Abstract
This paper reports our experimental work in using commercial secure coprocessors to control access to private data. In our initial project, we look at archived network traffic. We seek to protect the privacy rights of a large population of data producers by restricting computation on a central authority’s machine. The coprocessor approach provides more flexibility and assurance in specifying and enforcing access policy than purely cryptographic schemes. This work extends to other application domains, such as distributing and sharing academic research data.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Charles Antonelli, Kevin Coffman, J. Bruce Fields, and Peter Honeyman. Cryptographic wiretapping at 100 megabits. In SPIE 16th Annual International Symposium on Aerospace/Defense Sensing, Simulation, and Controls, Orlando, Apr 2002.
C.J. Antonelli, M. Undy, and P. Honeyman. The packet vault: Secure storage of network data. In Proc. USENIX Workshop on Intrusion Detection and Network Monitoring, Santa Clara, April 1999.
Dmitri Asonov and Johann-Christoph Freytag. Almost optimal private information retrieval. In Proc. Privacy Enhancing Technologies, San Francisco, Apr 2002.
Steven Bellovin, Matt Blaze, David Farber, Peter Neumann, and Eugene Spafford. Comments on the Carnivore system technical review. http://www.crypto.com/papers/carnivore_report_comments.html, December 2000.
M. Blaze, J. Feigenbaum, J. Ioannidis, and A. Keromytis. The KeyNote trustmanagement system version 2. RFC 2704, http://www.crypto.com/papers/rfc2704.txt, Sept 1999.
Matt Blaze, Joan Feigenbaum, and Jack Lacy. Decentralized trust management. In Proc. IEEE Conference on Security and Privacy, Oakland, CA, May 1996.
Matt Blaze, Joan Feigenbaum, and Martin Strauss. Compliance checking in the PolicyMaker trust management system. In Financial Cryptography. Springer, 1998.
Mike Bond and Ross Anderson. API-level attacks on embedded systems. Computer, 34(10):67–75, Oct 2001.
E. Etu and J. McIsaac. Bringing PKI to Dartmouth. Class Project, CS88, Dartmouth College, June 2001.
FBI. Carnivore diagnostic tool. http://www.fbi.gov/hq/lab/carnivore/carnivore.htm, Mar 2001.
Internet Engineeringt Task Force. Simple public key infrastructure (SPKI). http://www.ietf.org/html.charters/spki-charter.html, 1997.
R. Gennaro, P. Karger, S. Matyas, M. Peyravian, A. Roginsky, D. Safford, M. Willett, and N. Zunic. Two phase cryptographic key recovery system. Computers and Security, 16(6):481–506, 1997.
Amir Herzberg, Yosi Mass, Joris Michaeli, Yiftach Ravid, and Dalit Naor. Access control meets public key infrastructure, or: Assigning roles to strangers. In Proceedings of the 2000 IEEE Symposium on Security and Privacy (S&P 2000), Berkeley, CA, May 2000. IEEE.
IBM. IBM 4758 PCI Cryptographic Coprocessor Custom Software Interface Reference, http://www-3.ibm.com/security/cryptocards/html/library.shtml.
N. Knight. College’ Net security gets $1.5m. The Dartmouth, Feb 1 2002. http://www.thedartmouth.com/.
National Institute of Standards and Technology. Security requirements for cryptographic modules. Federal Information Processing Standards Publication 140-1, 1994.
Sandra Payette and Carl Lagoze. Policy-carrying, policy-enforcing digital objects. In J. Borbinha and T. Baker, editors, ECDL 2000, pages 144–157, Lisbon, Portugal, 2000.
Martin Roesch. Snort-lightweight intrusion detection for networks. In 13th Systems Administration Conference-LISA’ 99. USENIX, November 1999.
Sean W. Smith and Steve Weingart. Building a high-performance, programmable secure coprocessor. Computer Networks, 31:831–860, 1999.
Stephen P. Smith, Jr. Henry H. Perritt, Harold Krent, and Stephen Mencik. Independent technical review of the Carnivore system. http://www.usdoj.gov/jmd/publications/carniv_final.pdf, Dec 2000.
S.W. Smith. Outbound authentication for programmable secure coprocessors. Technical Report TR2001-401, Department of Computer Science, Dartmouth College, March 2001. http://www.cs.dartmouth.edu/~pkilab/oatr.pdf.
S.W. Smith, C.J. Antonelli, and Peter Honeyman. Proposal: the armored packet vault. Draft, Sep 2000.
S.W. Smith, R. Perez, S.H. Weingart, and V. Austel. Validating a high-performance, programmable secure coprocessor. In 22nd National Information Systems Security Conference. National Institute of Standards and Technology, October 1999.
S.W. Smith and D. Safford. Practical server privacy using secure coprocessors. IBM Systems Journal, 40(3), 2001. (Special Issue on End-to-End Security).
Statewatch. European parliament and EU governments on a collision course over the retention of data. http://www.statewatch.org/news/2001/nov/15eudata.htm, Nov 2001.
Dan Wallach. Copy protection technology is doomed. Computer, 34(10):48–49, Oct 2001.
Bennet Yee and J. D. Tygar. Secure coprocessors in electronic commerce applications. In Proc. First USENIX workshop on Electronic Commerce, New York, NY, July 1995.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2003 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Iliev, A., Smith, S. (2003). Prototyping an Armored Data Vault. In: Dingledine, R., Syverson, P. (eds) Privacy Enhancing Technologies. PET 2002. Lecture Notes in Computer Science, vol 2482. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-36467-6_11
Download citation
DOI: https://doi.org/10.1007/3-540-36467-6_11
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-00565-0
Online ISBN: 978-3-540-36467-2
eBook Packages: Springer Book Archive