Real time streaming data accounts for a growing proportion of Internet traffic. The demand for security is accordingly increasing, which poses severe burdens on the performance of terminal processing streaming data. In this paper, a high performance video encryption scheme (HPVES) is proposed to speed up cryptographic operations for streaming media data based on cryptographic USB key. In our scheme, the cryptographic key is stored and used in USB key, a dedicated hardware security module (HSM), which avoids the leakage of cryptographic key even when the terminal is compromised. We modify the cos (chip operating system) driver of USB key which is then called HPUK to accelerate data transmission between computer and its' peripherals. A flow control mechanism is also proposed to balance the throughput of keystream and media stream which could (1) make data encryption/decryption maintain at a constant throughput in regardless of the data size and (2) save storage space. We have implemented the proposed scheme and evaluated the performance on different devices. The evaluation demonstrates that HPUK almost doubles the throughput of original USB key on resource-constrained devices at small packet size (no more than 1.5 KB, which suits for real-time UDP transmission). Field experiments also show that HPVES could provide continuous and stable keystream with throughput of 4 MBps.

Data security has become a major concern in end-to-end communication of Internet of Things (IoT) devices. To establish an encrypted and trusted channel, certificate-based authentication is broadly adopted in many resource-constrained IoT environments, especially Elliptic Curve Qu-Vanstone (ECQV) implicit certificates, optimized for bandwidth and processing time compared to X.509 certificates. However, certificates in Public Key Infrastructure (PKI) inherently face the security problem that Certificate Authorities (CAs) with absolute trust might issue fraudulent certificates maliciously/unintentionally. To mitigate this problem, Certificate Transparency (CT) has been widely deployed, but it brings more transmission and validation overhead, posing new challenges for IoT devices. To inherit the advantage of implicit certificates and make CT more friendly to resource-restricted IoT systems, this paper proposes ImCT, the first feasible and efficient scheme for deploying ECQV implicit certificates with CT in IoT. It (1) offers an ingenious and compact design of certificate extension for integrating CT into implicit certificates, ensuring sufficiently small memory use and low validation cost; (2) provides a generic Bloom Filter-based solution to efficiently deploy ImCT in interactive protocols with compatibility with existing CT validation rules; (3) allows for incremental deployment and deploys to TLS 1.3 easily with only a few self-defined TLS extensions. The security of ImCT is also analyzed, and the performance evaluation shows its practicality and high efficiency.

Certificate Transparency (CT) enables timely detection of problematic certification authorities (CAs) by publicly recording all CA-issued certificates. This transparency inevitably leaks the privacy of identity owners (IdOs) through the identity information bound in certificates. In response to the privacy leakage, several privacy-preserving schemes have been proposed that transform/hash/encrypt the privacy-carrying part in certificates. However, these certificates conceal identity while also making it opaque to the IdO, which defeats the purpose of CT. To address the contradiction between transparency and privacy, we propose Semi-CT, a semi-transparency mechanism that makes the certificates transparent to IdOs but opaque to snoopers. Inspired by public-key encryption with keyword search (PEKS), Semi-CT based on bilinear pairing enables trapdoor-holding IdOs to retrieve certificates associated with their identity. Semi-CT also addresses protocol deviation detection and trapdoor protection in the malicious model. Finally, through theoretical and experimental analysis, we prove the security and feasibility of Semi-CT for practical applications.

The security, privacy, and trust are the critical concerns in Vehicular Ad Hoc Networks (VANETs). The Security Credential Management System (SCMS) is one of the most promising PKI-based solutions, which adopts linkage-based pseudonym certificates and has been standardized by IEEE. This paper aims to address the issues of certificate revocation in the SCMS architecture. We propose ESCORT, achieving: (i) a privacy-preserving revocation transparency for linkage-based pseudonym certificates, enhancing the reliability of the SCMS architecture; (ii) an efficient certificate status check for vehicles, eliminating complicated computations in checking CRLs. We analyze the security and feasibility of ESCORT, and experimental results indicate its superior efficiency.

