EBSI digital identity DDoS hardening using IP reputation #7481
Comments
|
why has public key infrastructure failed for 35 years |
|
Ask Google Scholar about PKI failure. First result: see 2016 ideas on Self-sovereign identity (SSI). TUDelft Master student full-time on EU digital ID from 2021. Discussed the Literature Survey wiki documentation {brainstorm in bit harsh term} A fraud-resilient authentication method is notoriously hard to realise. Academic thinkers have offered little help, academic literature extensively documents numerous ideas and design sketches. Public key cryptography was invented in the year: ... In the 35 years since this invention we have failed to utilise this invention. The European Digital Identity project (EBSI) is only the latest in a long line of failed attempts. For instance, "Overview of the German identity card project and lessons learned (2020 update)" and "The giant is lagging behind - How the German electronic ID fails to reap its potential. Bit of general info news article "Digital Identity: Where We Began, Where We Are And Where We Are Going" {early brainstorm for master thesis} The above builds expertise on wide scope of upcoming EU digital ID. Security will we essential, but EBSI server is based upon IBM Hyperledger technology. This is expected to only serve a good purpose during development. For full-scale production usage as the underpinning of the entire EU digital economy Hyperledger server probably needs replacing. Ideal outcome would be re-using the infrastructure at Delft to develop a 12-line Kotlin script to bring down such a EBSI Hyperledger server. See 2021 Delft master student who made the first open source Android EBSI v2 communications lib. Good news, save this project with application-level firewall rules???? |
|
On the risk of misbehaving RPKI authorities REGULATION (EU) on eid |
|
Lots of written documents in the past 35 years, yet no generic solution for digital identity:
|
|
|
|
Almost final draft |
|
|
|
Finished final version of the Survey. |
|
|
The survey is uploaded to arXiv with the lastest version. |
|
Completed! Today the master thesis work starts 🎉 |
|
Studied the code for existing EBSI wallet in the SuperApp |
|
Concrete tasks to further explore your thesis focus.
|
synctext
changed the title
|
Next week we should get an EBSI server image to install, so there is movement...
|
|
Update sprint:
|
|
|
Sprint update:
Full draft docker magic |
synctext
changed the title
|
|
Update sprint:
|
|
|
Short sprint update:
|
|
|
Brainstorming sprint:
|
|
😲 😲 😲 You have a viable roadmap to fix The Internet. P2P Modsecurity is a brilliant idea. With a bit of tweaking it is also incrementally expandable. However, no smart contracts, gas payments, and Turing incompleteness please. Re-architecting The Internet using zero-trust principle, Modsecurity, and PUFsWe create a layer of trust The Internet always needed, but never had. In 1962 the architecture of The Internet for the Roadmap till 31 Oct graduation
update: strong related work of a -simulation- of attack info sharing https://github.com/LukasForst/fides + proper code: https://github.com/stratosphereips/StratosphereLinuxIPS |
|
Back to coding 🎊 Created custom rules for modsecurity to apply on failed login and detect. Lots of options from documentation with different level of details to add to the logging and rules for specific requests https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-%28v3.x%29 Logging in an audit.log file that creates JSON for a transaction{
"transaction": {
"time": "20/May/2024:09:29:53.332742 +0000",
"transaction_id": "Zk27Eeazul3OewgjLhj2PAAAAAA",
"remote_address": "172.17.0.1",
"remote_port": 37570,
"local_address": "172.17.0.2",
"local_port": 80
},
"request": {
"request_line": "POST /login HTTP/1.1",
"headers": {
"Host": "localhost",
"User-Agent": "python-requests/2.32.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Connection": "keep-alive",
"Content-Length": "35",
"Content-Type": "application/x-www-form-urlencoded"
},
"body": [
"username=admin&password=faspassword"
]
},
"response": {
"protocol": "HTTP/1.1",
"status": 403,
"headers": {
"Content-Type": "application/json",
"Content-Length": "27",
"Keep-Alive": "timeout=5, max=100",
"Connection": "Keep-Alive"
},
"body": ""
},
"audit_data": {
"messages": [
