Due to the increasing adoption of public cloud services, virtualization, IoT, and emerging 5G technologies, enterprise network services and users, e.g., remote workforce, can be at any physical location. This results in that network perimeter cannot be defined precisely anymore, making adequate access control with traditional perimeter-based network security models (e.g., firewall, DMZ) challenging. The Zero Trust (ZT) network access framework breaks with this traditional approach by removing the implicit trust in the network. ZT demands strong authentication, authorization, and encryption techniques irrespective of the physical location of the devices. While several prominent companies have embraced ZT (e.g., Google, Microsoft, Cloudflare), its adoption has several obstacles.

A sequence of composable network functions constitutes a service function chain (SFC). Network function virtualization and software-defined networking have made SFCs feasible. With SFCs, a fundamental security requirement is that traffic, directed to traverse a path of network functions, actually follows the specified path. Current path validation enables path enforcement and verification, with on-path nodes able to verify that packets have indeed traversed the specified path. However, there is a problem — on-path service nodes, that implement network functions, might modify packets, whereas current path validation techniques do not allow packet modification.We propose SERVNET, a path validation scheme which supports authenticated packet modification. SERVNET uses a cryptographic primitive called chameleon hash function which allows packet modification without changing its associated hash value. To the best of our knowledge, SERVNET is the first work on path validation that allows authenticated packet modification by designated nodes.

In public key infrastructures (PKIs), cryptographically protected responses are used to validate the status of certificates. The online certificate status protocol (OCSP) [1] is a scheme that was proposed for this purpose. However, OCSP is expensive primarily because it requires online trusted servers. Currently, there exists cheaper online validation schemes wherein validating clients download pre-computed responses from untrusted distribution servers. Examples of such schemes include NOVOMODO [3], certificate revocation tree (CRT) [4], authenticated dictionary (AD) [5] and the recently proposed augmented certificate revocation lists (ACRL) [6]. In this paper, we conduct a detailed performance analysis of these schemes with respect to their computational, network and storage costs and compare them against OCSP. Based on the system model that we adopt, our results show that all these schemes perform better than OCSP.

Providing effective certificate revocation status is an important yet burdensome aspect of PKI. It is widely assumed that certificate revocation lists (CRLs) cannot provide bandwidth-efficient online certificate status. Using our reference delta CRL scheme, we show that this assumption is not true. Clients using reference delta CRLs never download complete CRLs times they construct revocation lists locally. Our scheme performs significantly better than any earlier CRL scheme and has comparable bandwidth performance with respect to OCSP (Myers et al., 1999)

Personal electronic devices, with short-range wireless capability are becoming commonplace. Wireless enabled devices belonging to the same user (domain) need to be associated long-term to each other with as much ease as connections with physical wires. It should be obvious which two devices are being associated. Managing device associations must be simple, intuitive and communication between associated devices secure. This paper describes touch-mediated association protocols (TAP) which enable user-friendly, secure long-term device associations. TAP extends the resurrecting duckling security model. It uses an intuitive UI (the mediator), a physical device which taps devices that need to be associated. TAP does not require any PKI, uses computationally cheap cryptography and is easy to integrate.

Consumer electronic devices, many of which short-range wireless enabled are becoming common. Such wireless devices need to connect to devices with which they might have no prior contact. These connections need to be managed by users who don't have much computer administration knowledge, where elaborate graphical user interfaces are unlikely and passwords cumbersome. We explain touch mediated association protocols (TAP), based on the intuitive concept of tapping. A simple computational device, the mediator, taps devices facilitating device discovery and secure key distribution. TAP is based on computationally cheap cryptography, doesn't need GUI or broadcasts for device discovery.