Recently, a series of vulnerabilities occurred to divulge or forge single sign-on tickets, such as the famous SolarWinds incident Once malicious attackers obtain fraudulent tickets, they can pry into user privacy as well as compromise the system by impersonating the victim user. Inspired by certificate transparency, a ticket transparency (TT) framework for detecting fraudulent tickets is proposed. However, it suffers from inefficiency and potential failure. In this paper, we further propose an enhanced ticket transparency (eTT) scheme, which ensures that all fraudulent tickets can be detected efficiently through a novel dual-backup structure to store ticket entries in the public log. Meanwhile, we design specific calculations for pairwise pseudonymous identifiers (PPIDs), to support fraudulent-detection towards tickets in which user identifiers are pseudonyms. We implemented the prototype system, and the experimental evaluation shows that eTT framework introduces acceptable overheads in the sign-on process.

Terminal users can deploy verification tools to verify Windows code-signing signatures and check their details (signing time, certificate chain, etc). Some representative verification tools are also adopted in related studies, which take tools’ outputs as contributing factors to analyse malicious software or certificate ecosystems. However, as code-signing signature verification is related to multiple dimensions, such as certificate status and system policies, getting accurate signature status and details is essential but rather complicated. And performance of different tools in verifications has not been well studied and compared with.We provide a novel methodology to inspect Windows code-signing verification tools, checking that if they print consistent results and details. We choose four representative tools to verify massive samples (more than 26 million) and collect their outputs. During the verification, we deploy a two-step verification method, which efficiently excludes 78.8% of samples (not signed). We write scripts to read each line of outputs, learning tools’ output structures. Then we can precisely locate and extract interested code-signing fields from outputs. After that, we compare these essential fields from different tools, and analyze inconsistent cases. Finally, we present three types of inconsistent cases: verifying neglect, timestamp disturbance, and compatibility/robustness issues. We find some verification tools may assert code-signing signatures as invalid due to external factors, such as unexpected signing or invalid timestamp.

Numerous works have experimentally shown that Intel Software Guard eXtensions (SGX) is vulnerable to side-channel attacks (SCAs) and related threats, including transient execution attacks. These threats compromise the security of SGX-protected apps. Obfuscating data access patterns is a realistic way to guard against these threats. However, existing defenses impose either too much performance overhead or additional usage restrictions (such as multi-threading). Furthermore, these obfuscation schemes may no longer work if the attacker has the capacity to single-step the target application.

WPA2-Enterprise networks offer access to the Internet widely for multifarious client devices. Certificate-based authentication is adopted on the client-side to authenticate the server during network connection. Due to a lack of professional knowledge, client users commonly fully trust the devices, which may result in insecure network connection and user credential leakage. Previous works commonly focus on the security vulnerabilities due to the design weaknesses of the user interfaces from mainstream operating systems, while the built-in certificate validation implementations, which act as a block box for users to validate the received certificates, are not taken into consideration.In this paper, we design a series of comprehensive testings to evaluate the built-in certificate validation implementations of mainstream client devices for the first time. Moreover, we investigate the configuration options provided by the devices from different vendors, which may downgrade the security of the certificate validation. We select both Windows and Android (from vendors with the largest five market share) devices as our empirical study target. The results show that more than one security vulnerability exists in the built-in certificate validation implementations of the selected devices, and all the selected devices provide a certain option which may downgrade the security of certificate validation. We also conduct a real Evil Twin attack, which reveals that the user credentials can be cracked due to the discovered security vulnerabilities. Our findings have been responsibly disclosed to the relevant device vendors, and we received an assortment of responses, meanwhile many vendors (e.g., Huawei) have already positively acknowledged our findings.

