Data Privacy in Trigger-Action Systems Yunang
Description: Data Privacy in Trigger-Action Systems Yunang Chen, Amrita Roy Chowdhury, Ruizhe Wang, Andrei Sabelfeld, Rahul Chatterjee, Earlence Fernandes University of Wisconsin-Madison Chalmers University of Technology Online services with
Related Topics
Download Presentation
"Data Privacy in Trigger-Action Systems Yunang" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
slide1. Data Privacy in Trigger-Action Systems Yunang Chen*, Amrita Roy Chowdhury*, Ruizhe Wang*,
Andrei Sabelfeld†, Rahul Chatterjee*, Earlence Fernandes*
* University of Wisconsin-Madison
† Chalmers University of Technology<br>
slide2. Online services with different APIs don’t talk to each other 2<br>
slide3. Trigger-Action Platforms (TAPs) connect independent services to empower automation rules Popular Commercial Trigger-Action Platforms 3<br>
slide4. Trigger-Action Automation Rules room PM level > turn on air purifier threshold IF , THEN new email received is from ring smart speaker bank IF , THEN new transaction happens with send SMS $100 IF THEN 4 transaction amount > AND midnight transaction time during with receiver = , contact information message body = transaction details AND phone number extract from “Warning: ” +<br>
slide5. However, users risk their privacy and security What happens if TAP is compromised? Chat logs Emails Social networks Cloud files Control lights Control power outlets Control ovens Sensitive information is leaked Arbitrary actions can be performed 5<br>
slide6. Security Concerns in TAPs: IFTTT as a Case Study IFTTT’s Term of Use states…
IFTTT operates on lots of sensitive information
Integrated with 600+ services
Has 20M+ users 6<br>
slide7. Security Concerns in TAPs: IFTTT as a Case Study Access tokens acquired by IFTTT are overprivileged [Fernandes et al, 2018]
Gmail removed its triggers from IFTTT due to security concern in 2019 7 Trigger a rule when I upload a new file to Google Drive<br>
slide8. How to design a secure trigger-action system? 8<br>
slide9. eTAP: encrypted Trigger-Action Platform 9 Protect data privacy and integrity Support computations in rules Optimize for string operations Efficient protocol with low overhead<br>
slide10. Abstract Paradigm of a Trigger-Action System trigger data action data Action Service Trigger-Action Platform (TAP) IF f1(trigger data, constant),
THEN action data = f2(trigger data , constant) Trigger Service 10 Programmed through User Client<br>
slide11. Security Guarantees and Practical Consideration of eTAP 11 has fully infiltrated Security Guarantees
Attacker can’t learn trigger and action data
Attacker can’t modify or delay action data
Action Service can’t learn trigger data and vice versa
Action Service can only learn action data when f1 = true
Only client can learn user constant trigger data action data Action Service Trigger-Action Platform (TAP) IF f1(trigger data, constant),
THEN action data = f2(trigger data , constant) Trigger Service User Client [Chiang et al, 2020] [Fernandes et al, 2018],
[Chiang et al, 2020] honest but curious honest but curious malicious trusted Practical Consideration
Minimal changes to trigger and action service (no infrastructural change, constant extra storage per user, etc.)
