Box: A Platform for Privacy-Preserving Apps ... controlled sharing Aggregate channel bounded...

download Box: A Platform for Privacy-Preserving Apps ... controlled sharing Aggregate channel bounded information

of 82

  • date post

    23-May-2020
  • Category

    Documents

  • view

    1
  • download

    0

Embed Size (px)

Transcript of Box: A Platform for Privacy-Preserving Apps ... controlled sharing Aggregate channel bounded...

  • πBox: A Platform for Privacy-Preserving Apps

    Sangmin Lee, Edmund L. Wong, Deepak Goel, Mike Dahlin, Vitaly Shmatikov

    The University of Texas at Austin

  • 17% paid attention

  • 17% paid attention

    3% understood

    From “Android permissions: User attention, comprehension, and behavior.” In SOUPS 2012.

  • 300,000 app publishers!

  • Shifting user trust from 300,000 app publishers...

  • Shifting user trust from 300,000 app publishers...

    to a few well known brands

  • Shifting user trust from 300,000 app publishers...

    to a few well known brands that many already trust

  • πBox A platform that allows users to use untrusted apps while

    providing explicit and useful privacy guarantees

  • Confine apps for STRONG PRIVACY

  • aggregate channel

    sharing channel

  • Platform channels for FUNCTIONALITY

    aggregate channel

    sharing channel

  • How are apps confined within the sandbox?

    How does the aggregate channel work?

    How does the sharing channel work?

    What guarantees are provided to users?

    What is the applicability and overhead of πBox?

    Outline

  • How are apps confined within the sandbox?

    How does the aggregate channel work?

    How does the sharing channel work?

    What guarantees are provided to users?

    What is the applicability and overhead of πBox?

    Outline

  • Per-user, per-app sandbox

  • Per-user, per-app sandbox

  • Per-user, per-app sandbox

    X

  • Per-user, per-app sandbox

  • Per-user, per-app sandbox spans device and cloud

  • Per-user, per-app sandbox spans device and cloud

  • Private vault read/write

    Per-user, per-app sandbox spans device and cloud

    (e.g., settings, search history)

  • Content storage shared read-only, per-app

    Per-user, per-app sandbox spans device and cloud

    Private vault read/write

    (e.g., map data, media)

  • How are apps confined within the sandbox?

    How does the aggregate channel work?

    How does the sharing channel work?

    What guarantees are provided to users?

    What is the applicability and overhead of πBox?

    Outline

  • Just set it and forget it! The Ronco Showtime Rotisserie Oven

  • Just set it and forget it! The Ronco Showtime Rotisserie Oven

  • App Publisher

    ...

    Aggregate channel (shared write only)

    releasing true values enable app to signal to publisher

    πBox

  • Counter for ad x

    App Publisher

    ...

    one counter per ad

    Aggregate channel (shared write only)

    releasing true values enable app to signal to publisher

    Just set it and forget it! The Ronco Showtime Rotisserie Oven

    πBox

  • Counter for ad x

    App Publisher

    ...

    Aggregate channel (shared write only)

    releasing true values enable app to signal to publisher

    πBox

  • Counter for ad x

    App Publisher

    ...

    Aggregate channel (shared write only)

    releasing true values enable app to signal to publisher

    πBox

  • Counter for ad x

    App Publisher

    ...

    Aggregate channel (shared write only)

    releasing true values enable app to signal to publisher

    πBox

  • Counter for ad x

    App Publisher

    ...

    Aggregate channel (shared write only)

    releasing true values enable app to signal to publisher

    πBox

  • Counter for ad x

    App Publisher

    ...

    Aggregate channel (shared write only)

    uses differential privacy to bound information leak

    πBox

  • Counter for ad x

    App Publisher

    ...

    Aggregate channel (shared write only)

    uses differential privacy to bound information leak

    πBox

  • +Counterfor ad x

    App Publisher

    ...

    random noise

    Aggregate channel (shared write only)

    uses differential privacy to bound information leak

    πBox

  • +Counterfor ad x

    App Publisher

    ...