Two-factor authentication (2FA) offers very important security enhancement to traditional username-password authentication, while in many cases incurring undesirable user burdens (e.g., entering a one-time verification code sent to a phone via SMS). Some zero-effort authentication techniques (e.g., Sound-Proof) have been proposed to relieve such burdens without degrading security, but are vulnerable to prediction attacks and co-existence attacks. This paper proposes ABLE, a zero-effort 2FA approach based on co-location detection leveraging environmental Bluetooth Low Energy (BLE) signal characteristics. In this approach, a laptop on which the user tries to authenticate to a web server, and the user’s smartphone placed nearby which is trusted by the server, both collect and send a record of environmental BLE signal characteristics to the server. The server decides whether the two devices are co-located by evaluating the similarity of the two records, and makes the authentication decision. ABLE is constructed based on the fact that only two devices in close proximity share similar environmental signal characteristics, which distinguishes a legitimate user device from potential adversaries. Due to its location-sensitive nature, combining favorable features brought with the BLE protocol, ABLE is gifted with good resistance to attacks that threaten existing zero-effort authentication schemes. ABLE is not only immune to remote attackers, but also achieves an accuracy over 90% even against co-present attackers.

Large-scale organizations usually deploy Wi-Fi to offer wireless network services for the target users, and password-based authentication is the most commonly adopted to identify Wi-Fi network users. However, multiple security issues occur in the password-based authentication schemes, such as using static passwords, unauthorized user access, and etc. To solve these problems, we propose a dynamic Wi-Fi password scheme updating passwords according to the location-based physical access controls, which is compatible with IEEE 802.11i protocols without introducing extra equipment or user efforts. We reuse the available location based resources in IEEE 802.11 to broadcast dynamic salt values for password updating and implement a prototype system. The experimental results illustrate that the introduced overhead is acceptable (i.e., the disconnection due to password update lasts less than 320ms).

Traditional X.509 public key infrastructures (PKIs) depend on trusted certification authorities (CAs) to sign certificates, used in SSL/TLS to authenticate web servers and establish secure channels. However, recent security incidents indicate that CAs may (be compromised to) sign fraudulent certificates. In this article, we propose blockchain-based certificate transparency (CT) and revocation transparency (RT) to balance the absolute authority of CAs. Our scheme is compatible with X.509 PKIs but significantly reinforces the security guarantees of a certificate. The CA-signed certificates and their revocation status information of an SSL/TLS web server are published by the subject (i.e., the web server) as a transaction in the global certificate blockchain. The certificate blockchain acts as append-only public logs to monitor CAs’ certificate signing and revocation operations, and an SSL/TLS web server is granted with the cooperative control on its certificates. A browser compares the certificate received in SSL/TLS negotiations with the ones in the public certificate blockchain, and accepts it only if it is published and not revoked. We implement the prototype system with Firefox and Nginx, and the experimental results show that it introduces reasonable overheads.

To detect fraudulent TLS server certificates and improve the accountability of certification authorities (CAs), certificate transparency (CT) is proposed to record certificates in publicly-visible logs, from which the monitors fetch all certificates and watch for suspicious ones. However, if the monitors, either domain owners themselves or third-party services, fail to return a complete set of certificates issued for a domain of interest, potentially fraudulent certificates may not be detected and then the CT framework becomes less reliable. This paper presents the first systematic study on CT monitors. We analyze the data in 88 public logs and the services of 5 active third-party monitors regarding 3,000,431 certificates of 6,000 selected Alexa Top-1M websites. We find that although CT allows ordinary domain owners to act as monitors, it is impractical for them to perform reliable processing by themselves, due to the rapidly increasing volume of certificates in public logs (e.g., on average about 5 million records or 28.29 GB daily for the minimal set of logs that need to be monitored in 2018, or more than 7 million records per day in 2020, according to the Chrome CT policy). Moreover, our study discloses that (${a}$) none of the third-party monitors guarantees to return the complete set of certificates for a domain, and (${b}$) for some domains, even the union of the certificates returned by the five third-party monitors can probably be incomplete. As a result, the certificates accepted by CT-enabled browsers are not actually visible to the claimed domain owners, even when CT is adopted with well-functioning logs. The risk of invisible fraudulent certificates in public logs raises doubts on the reliability of CT in practice.

