Journalists, aid workers, and democracy advocates all put themselves in harm’s way for the benefit of others. Yet, there is a glaring need for them to store data securely. Typically, private data is protected with encryption that is assumed unbreakable. Yet, if those in a hostile environment are caught with encrypted data, they could be forced to comply through coercion or threats of bodily harm. We propose to secure data in plain sight by hiding it so that the operating system doesn’t even know it’s there. Therefore, the owner can completely deny the existence of the data.
A variety of previously developed systems have been designed in an attempt to address this problem. In the process of navigating the compromises inherent to plausibly deniable storage, each of these systems have demonstrated distinctive “tells” that enable a skilled adversary with knowledge of their design to quickly discover them. Since carrying encrypted files or dedicated hardware can be inherently suspicious, a deniable storage system must be hidden within a publicly visible file system or storage device to maintain plausible deniability. It is highly suspicious if there are visible drivers or firmware, unconventional partitioning schemes, excess unusable space in a file system, or unexplained changes to the disk’s free space. To avoid suspicion, the hidden volume must operate in such a way that the encapsulating file system and operating system are entirely unaware of the hidden file system’s existence, even when faced with a detailed forensic examination.
We take a step toward the goal of applying deniable storage systems to safeguard users by addressing the above requirements with Artifice, a block device that provides functional plausible deniablility for both hidden data and the Artifice driver itself. To access a hidden volume, the user boots into a separate, Artifice-aware operating system through a Linux live USB drive which provides effective isolation from the host OS. Unlike earlier systems, this does not leave behind suspicious drivers on the user’s machine and mitigates the impact of malware and information leakage to the public volume. As the public file system cannot be aware of Artifice’s existence, Artifice must protect itself from damage due to overwrites by public operations. Information Dispersal Algorithms (such as Shamir Secret Sharing) provide Artifice overwrite tolerance through the inclusion of redundant blocks and enable a self repair process whenever the user boots the Artifice-aware OS. The overwrites still occur, but don’t cause irreparable harm.
Artifice is implemented as a Linux Device Mapper target and is
distributed as a loadable Linux kernel module. It is intended
to be installed on a bootable Live disk and be used alongside a
distribution such as Tails. Currently it is compatible with FAT32 and
EXT4 file systems.
Source Code
Modern day general data privacy regulations state that people can request for data pertaining to them to be deleted without undue delay. Existing storage systems are not equipped to handle secure deletes and tend to leave traces of deleted data for indeterminant periods of time. Current approaches to secure deletion, repeated overwrite and encryption, are also unsatisfactory. Flash media makes the former especially difficult. SSDs typically allocate new blocks for data, providing logical overwrite, but not overwriting physical flash pages. In place overwrites on flash are costly and negatively impact endurance.
Encryption is an alternative to provide secure deletion. Data is securely deleted if the encryption key used to encrypt the data is forgotten. For a file system, this typically entails at least one key per file. This is problematic when block modifications occur as any modification requires a complete re-encryption of the entire file with a new key. To provide a finer granularity, per block encryption keys can be used as well, but quickly turns into a larger key management problem. To address these shortcomings, we propose Lethe, a new system designed to provide efficient key management and secure deletion in file systems, regardless of storage medium, by utilizing keyed hash trees. Using keyed hash trees, Lethe is able to provide secure deletion at a block-level granularity, only requiring that exactly one key needs to be remembered and able to be securely forgotten.
Covert timing channels present a means of securely transferring sensitive data, such as encryption keys, between nodes in a distributed system without detection from an adversary. Typically timing channels are used by an adversary to exfiltrate data, and the majority of security research on this topic has pursued their detection and disruptive capabilities. We show that, when used in a distributed system with especially high volume of network traffic, covert timing channels can be an effective means to reestablish security when a system's network infrastructure has been compromised.
Vinz Clortho is a system independent, TCP Handshake based, Linux Netfilter kernel module designed to measure inter-node latency, covertly transmit a message through manipulating packet latency, and then rebuild that message using Reed-Solomon encoding. Vinz Clortho can communicate a secret message reliably, albeit slowly, while still maintaining the ability to remain undetected.
Experimental implementation and observations pertaining to a Add-Remove Partial Order graph Conflict Free Replicated Data Type as described by Shapiro et al. in the paper A Comprehensive Study of Convergent and Commutative Replicated Data Types. This work was for Professor Lindsey Kuper's CMPS 290s seminar.