    Aggregate channel (shared write only)

    uses differential privacy to bound information leak

    πBox

  • +Counterfor ad x

    App Publisher

    ...

    Aggregate channel (shared write only)

    uses differential privacy to bound information leak

    see paper for other types of counters (delayed, top-K)

    πBox

  • How are apps confined within the sandbox?

    How does the aggregate channel work?

    How does the sharing channel work?

    What guarantees are provided to users?

    What is the applicability and overhead of πBox?

    Outline

  • what is shared when it is shared with whom it is shared

  • what is shared when it is shared with whom it is shared

  • what is shared when it is shared with whom it is shared

  • π

  • π Dialog box displayed by πBox

  • π Dialog box displayed by πBox

    ← πBox asks whom to share with

  • π Dialog box displayed by πBox

    ← πBox asks whom to share with Users know when and

    with whom sharing occurs

  • π Dialog box displayed by πBox

    πBox confirms content to share

    ← πBox asks whom to share with Users know when and

    with whom sharing occurs

  • π Dialog box displayed by πBox

    πBox confirms content to share

    ← πBox asks whom to share with

    Users may not know what is shared (steganography)

    Users know when and with whom sharing occurs

  • π Dialog box displayed by πBox

    πBox confirms content to share

    ← πBox asks whom to share with

    Users may not know what is shared (steganography)

    Users know when and with whom sharing occursDifficult for publishers

    to gain access to private data

  • How are apps confined within the sandbox?

    How does the aggregate channel work?

    How does the sharing channel work?

    What guarantees are provided to users?

    What is the applicability and overhead of πBox?

    Outline

  • Extended sandbox

    Sharing channel controlled sharing

    Aggregate channel bounded information leak

    ... +Counterfor ad x

    π

  • Extended sandbox strong confinement

    Sharing channel controlled sharing

    Aggregate channel bounded information leak

    ... +Counterfor ad x

    π

  • Extended sandbox strong confinement

    Sharing channel controlled sharing

    Aggregate channel bounded information leak

    ... +Counterfor ad x

    π

  • Extended sandbox strong confinement

    Sharing channel controlled sharing

    Aggregate channel bounded information leak

    ... +Counterfor ad x

    π

  • Extended sandbox strong confinement

  • Extended sandbox strong confinement

    USER%WELCOME

    NO%RISK%TO%PRIVACY

  • Extended sandbox strong confinement

    + Aggregate channel bounded information leak

    ... +Counterfor ad x

  • Extended sandbox strong confinement

    + Aggregate channel bounded information leak

    ... +Counterfor ad x

    USER%GUIDANC E%SUGGESTED

    MINIMAL%RISK% TO%PRIVACY

  • π

    Extended sandbox strong confinement

    Sharing channel controlled sharing

    Aggregate channel bounded information leak

    ... +Counterfor ad x

    +

    +

  • π

    Extended sandbox strong confinement

    Sharing channel controlled sharing

    Aggregate channel bounded information leak

    ... +Counterfor ad x

    +

    + USER

    %STRO NGLY

    %CAUT IONE

    D

    MAY%L EAK%I

    NFOR MATI

    ON%W HEN%S

    HARI NG

  • How are apps confined within the sandbox?

    How does the aggregate channel work?

    How does the sharing channel work?

    What guarantees are provided to users?

    What is the applicability and overhead of πBox?

    Outline

  • 1. Can real applications benefit from πBox?

    2. How much implementation effort is needed to use πBox?

    3. What is the overhead of using πBox?

    Three questions

  • From Google Play (as of Feb. 2013). Based on developer’s description. Core functionality only.

    Arcade/Action Books

    Brain/Puzzles Business

    Cards/Casino Casual Comics

    Communication Education

    Entertainment Finance

    Health/Fitness Lifestyle

    Live Wallpaper Media/Video

    Medical Music/Audio

    News/Magazines Personalization Photography Productivity

    Racing Shopping

    Social Sports

    Sports Games Tools

    Tra