ECQV implicit certificates are special public-key certificates, proposed for smaller size and faster verification. In resource-constrained environments such as Internet of Things (IoT), it’s common to replace X.509 certificates with ECQV implicit certificates for better efficiency. Google’s Certificate Transparency (CT) makes the certificate issuance be publicly-visible to everyone, to enhance the trustworthiness of Public Key Infrastructure (PKI). However, the conventional CT approach based on Signed Certificate Timestamp (SCT) will be a burden for ECQV certificate verifiers in resource-constrained environments. In this paper, we propose an efficient scheme, named ECQV Implicit Certificate Transparency (EICT), to integrate CT with implicit certificates following the same assumption and approach of ECQV implicit certificates. EICT obtains better performance than CT applied in traditional X.509 PKIs. We also conduct the security analysis and performance evaluation of the proposed scheme.

The video conference has been widely adopted for telecommuting due to the convenience, and various schemes are proposed to provide the confidentiality and integrity of the stream data. However, due to the limitation of the video terminals, the adversary can still obtain the cryptographic key by exploiting the vulnerabilities of OS or other binaries in the video terminals, or launching various attacks such as cold-boot attacks, DMA attacks and side channel attacks. Once the cryptographic key is leaked, the confidentiality and integrity of the stream data will be broken. In this paper, we propose a secure video conference system by customizing the cryptographic USB key (called CCUK) for efficient cryptographic computation and secure key storage. In our scheme, the cryptographic key is stored and used (i.e., key agreement and data encryption/decryption) in CCUK, a dedicated hardware security module (HSM), which avoids the leakage of cryptographic key even when the video terminal is compromised. Moreover, CCUK only has one requirement on the video terminal, i.e., having the USB interface, and therefore can be deployed in almost all types of video terminals. CCUK is cost-effective compared to other types of HSMs, and its efficiency avoids the stream data encryption/decryption to be the performance bottleneck. We have implemented the proposed scheme, and deployed it to provide the confidentiality and integrity for a practical video conference system. The evaluation demonstrates that CCUK can support 1080P HD video conference.

The wide spread of cloud computing and the rapid growth of online activities raise the demand for privacy enhancing cryptography, such as identity-based encryption (IBE), attribute-based encryption (ABE), and group/ring signature, which are mostly asymmetric. However, implementing a practical asymmetric cryptosystem with privacy enhancing functionalities faces the big challenge of large computing overhead that stems from the hard mathematical problems they are based on, which in reality hinders the further deployment of such cryptosystems.In this paper, we propose "SGX Cipher Box" (SCB), a method of constructing flexible and efficient asymmetric computations by encapsulating symmetric algorithms into Intel SGX enclaves. Two types of enclaves are designed for serving computations with the public key and the private key, respectively. The security assumptions of asymmetric algorithms can be achieved in SCB based on guarantees offered by SGX. SCB is of great flexibility that it facilitates implementing various asymmetric computations with limited enclaves. We present four SCB-based cryptosystems, provisioning asymmetric primitives, IBE, ABE, and ring signature, respectively. The four prototype cryptosystems are implemented and benchmarked in terms of computing efficiency. Experimental results show that SCB surpasses conventional asymmetric cryptosystem implementations in performance.

