Updated on 2013-04-10. This is a report of the presentation done by Sangmin Lee on 2013-04-05. Paper co-authors are Sangmin Lee, Edmund L. Wong, Deepak Goel, Mike Dahlin, and Vitaly Shmatikov, The University of Texas at Austin.
Do you pay attention to access permission requests when installing applications on your mobile devices? In his talk, Sangmin Lee pointed out a recent study which has shown that only 17% of users do. More alarmingly, just 3% of them actually fully understand these requests. But even though users read and fully understand these requests, there is no guarantee that apps will actually comply to them -- in fact, there are various evidences some apps out there are misusing users' private data! You may choose to believe that app publishers will not misuse your private data; but in which one of the 300,000+ publishers will you actually trust? Yes, the scenario is pretty obscure for users' privacy, and it strongly suggests that existing countermeasures to protect users' privacy are not working.
Sangmin proposed to shift the users' trust from the 300,000+ app publishers to a few major brands, such as Google, Microsoft, Apple, and Amazon.
In addition to the fact that one already has to trust these companies to use their
device anyway, they also have a reputation to maintain, and thus more incentive to
work correctly. The key to realize the proposed shift? πBox: a framework that combines app confinement through sandboxes and control channels to provide explicit and useful privacy guarantees.
Sangmin explained that πBox provides a per-user, per-app sandbox confinement.
All users' data stays inside the sandbox along with an app instance, and the sandbox prevents the app from leaking the data. The sandboxes use a model which makes them span the users' device and the cloud -- and thus use resources from both the device and the cloud. Private vaults (which are in both the device and the cloud) and content storages are provided for storing user and app specific data, respectively. Both are secured to prevent privacy violation. The aggregate channels provide communication capabilities between the app and its publisher, and use differential privacy to introduce random noise and thus bound information leakage. Finally, The sharing channel allows one to have control of "when" and "with whom" to
share, but provides weak guarantees on "what to share". However, it
makes it difficult for an adversary to access users private data directly. Sangmin mentioned though that shared channels are not entirely secure (for example, photo sharing remains subject to steganography). Along with a three-level classification model (green, yellow, and red), πBox enables to fine-grain control which security features will be enabled for each app, and provides explicit privacy guarantees users can rely on. Sangmin closed the talk arguing that real, existing applications can benefit from πBox, and highlighting that overhead is low: only a few lines of code were required to change in existing, popular apps; and the measured information throughput was marginally degraded.
During the question & answer session, Fengyuan Xu (Collegue of Willian and Mary) showed himself concerned about the burden πBox will place on users (who will have to decide what, when, and with whom contents will be shared, for example). Sangmin argued that there will be no much difference from how it is currently done, and that apps will provide support for that decision process. In a follow up question, Fengyuan asked if πBox is vulnerable to attacks that use covert channels. Sangmin replied that it depends on the implementation of sandboxes and the design of πBox is
orthogonal. He added that if there are any improvements on building better
sandboxes, πBox can benefit from it by using it. Fengyuan then asked if πBox is something like a platform, in which you can plug-in other schemes to make it more secure. Sangmin simply replied that yes, it is. Yan Chen (Northwestern University) asked what aggregation channels can support. Sangmin replied that one big goal of aggregate channels is to provide information to app provides without violating users' privacy. He continued mentioning some examples of apps and how they could use aggregate channels to export information to app publishers. Yan then asked if πBox does protect social network information (i.e. the list of friends to whom one is sharing photos) from potential spammers. Sangmin replied that yes, it does.
No comments:
Post a Comment