Addressing Data Breaches through Localization

NSPW08 Presentation, Sept. 23, 2008
Localization of Credential Information to Address
Increasingly Inevitable Data Breaches

Mohammad Mannan and P.C. van Oorschot
mmannan@scs.carleton.ca

Carleton University, Canada

Mohammad Mannan

Sept. 23, 2008

1/16

Addressing Data Breaches through Localization“...we do not have any evidence that the data ... has been
improperly accessed or misused...”Mohammad Mannan

Sept. 23, 2008

2/16

Addressing Data Breaches through Localization

Goals of our proposal
1. Goals:
 limit misuse of breached ID numbers from relying parties
 ameliorate huge data breaches (but not card theft or loss)– primary concern: identity theft

2. Non-goals:
 prevent data breach privacy

Mohammad Mannan

Sept. 23, 2008

3/16

Addressing Data Breaches through Localization

Overview of ID localization

address “compromise once, reuse multiple times”

design for damage control
Mohammad Mannan

Sept. 23, 2008

4/16

Addressing Data Breaches through Localization

Assumptions
1. Breaches will happen...there is no 100% prevention
2. Massive breaches usually involve relying party
3. ID issuers are targeted less often
4. Up-to-date user lookup data can be maintained
5. Online verification is possible

Mohammad Mannan

Sept. 23, 2008

5/16

Addressing Data Breaches through Localization

Overview of our proposal
1. ‘Localize’ ID numbers so that they are valid only for aparticular relying party
 valid for Internet/phone, physical world
 not necessarily ‘one-time’ use IDs
2. Limit misuse, assuming breaches can’t be prevented
3. The problem domain is large: we propose several variants

Mohammad Mannan

Sept. 23, 2008

6/16

Addressing Data Breaches through Localization

ID localization: issue card
ID cardFixed ID

custom length128-bit secretUser

ID Issuer

Mohammad Mannan

Sept. 23, 2008

7/16

Addressing Data Breaches through Localization

ID localization: generate ‘localized’ ID

Mohammad Mannan

Sept. 23, 2008

8/16

Addressing Data Breaches through Localization

ID localization: verify ‘localized’ ID

Mohammad Mannan

Sept. 23, 2008

9/16

Addressing Data Breaches through Localization

Variants 1 & 2
1. Variant 1: Localized authorization code PRF-output is used as authorization code (cf. CVV2)
 fixed ID + auth. code is required for any valid use

2. Variant 2: Without chip-card or card-reader
 shared ‘secret’ is printed on the card
 localized ID (or auth. code) is generated through a personal device

Mohammad Mannan

Sept. 23, 2008

10/16

Addressing Data Breaches through Localization

Limitations
1. Data aggregation isn’t straight-forward
2. Several types of privacy-sensitive info remain unprotected
3. Requires online verification
4. Deployment would most-likely require: increased liability strong consumer lobbying legislation/regulation

but now is the time for a change...
Mohammad Mannan

Sept. 23, 2008

11/16

Addressing Data Breaches through Localization

Open issues
1. Using static, reusable numbers invites repeated misuse but how can they be replaced?
2. Can we apply localization beyond data breaches?

Design for damage control

Mohammad Mannan

Sept. 23, 2008

12/16

Addressing Data Breaches through Localization

Backup slides

Mohammad Mannan

Sept. 23, 2008

13/16

Addressing Data Breaches through Localization

Current approaches that fall short
1. Data encryption
2. Intrusion detection/prevention systems
3. One-time use credit cards: Citibank MasterCard, DiscoverCard
4. Academic proposals: FC01, FC07, RIDE04, ESORICS08
5. Legal remedies, breach notification laws

Mohammad Mannan

Sept. 23, 2008

14/16

Addressing Data Breaches through Localization

Consequences for consumers: identity fraud
1. “Full identity” costs only $1-15
2. Time lost to resolve ID fraud
3. Denied financial services
4. Harassment by collection agencies
5. Criminal prosecution/arrest

Mohammad Mannan

Sept. 23, 2008

15/16

Addressing Data Breaches through Localization

Variants 3 & 4
1. Variant 3: Database poisoning each relying party inserts fake user records in its database breach is detected when fake records are used
 card issuers may also use this technique

2. Variant 4: User-centric authorization
 notify/seek user approval for e.g. issuing new card, transferring user info across domains, high-value trans.
 deploy “physical presence” mechanisms for approval

Mohammad Mannan

Sept. 23, 2008

16/16