Rethinking Identity Management for Large-scale Distributed Systems

Rethinking Identity Management for

Large-scale Distributed Systems

Weverton Luis da Costa Cordeiro weverton cordeiro@inf ufrgs br weverton.cordeiro@inf.ufrgs.br

Agenda

• Identity management todayy g y • What we think about it…

• What we see (as prominent solutions) about it… • What we envisage about it…

• Our framework for it… • The road ahead for it…

Identity management today…

Online systems offer a lightweight processy g g p so that user can create identities

Such convenience comes with a price: with minimum Such convenience comes with a price: with minimum

Identity management today…

Fake accounts can serve for a variety of purposes, y p p which mainly depend on the system nature

Promote people and advertisements

Promote words and tweets

Identity management today…

• The problem of creation of fake accounts is toughp g

• No solution can be achieved without some degree of centralization (Douceur, 2002)

centralization (Douceur, 2002)

• There can be no “one-size-fits-all” solution

i t ith di it f i t

• environments with a diversity of requirements

• varied user constraints

• Existing solutions fall in either of two categories

• Strong-based identity schemes

What we think about identity

management

management…

• It should preserve the users’ privacyp p y

• Obtaining a single identity

• should be cheap for honest users

What we see as prominent directions

for identity management

for identity management…

CAPTCHAs

The attacker can redirect them for some other user to solve for some other user to solve

Computational puzzles

Existing approaches use puzzles of fixed capacity

Waste of processing cycles for computing useless information

What we envisage as a prominent

framework for identity management

framework for identity management…

• Focus on those distributed systemsy based on the peer-to-peer paradigm

W k id tit h ( t th ti ti )

• Weak identity schemes (no strong authentication)

We hypothesize that the attacker recurs much more • We hypothesize that the attacker recurs much more

frequently than a honest user to obtain identities

• Tracking back these identity requests to their

What we envisage as a prominent

framework for identity management

framework for identity management…

Identity requests Bootstrap y Bootstrap service Identity requests Bootstrap service service

What we envisage as a prominent

framework for identity management

framework for identity management…

Identity requests Bootstrap y Bootstrap service Identity requests Bootstrap service service

The challenge is that sources cannot be reliably tracked, and may change overtime

What we envisage as a prominent

framework for identity management

What we envisage as a prominent

framework for identity management

framework for identity management…

Trust score Trust score

Trust score Trust score

Trust score

Trust score Trust score

Trust score

What we envisage as a prominent

framework for identity management

framework for identity management…

Trust score Trust score

Trust score Trust score

Trust score

Trust score Trust score

Trust score

What we envisage as a prominent

framework for identity management

framework for identity management…

Trust score Trust score

Trust score Trust score

Trust score

Trust score Trust score

Trust score

Our framework…

• Preserves the user privacy (primary goal)p y (p y g )

• Evaluates the likeliness of an ongoing attack during

th d i i h ( b h i l i )

the admission phase (no user behavior analysis)

Relies on the concept of sources of identity requests • Relies on the concept of sources of identity requests,

not on the strategies that can materialize them

• Can accommodate any strategy for pricing identity requests (in terms of effort or computational cost)

Our framework…

Trust Scores (CNSM 2011)

( )

• Trust score derived from a relationship between the source and

Our framework…

• Trust score derived from a relationship between the source and

network recurrence rates

• Puzzles of adaptive complexity defined as a function of the

Our framework…

• Trust score derived from a relationship between the source and

network recurrence rates

• Puzzles of adaptive complexity defined as a function of the

source trust score, and assigned to users

• Traditional puzzles reshaped into simulation jobs (following theTraditional puzzles reshaped into simulation jobs (following the

ReCAPTCHA project philosophy) and wait time

• reduces energy consumption

• make puzzle-processing useful

Our framework…

• Trust score derived from a relationship between the source and

network recurrence rates

( )

• Puzzles of adaptive complexity defined as a function of the

source trust score, and assigned to users

• Traditional puzzles reshaped into simulation jobs (following theTraditional puzzles reshaped into simulation jobs (following the

ReCAPTCHA project philosophy) and wait time

• reduces energy consumption

• make puzzle-processing useful

The road ahead…

Existing challenges at this stage

Existing challenges at this stage

1 design a decentralized approach e g for 1. design a decentralized approach, e.g. for

super-peers and chord-based architectures

2. obtain recent network profiles to use as 2. obtain recent network profiles to use as

input data for simulation and analysis

3. evaluate our framework in-the-wild

(modeling, simulation, and planetlab so far)

4. coexist with existing identity management

f k ( th b d t ti )

Rethinking Identity Management for

Large-scale Distributed Systems

Weverton Luis da Costa Cordeiro weverton cordeiro@inf ufrgs br weverton.cordeiro@inf.ufrgs.br

Eclipse Attack…

Fake accounts can serve for a variety of purposes, y p p which mainly depend on the system nature

Eclipse Attack…

Fake accounts can serve for a variety of purposes, y p p which mainly depend on the system nature

Eclipse Attack…

Fake accounts can serve for a variety of purposes, y p p which mainly depend on the system nature

Eclipse Attack…

Fake accounts can serve for a variety of purposes, y p p which mainly depend on the system nature

Analytical Model

• We demonstrated some important properties that our p p p framework holds (to appear)

• Given a set of resources in hands of an attacker, she can only maximize the profit of her attack by evenly dividing the

maximize the profit of her attack by evenly dividing the

number of identities to be requested among these resources

• Given a time period for the attack, the attacker can only

maximize the profit of her attack by uniformly distributing the maximize the profit of her attack by uniformly distributing the identity requests to be performed throughout that period

• An attacker, sharing sources with honest users, causes minimal impact to their requests; instead, such source sharing even degrades further the attack profit

Results with simulation

160,000 honest users trying to obtain identities over one week

An attacker, using varying proportions of sources trying proportions of sources, trying to get 80,000 identities in the same period

Results with PlanetLab

240 honest users trying to obtain 2,400 identities over two hours

An attacker, using 20 sources, trying to get 1 200 identities in trying to get 1,200 identities in the same period