certificate Type: Account

Charlie
2. Name: Alice Alice

3. Account number: 12345

4. Certifying Authority: Charlie’s Bank
5. Signature
– KCpriv(Hash(Name+Account number))

24
Charlie’s Bank, in Turn has another Certificate

1. Certificate Type: Public Key Banker’s Fed

Charlie
2. Name: Charlie’s Bank Alice

3. Public Key: KCpub

4. Certifying Authority: Banker’s
Federation
5. Signature
– KFpriv(Hash(Name+Public key))
25
Banker’s Federation, Has Another Certificate
From the Root Server
Verisign
1. Certificate Type: Public Key
Banker’s Fed
2. Name: Banker’s Federation Charlie
Alice
3. Public Key: KFpub
4. Certifying Authority: Verisign
5. Signature
– Kverisign priv(Hash(Name+Public key))

26
IV. Authorization

• Access Control Matrix

– For every combination of (principal,object) say what mode of access is
allowed
– May be very large (1000s of principals, millions of objects)
– May be sparse (most entries are “no access”)
• Access Control Lists (ACLs) = per object, list of allowed
principals and access allowed to each
– Maintained at server
• Capability Lists = per principal, list of files allowed to
access and type of access allowed
– Could split it up into capabilities, each for a different (principal,file) 27
– Can be handed (like certificates) to clients
Security: Summary

• Security Challenges Abound

– Lots of threats and attacks
• CIA Properties are desirable policies
• Encryption and decryption
• Shared key vs Public/private key systems
• Implementing authentication, signatures,
certificates
• Authorization

28