To validate a certificate, a user needs to install the certificate of the root certification authority (CA) and download the certificate revocation information (CRI). Although operating systems and browsers manage the certificate trust list (CTL) of publicly-trusted root CAs for global users, locally-trusted root CAs still play an important role and it is difficult for a user to manage its CTL properly by itself. Meanwhile, the CRI access is inefficient, sometimes even unavailable, and causes privacy leakage. We revisit these problems by analyzing the TLS sessions within an organization. To the best of our knowledge, we are the first to analyze CTL management and CRI access on the scale of medium-sized organizations. Based on the analysis, a locally-centralized design is proposed to manage the CTLs of all users by IT administrators and access the CRI services for all users, within an organization. We apply this design to desktop virtualization systems to demonstrate its applicability, and build vCertGuard with oVirt and KVM-QEMU. In vCertGuard, the CTLs of all virtual machines (VMs) are managed in the VM monitors (VMMs). In the CTL, the self-signed certificates of publicly-trusted root CAs are properly configured, while each locally-trusted certificate chain is specified one by one. vCertGuard accesses the CRI services for all VMs, and the downloaded CRI is cached and shared among VMs. Because most TLS servers are visited by multiple users of an organization, it reduces the cost of CRI access. Experimental results of the prototype system show that vCertGuard maintains the CTLs with a negligible overhead, and significantly improves the performance of CRI access.

FIDO2, the newest set of FIDO specifications, enables the user to leverage an external authenticator for the authentication in both mobile and desktop environments (referred to as user agent). For the secure registration and authentication, FIDO2 requires the external authenticator and user agent to establish a confidential and mutually authenticated data transport channel through either USB interfaces, Near Field Communication (NFC) or Bluetooth. However, the external authenticator and host may not be equipped with one of the above physical media simultaneously, for example, a desktop may only have USB interfaces while an external authenticator (e.g., a smartphone) may have no USB inferfaces. This affects the wide adoption of FIDO2. In this paper, we extend the registration and authentication processes of FIDO2 external authenticator with QR code, which enables the external authenticator being equipped with a camera to be used for the authentication at any user agent. During the registration process, our scheme requires the user to provide the original credential and a one-time password displayed on the authenticator, and therefore ensures the correct user will only be bound with the expected authenticator. The security of our scheme has been formally analyzed based on the Dolev-Yao style model, a widely adopted model for the analysis of web systems. We have implemented the prototype, and the performance evaluation demonstrated the efficiency of our scheme, which needs 373 ms for registration and 141 ms for authentication in our environment.

To detect fraudulent TLS server certificates and improve the accountability of certification authorities (CAs), certificate transparency (CT) is proposed to record certificates in publicly-visible logs, from which the monitors fetch all certificates and watch for suspicious ones. However, if the monitors, either domain owners themselves or third-party services, fail to return a complete set of certificates issued for a domain of interest, potentially fraudulent certificates may not be detected and then the CT framework becomes less reliable. This paper presents the first systematic study on CT monitors. We analyze the data in 88 public logs and the services of 5 active third-party monitors regarding 3,000,431 certificates of 6,000 selected Alexa Top-1M websites. We find that although CT allows ordinary domain owners to act as monitors, it is impractical for them to perform reliable processing by themselves, due to the rapidly increasing volume of certificates in public logs (e.g., on average 5 million records or 28.29 GB daily for the minimal set of logs that need to be monitored). Moreover, our study discloses that (a) none of the third-party monitors guarantees to return the complete set of certificates for a domain, and (b) for some domains, even the union of the certificates returned by the five third-party monitors can probably be incomplete. As a result, the certificates accepted by CT-enabled browsers are not absolutely visible to the claimed domain owners, even when CT is adopted with well-functioning logs. The risk of invisible fraudulent certificates in public logs raises doubts on the reliability of CT in practice.

HTTPS provides authentication, data confidentiality, and integrity for secure web applications in the Internet. In order to establish secure connections with the target website but not a man-in-the-middle or impersonation attacker, a browser shows security warnings to users, when different HTTPS errors happen (e.g., it fails to build a valid certificate chain, or the certificate subject does not match the domain visited). Each browser implements its own design of warnings on HTTPS errors, to balance security and usability. This paper presents a list of common HTTPS errors, and we investigate the browser behaviors on each error. Our study discloses browser defects on handling HTTPS errors in terms of cryptographic algorithm, certificate verification, name validation, HPKP, and HSTS.