Services don’t need to know each other or the rules
Client may not be always online<br>
slide12. Design Overview of eTAP Use Garbled Circuit for secure function evaluation
Extend Garbled Circuit to satisfy all security goals
Asymmetric trust assumptions lead to more optimizations 12 Convert functions to garbled circuit
Encode input data Evaluate garbled circuit
Decode output data can be pre-computed w/o input computationally efficient<br>
slide13. Phase #1: Setup (once, w/ client) Action Service Trigger-Action Platform (TAP) Trigger Service 13 During OAuth negotiation with Trigger/Action Service trigger secret key to generate GC encoding information action secret key to protect GC decoding information<br>
slide14. Phase #2: Function Garbling (periodic, w/ client) 14 Trigger-Action Platform (TAP) Client does: Given a Rule:
IF f1(trigger data, constant),
THEN action data = f2(trigger data , constant) garbled circuit,
garbled constant,
decode blob f1, f2 encode info Garbled Circuit Generation garbled circuit decode info constant Symmetric Encryption Input Encoding decode blob garbled constant<br>
slide15. Phase #3: Execution (whenever trigger happens, w/o client) 15 Action Service Trigger-Action Platform (TAP) Trigger Service Trigger Service does: encode info Input Encoding garbled trigger data trigger data garbled trigger data<br>
slide16. Phase #3: Execution (whenever trigger happens, w/o client) 16 Action Service Trigger-Action Platform (TAP) Trigger Service TAP does: garbled trigger data garbled circuit garbled constant garbled trigger data Garbled Circuit Evaluation garbled action data garbled action data decode blob<br>
slide17. Phase #3: Execution (whenever trigger happens, w/o client) 17 Action Service does: Action Service Trigger-Action Platform (TAP) Trigger Service garbled trigger data garbled action data decode blob decode blob Symmetric Decryption decode info Output Decoding action data garbled action data<br>
slide18. Benefits of eTAP’s Design No need for oblivious transfer: All input data provided by “Circuit Generator”
Allows for efficient protocol: Extending semi-honest protocols with authenticity can defend against a malicious TAP 18<br>
slide19. Common functions crawled from top IFTTT + Zapier rules 19<br>
slide20. Common functions crawled from top IFTTT + Zapier rules 20 supported by common GC libraries / easy to implement<br>
slide21. Common functions crawled from top IFTTT + Zapier rules 21 can be implemented with simple regular expression supported by common GC libraries / easy to implement Challenge: How to evaluate regular expression efficiently in garbled circuits?<br>
slide22. Optimize for Regular Expression 22 Regular Expression Deterministic Finite Automaton (DFA) State Transition Circuit Can be replaced with XOR gate One-hot encoded XOR gates can be computed for free<br>
slide23. Common functions crawled from top IFTTT + Zapier rules 23 hard to implement efficiently eTAP supports 93.4% of all Zapier rules and 100% of top 500 IFTTT rules can be implemented with simple regular expression supported by common GC libraries / easy to implement<br>
slide24. Modest overhead of running encrypted rules in eTAP 24 Avg. 55% increase Avg. 59% decrease<br>
slide25. Client Overhead Estimation Based on prior study [Mi et al, 2017] [Cobb et al, 2020], assuming that
an average user has 26 rules installed
each rule will be executed once every 15 minutes
Client needs to spend 10.2 seconds per day to generate garbled circuits of size 61.7 MB in total 25 / 1 min<br>
slide26. Conclusion Trigger-action platforms provide desirable functionality but pose security and privacy threats if compromised.
We propose eTAP, a clean-slate design for trigger-action platforms 26 Yunang Chen yc@cs.wisc.edu Data privacy and integrity against malicious TAP Optimize garbled circuits with asymmetric trust assumptions Efficiently support common string operations Modest performance reduction for rule execution https://github.com/EarlMadSec/etap<br>
Andrei Sabelfeld†, Rahul Chatterjee*, Earlence Fernandes*
* University of Wisconsin-Madison
† Chalmers University of Technology<br>
slide2. Online services with different APIs don’t talk to each other 2<br>
slide3. Trigger-Action Platforms (TAPs) connect independent services to empower automation rules Popular Commercial Trigger-Action Platforms 3<br>
slide4. Trigger-Action Automation Rules room PM level > turn on air purifier threshold IF , THEN new email received is from ring smart speaker bank IF , THEN new transaction happens with send SMS $100 IF THEN 4 transaction amount > AND midnight transaction time during with receiver = , contact information message body = transaction details AND phone number extract from “Warning: ” +<br>
slide5. However, users risk their privacy and security What happens if TAP is compromised? Chat logs Emails Social networks Cloud files Control lights Control power outlets Control ovens Sensitive information is leaked Arbitrary actions can be performed 5<br>
slide6. Security Concerns in TAPs: IFTTT as a Case Study IFTTT’s Term of Use states…
IFTTT operates on lots of sensitive information
Integrated with 600+ services
Has 20M+ users 6<br>
slide7. Security Concerns in TAPs: IFTTT as a Case Study Access tokens acquired by IFTTT are overprivileged [Fernandes et al, 2018]
Gmail removed its triggers from IFTTT due to security concern in 2019 7 Trigger a rule when I upload a new file to Google Drive<br>
slide8. How to design a secure trigger-action system? 8<br>
slide9. eTAP: encrypted Trigger-Action Platform 9 Protect data privacy and integrity Support computations in rules Optimize for string operations Efficient protocol with low overhead<br>
slide10. Abstract Paradigm of a Trigger-Action System trigger data action data Action Service Trigger-Action Platform (TAP) IF f1(trigger data, constant),
THEN action data = f2(trigger data , constant) Trigger Service 10 Programmed through User Client<br>
slide11. Security Guarantees and Practical Consideration of eTAP 11 has fully infiltrated Security Guarantees
Attacker can’t learn trigger and action data
Attacker can’t modify or delay action data
Action Service can’t learn trigger data and vice versa
Action Service can only learn action data when f1 = true
Only client can learn user constant trigger data action data Action Service Trigger-Action Platform (TAP) IF f1(trigger data, constant),
THEN action data = f2(trigger data , constant) Trigger Service User Client [Chiang et al, 2020] [Fernandes et al, 2018],
[Chiang et al, 2020] honest but curious honest but curious malicious trusted Practical Consideration
Minimal changes to trigger and action service (no infrastructural change, constant extra storage per user, etc.)