"Warning. String match \"403\" at RESPONSE_STATUS. [file \"/etc/modsecurity/custom_rules.conf\"] [line \"3\"] [id \"1001\"] [msg \"Failed login attempt detected\"]"
],
"error_messages": [
"[file \"apache2_util.c\"] [line 275] [level 3] [client 172.17.0.1] ModSecurity: Warning. String match \"403\" at RESPONSE_STATUS. [file \"/etc/modsecurity/custom_rules.conf\"] [line \"3\"] [id \"1001\"] [msg \"Failed login attempt detected\"] [hostname \"localhost\"] [uri \"/login\"] [unique_id \"Zk27Eeazul3OewgjLhj2PAAAAAA\"]"
],
"handler": "proxy-server",
"stopwatch": {
"p1": 589,
"p2": 882,
"p3": 75,
"p4": 115,
"p5": 1215,
"sr": 111,
"sw": 1115,
"l": 0,
"gc": 0
},
"response_body_dechunked": true,
"producer": [
"ModSecurity for Apache/2.9.7 (http://www.modsecurity.org/)",
"OWASP_CRS/3.3.4"
],
"server": "Apache/2.4.59 (Debian)",
"engine_mode": "ENABLED"
}
}{
"ip_address": "172.18.0.1",
"request_method": "POST",
"request_uri": "/login HTTP/1.1",
"status_code": 403,
"message": "Warning. String match \"403\" at RESPONSE_STATUS. [file \"/etc/modsecurity/custom_rules.conf\"] [line \"3\"] [id \"1001\"] [msg \"Failed login attempt detected\"]"
}Next steps:
|
|
|
Work in progress:
|
|
🎉 🎉 🎉
Next sprints: idea gets bigger, experiments become more focused. 15Sep talk to EBSI server or cancel that part. |
|
Experiment update:
Full Rules set |
ToDo: write small text with state-of-the-art in DDoS + IPv4 reputation. Expand experiment. |
|
Back to school with new experiment results.
BUT there are good news for them:
Code with the latest experiment Next steps perhaps:
|
|
Solid progress. With the first operational trust token, now see how this would "sell" in a master thesis. DDoS is still the main attack. If you do the same work, but titled "Zero-Trust Architecture", then it is suddenly scientific 🤡 🧐 🤡
Linkage of zero-trust architecture to first principles of digital identity. Key thing is to make it as expensive as possible to setup, maintain, and/or exit fake identities. No focus on the detailed scoring, focus on the realisation of the overall architecture. What would 3 convincing zero-trust EBSI passport-grade ID experiments look like?
TrustZero: Passport-grade trust at Internet scaleOur audacious aim is to secure the European digital economy. We present the TrustZero architecture, a zero-trust architecture based upon the legal framework of European Union eIDAS for passport-grade digital identity. Specifically, TrustZero is meticulously design to provide passport-grade identity and trust for all financial transactions, information flows, and socio-economic activity in general. These four fundamental security assertions are provided by TrustZero:
TrustZero thus first confirms who you are with absolute certainty. We deliberately selected the passport as the root-of-trust within TrustZero. Passports offer unrivalled security, broad usage, and deep historical grounding. Digital wallets on your smartphone are the modern equivalents of passports. {ToDo: 🚧 Byzantine robustness is critical for our envisioned societal primitive. TrustZero guarantees protection against any Byzantine communication failure, when the private keys remain private [REF]}. Transitive trust and generic value transfer are the two main elements of TrustZero on top of identity management. It grants citizens autonomy, facilitates ad-hoc trusted collaboration, ability to construct trust networks, and establish trustworthy socio-economic activity in general. Our transitive trust and value transfer elements are designed to be long-enduring and evolvable, inspired by TCP/IP, Email, and HTTP. The TrustZero trust model goes beyond the mere delegation of trust from at most 1 identity to an entity. With transitive trust multiple identities attest the trustworthiness of a single receiver. This receiver can be another person, organisation, car/ship, object, or entity in general. TrustZero could potentially re-establish trust in social media, product review sites, and other Internet services. In prior work we designed and deployed a digital Euro with live connectivity to the legacy IBAN banking system of Europe. TrustZero digital wallets may contain fiat money, promissory notes, Bitcoins, or tokens of vaulted gold with outright ownership of certain physical gold. Previously we also designed and implemented an offline-first currency system by using Groth-Sahai proofs. Transactions can be executed offline without third parties and retroactive double-spending detection is facilitated. Collective intelligence is a specific and powerful socio-economic activity enabled by TrustZero. No design chapter yet. For 1 sprint write a thesis-ready introduction+Problem Description. |
