Bluff Forwarding: A Practical Protocol for Delivering Refreshed Symmetric Keys on a Multi-Path Big Data Ingestion System

Abstract

In this paper, we present a clean-slate design of a novel and practical protocol for transporting refreshed symmetric keys for multi-path big data ingestion systems. Our objective is to securely and reliably deliver the refreshed keys from data sources to the data collection servers even in the presence of malicious attackers. To satisfy this objective, we first adapt the secret sharing algorithm. We split symmetric keys into multiple secrets in such a way that partial retrieval of the secrets does not warrant the reconstruction of the original key. Then, we hide the updated secret keys by shuffling them into a group of randomly generated fake keys. These keys are encapsulated in a message container called a bluff. We develop a protocol that makes it computationally infeasible for the attackers to distinguish between bluffs and normal data. We implement and test this protocol on Apache Flume, which is a widely used, state-of-the-art data ingestion system. We analyze the security aspects of our protocol and observe the effects of various configuration settings on the data ingestion performance.