Services don’t need to know each other or the rules
Client may not be always online<br>
slide12. Design Overview of eTAP Use Garbled Circuit for secure function evaluation
Extend Garbled Circuit to satisfy all security goals
Asymmetric trust assumptions lead to more optimizations 12 Convert functions to garbled circuit
Encode input data Evaluate garbled circuit
Decode output data can be pre-computed w/o input computationally efficient<br>
slide13. Phase #1: Setup (once, w/ client) Action Service Trigger-Action Platform (TAP) Trigger Service 13 During OAuth negotiation with Trigger/Action Service trigger secret key to generate GC encoding information action secret key to protect GC decoding information<br>
slide14. Phase #2: Function Garbling (periodic, w/ client) 14 Trigger-Action Platform (TAP) Client does: Given a Rule:
IF f1(trigger data, constant),
THEN action data = f2(trigger data , constant) garbled circuit,
garbled constant,
decode blob f1, f2 encode info Garbled Circuit Generation garbled circuit decode info constant Symmetric Encryption Input Encoding decode blob garbled constant<br>
slide15. Phase #3: Execution (whenever trigger happens, w/o client) 15 Action Service Trigger-Action Platform (TAP) Trigger Service Trigger Service does: encode info Input Encoding garbled trigger data trigger data garbled trigger data<br>
slide16. Phase #3: Execution (whenever trigger happens, w/o client) 16 Action Service Trigger-Action Platform (TAP) Trigger Service TAP does: garbled trigger data garbled circuit garbled constant garbled trigger data Garbled Circuit Evaluation garbled action data garbled action data decode blob<br>
slide17. Phase #3: Execution (whenever trigger happens, w/o client) 17 Action Service does: Action Service Trigger-Action Platform (TAP) Trigger Service garbled trigger data garbled action data decode blob decode blob Symmetric Decryption decode info Output Decoding action data garbled action data<br>
slide18. Benefits of eTAP’s Design No need for oblivious transfer: All input data provided by “Circuit Generator”
Allows for efficient protocol: Extending semi-honest protocols with authenticity can defend against a malicious TAP 18<br>
slide19. Common functions crawled from top IFTTT + Zapier rules 19<br>
slide20. Common functions crawled from top IFTTT + Zapier rules 20 supported by common GC libraries / easy to implement<br>
slide21. Common functions crawled from top IFTTT + Zapier rules 21 can be implemented with simple regular expression supported by common GC libraries / easy to implement Challenge: How to evaluate regular expression efficiently in garbled circuits?<br>
slide22. Optimize for Regular Expression 22 Regular Expression Deterministic Finite Automaton (DFA) State Transition Circuit Can be replaced with XOR gate One-hot encoded XOR gates can be computed for free<br>
slide23. Common functions crawled from top IFTTT + Zapier rules 23 hard to implement efficiently eTAP supports 93.4% of all Zapier rules and 100% of top 500 IFTTT rules can be implemented with simple regular expression supported by common GC libraries / easy to implement<br>
slide24. Modest overhead of running encrypted rules in eTAP 24 Avg. 55% increase Avg. 59% decrease<br>
slide25. Client Overhead Estimation Based on prior study [Mi et al, 2017] [Cobb et al, 2020], assuming that
an average user has 26 rules installed
each rule will be executed once every 15 minutes
Client needs to spend 10.2 seconds per day to generate garbled circuits of size 61.7 MB in total 25 / 1 min<br>
slide26. Conclusion Trigger-action platforms provide desirable functionality but pose security and privacy threats if compromised.
We propose eTAP, a clean-slate design for trigger-action platforms 26 Yunang Chen yc@cs.wisc.edu Data privacy and integrity against malicious TAP Optimize garbled circuits with asymmetric trust assumptions Efficiently support common string operations Modest performance reduction for rule execution https://github.com/EarlMadSec/etap<br>