TrustBase: An Architecture to Repair and Strengthen Certificate-based Authentication
TrustBase: An Architecture to Repair and Strengthen Certificate-based Authentication
复制标题
DOI：
--
复制
发表时间：
2016-10
期刊：
影响因子：
--
通讯作者：
Mark O'Neill;S. Heidbrink;Scott Ruoti;Jordan Whitehead;Dan Bunker;Luke Dickinson;Travis Hendershot;J. Reynolds;K. Seamons;D. Zappala
中科院分区：
文献类型：
--
作者：
Mark O'Neill;S. Heidbrink;Scott Ruoti;Jordan Whitehead;Dan Bunker;Luke Dickinson;Travis Hendershot;J. Reynolds;K. Seamons;D. Zappala
我们描述了 TrustBase，这是一种将基于证书的身份验证作为操作系统服务提供的体系结构。 TrustBase 为所有应用程序实施证书验证的最佳实践，并透明地使现有应用程序能够针对 CA 系统的故障得到加强。 TrustBase 系统允许简单部署身份验证系统，从而强化 CA 系统。例如，这使系统管理员能够要求对所有 TLS 连接进行证书吊销检查，或者要求对支持它的电子邮件服务器进行 STARTTLS。 TrustBase 是第一个能够使用与所有操作系统兼容的方法来保护所有 TLS 流量的系统。我们设计并评估了 Linux 上 TrustBase 的原型实现，评估其安全性，并证明其开销可以忽略不计，并且与应用程序具有通用兼容性。为了演示 TrustBase 的实用性，我们开发了六种身份验证服务，以加强所有应用程序的证书验证。
We describe TrustBase, an architecture that provides certificate-based authentication as an operating system service. TrustBase enforces best practices for certificate validation for all applications and transparently enables existing applications to be strengthened against failures of the CA system. The TrustBase system allows simple deployment of authentication systems that harden the CA system. This enables system administrators, for example, to require certificate revocation checks on all TLS connections, or require STARTTLS for email servers that support it. TrustBase is the first system that is able to secure all TLS traffic, using an approach compatible with all operating systems. We design and evaluate a prototype implementation of TrustBase on Linux, evaluate its security, and demonstrate that it has negligible overhead and universal compatibility with applications. To demonstrate the utility of TrustBase, we have developed six authentication services that strengthen certificate validation for all applications.