|
ToDo: start writing first 4-5 pages of thesis! |
|
This sprint: get first experiments into thesis (text+graph). Who, Why, What + How
|
|
|
Great step forward in thesis 🎉
update: Would advise you to delete Introduction and start over with different tone. Zero trust is not a hard-core systems topic. It's not about throughput, cache hits, tps, and latency. So outside our comfort zone. All this fluffy noisy info out there says its about consultancy fees, management buy-in, B2B sales pitches, awareness programs against an advanced threats, and getting hacked. Introduction storyline... The zero trust movement is a reaction to this evolving cybersecurity armsrace. Simply using a VPN to encrypt traffic on The Internet is no longer sufficient in the age of zero-days trading. According to the European Systemic Risk Board report: The persistently heightened cyber threat environment in Europe is evidenced by the sabotage of undersea telecommunications cables, the disruptions to systems in large banks and third-party providers, and the increased sophistication of cyberattacks and the skills of hackers. Big Tech giant Google was successfully "hacked" by China, as revealed in official company and US government publications. On January 14, 2010, the United States learned of a coordinated, sophisticated, and prolonged computer attack that targeted Google, Adobe and over 30 Fortune 100 companiesREF. Dubbed Operation Aurora after a folder found in an infected machine, the attack used a novel zero-day exploit. State-sponsored hackers focus on attacking and infiltrating second-tier defence industry suppliers that make electronic or mechanical components for major defence companies. Those companies then become a cyber "stepping stone" to gain access to the major defence contractors TEXT FULLY COPIED FROM WIKIPEDIA. Problem Description After the successful attack on Google they migrated all their legal, financial, engineering, and administrative staff into isolated network domains using the zero trust principle. However, their description is very high level and lacks the details needed for scientific reproducibility. design Tech companies such as ASML have over 5000 suppliersREF. We use this level of complexity, depth, and diversity of the modern supply chain to our advantage. All prior work operated zero trust from the perspective of a single business entity, isolated organisation, or solitary government. ZeroTrust is based on the novel principle of making trust portable at a global scale. the core of ZeroTrust is enabling various autonomous entities to exchange their verified trust. Experiments and performance analysis First we quantify the most basic element: the wallet and passport-grade login service. Second we explore Time-based One-time Passwords (TOTP). Third, a hardware security module (HSM) is a physical computing device that safeguards and manages secrets (most importantly digital keys). |
|
update: try out EBSI passport-grade wallet service about trust: https://github.com/eu-digital-identity-wallet/eudi-srv-web-trustprovider-signer-java ? |
Survey Q1 + Starting thesis
10 jan{job next to thesis}Also interested in the problem of online trust. General intro and overview by Bruce {rockstar of security research} Ten Risks of PKI: What You’re not Being Told about Public Key Infrastructure. Technical discussion on HackerNews on passport failures and public key directories.
{duplicate from # 7423}
More on passport-level digital identity. Warning given 😸 "this is complex stuff". identity is the foundation of trust in the old analog world. Please make a reading list about SSI, EBSI, EBP and eIDAS2
please note the survey @ Tribler lab methodology: https://github.com/Tribler/tribler/wiki/MasterThesis#10-ects-literature-survey-at-tribler-lab (e.g. try out all known open source wallets for suvey and grade them with stong/weak analysis in a table with screenshots { https://walt.id/ebsi ; https://github.com/walt-id })
The text was updated successfully, but these errors were encountered: