Threat Model

Threat modeling is a systematic approach used to identify, understand, and mitigate potential security threats to a system before they can be exploited. By anticipating possible attack vectors, organizations can design more secure systems, prioritize resources effectively, and reduce the risk of security breaches.

Scope

In the context of security, a threat is anything that has the potential to cause harm to a system, asset, or organization. Threats can come from many sources — such as hackers, malware, natural disasters, or even human error — and they exploit vulnerabilities to compromise confidentiality, integrity, or availability. In our threat model we focus on human threat sources, and threat actors who for one reason or another seek to harm the trust infrastructure. The threat model concerns all components inside the swiyu Trust Infrastructure.

Assumptions

We assume all attackers have bounded computation and bounded time. Therefore they don’t have the capability to break cryptographic primitives.
TLSv1.3 not breakable
TEE Strong enough to prevent remote key extraction
Operating System is trustworthy
Device is trustworthy

STRIDE Framework

STRIDE is a widely used framework for categorizing different types of security threats. It helps teams systematically identify potential threats during the threat modeling process. The acronym STRIDE stands for six key threat categories:

Spoofing: Pretending to be someone or something else to gain unauthorized access.
Tampering: Altering data or code to cause harm.
Repudiation: Denying an action or transaction, making it hard to prove accountability.
Information Disclosure: Exposing sensitive information to unauthorized parties.
Denial of Service: Disrupting system availability to legitimate users.
Elevation of Privilege: Gaining higher access rights than allowed.

Attack Trees

We use attack trees to visualize and structure the threat model. Attack trees give us a way to arrange the threats into a tree instead of a flat list. Each attack tree starts with a critical security goal for an attacker.

1 Ecosystem unavailable

1.1 Unavailable Mobile Backend

1.2 External services unavailable

1.3 Wallet unavailable

1.4 Support not available

1.5 Registries unavailable

1.6 Credential not accessible

1.7 Actor unavailable

2 Compromise component

2.1 Internal operating information leak

2.1.1 Internal worker leaks internal data

2.2 Design / Implementation flaws

2.2.1 Supply Chain attack

| Description | We rely on libraries in our code. We thus also rely on their security. A malicious library can gain information, make the system unavailable, or execute code on the systems. | |:————–|:———-| | Stride | Information Disclosure (I), Denial of Service (D), Elevation of Privilege (E) | | Components | Issuer, Registry, Verifier, Wallet |

2.2.2 Malicious requests to swiyu components

2.2.3 Swiss Trust Protocol flaws

2.2.4 Reach hidden/protected endpoints

2.2.5 Insecure configuration

2.3 Unallowed change of swiyu managed content

2.4 Spoof communication partner

3 Steal verifiable credential

3.1 Circumvent verification

3.2 Issue credential for attacker

3.2.1 Steal credential offer during issuance

3.2.2 Impersonate legitimate issuer

3.2.3 Impersonate holder

3.2.3.1 Exploit e-ID request flow

3.2.3.2 Unauthorized credential access

3.2.3.2.1 Unauthorized access to backup

3.2.3.2.2 Physical access to wallet

3.2.3.3 Exploit credential renewal flow

3.2.3.4 Exploit recovery mechanism

3.2.3.4.1 Unauthorized access to backup

3.2.3.5 Verification with friend credential

3.2.4 Issue restricted schema

3.3 Change sent VC

3.4 Change credential request

4 Exfiltrate User Data

4.1 Holder tracking

4.1.1 Registry observability / trackability

4.1.2 Attestation + Push Notification Service observability / trackability

4.1.3 Verifier stores data to track user

4.1.4 Collusion against Holder

4.1.4.1 Issuer & Verifier collusion

4.1.4.2 Verifier & Verifier collusion

4.1.4.3 Issuer & Registry collusion

4.1.5 Issuer tracks credential holders

4.2 Unauthorized credential access

4.2.1 Unauthorized access to backup

4.2.2 Physical access to wallet

4.3 Internal worker leaks internal data

4.4 Holder information to underlying infrastructure

4.4.1 Supply Chain attack

4.5 Issuer leaks sensitive data

4.6 Verifier leaks sensitive data

4.6.1 Impersonate legitimate verifier

4.6.2 Verifier stores data to track user

4.6.3 Verifier requests too much data

4.6.4 Leak personal information through side channel

5 Deny Action

5.1 Deny receiving message

5.2 Deny processing message

5.3 Deny sending message