In modern science and engineering practices, regression analysis is widely used to deal with large-scale and sensitive data, such as personal credit information. When executing such tasks, it is preferable for a resource-constrained client, like a mobile phone, to outsource part of its expensive computation. However, it is challenging to outsource the computation to an untrusted cloud server without leak of sensitive information. In this paper, we propose a fast ridge regression outsourcing scheme FaSORR with a series of disguise techniques. Our scheme is based on singular-value decomposition(SVD), which is non-iterative and highly efficient with light workload at the client side. Moreover, we update the perturbation method and offer more protection to the original data than previous works. Experiment results show that the computing load at the client side decreases dramatically after the adoption of FaSORR. We analyze the performance of our scheme and compare it with previous works.

Wearing smartwatches becomes increasingly popular in people’s lives. This paper shows that a smartwatch can help its bearer authenticate to a login system effectively and securely even if the bearer’s password has already been revealed. This idea is motivated by our observation that a sensor-rich smartwatch is capable of tracking the wrist motions of its bearer typing a password or PIN, which can be used as an authentication factor. The major challenge in this research is that a sophisticated attacker may imitate a user’s typing behavior as shown in previous research on keystroke dynamics based user authentication. We address this challenge by applying a set of machine learning and deep learning classifiers on the user’s wrist motion data that are collected from a smartwatch worn by the user when inputting his/her password or PIN. Our solution is user-friendly since it does not require users to perform any additional actions when typing passwords or PINs other than wearing smartwatches. We conduct a user study involving 51 participants so as to evaluate the feasibility and performance of our solution. User study results show that the best classifier is the Bagged Decision Trees, which yields 4.58% FRR and 0.12% FAR on a QWERTY keyboard, and 6.13% FRR and 0.16% FAR on a numeric keypad.

Public key infrastructures (PKIs) are proposed to provide various security services. Some security services such as confidentiality require key escrow in certain scenarios, whereas some others such as non‐repudiation and authentication usually prohibit key escrow. Moreover, these two conflicting requirements can coexist for one PKI user. The popular solution in which each user has two different certificates and an escrow authority backs up all escrowed private keys faces the problems of efficiency and scalability. In this study, a novel key management infrastructure called RIKE + is proposed to integrate the ‘inherent key escrow’ of identity‐based encryption (IBE) into PKIs. In RIKE+, (the hash value of) a user's PKI certificate also serves as a ‘revocable identity’ to derive the user's IBE public key, and the revocation of this IBE key pair is achieved by the certificate revocation of PKIs. Therefore the certificate binds the user with two key pairs, one of which is escrowed inherently and the other is not. Furthermore, RIKE+ employs chameleon hash to flexibly control the relationship between the certificate and the IBE key pair. In the case of certificate renewal and revocation, chameleon hash enables RIKE+ to manipulate the hash value of the new certificate, so the user's IBE key pair is not unconditionally changed unless it is necessary. RIKE+ is an effective certificate‐based solution compatible with traditional PKIs and can be built on existing X.509 PKIs.

ABSTRACT To tolerate servers' Byzantine failures, a distributed storage service of self‐verifying data needs to make three security properties be Byzantine fault tolerant (BFT): data consistency, data availability, and confidentiality of the signing service's private key. Building such systems demands the integration of Byzantine quorum systems (BQSs), which only make data consistency and availability be BFT, and threshold signature schemes (TSSs), which only make confidentiality of the private key be BFT. Two families ofvalidTSS‐BQS systems (of which the server protocols carry all the design options) have been proposed in the literature. Motivated by the failures in finding a third family of valid server protocols, we study the reverse problem and formally prove that it isimpossibleto find any third family of valid TSS‐BQS systems. To obtain this proof, we develop avalidity theoryon server protocols of TSS‐BQS systems. It is shown that the only two families of valid server protocols, “predicted” (or deduced) by the validity theory, precisely match the existing protocols. Copyright © 2012 John Wiley & Sons, Ltd.