TWC: Small: Middleware for Certificate-Based Authentication

每当有人用手机或电脑连接到一个网站时，软件就会判断这个连接是否安全，是否被攻击者拦截。不幸的是，该软件容易出错，使用户容易因网络钓鱼攻击、身份盗窃和未经授权的加密流量检查而受到隐私侵犯或个人信息被盗。人们提出了许多解决方案，但软件在许多平台上都是碎片化的，并且冗余或不正确地实现。本研究的目标是开发一个信任平台，将决策过程整合到一个位置，为所有现有和未来的应用程序提供正确、一致和可用的服务。该平台旨在使研究人员更容易测试和部署替代方法来检测值得信赖的互联网站点。研究强调可用性，这样用户就不会面临难以理解或难以采取行动的错误消息。该项目设计并分析了在操作系统中整合基于证书的身份验证的中间件。它是为Linux和Android设计的，并自动覆盖目前在许多现有应用程序中发现的错误决策过程。开发人员在构建应用程序时不再需要提供自己的证书验证功能。该平台支持各种证书认证插件，如动态证书固定、众包公证服务和管理根存储。策略配置使用户或组织能够定义如何组合来自多个插件的响应以做出最终的信任决策。可用性研究集中在需要用户与系统交互的所有方面：安装系统、配置安全和隐私偏好、选择身份验证提供者以及接收可操作的通知和警告。本研究通过使用新的认证服务解决当前信任系统中的许多弱点，从而有利于国家安全。该项目通过提供一个开源平台来轻松扩展当前的信任系统，从而为安全社区做出了贡献。

Every time someone uses a phone or computer to connect to an Internet site, software determines whether the connection is safe or being intercepted by attackers. Unfortunately, this software is error-prone, leaving users vulnerable to having their privacy violated or their personal information stolen due to phishing attacks, identity theft, and unauthorized inspection of their encrypted traffic. A number of solutions are being proposed, but the software is fragmented across many platforms and redundantly or incorrectly implemented. The goal of this research is to develop a trust platform that consolidates the decision-making process into a single location to provide a correct, consistent, and usable service for all existing and future applications. The platform is designed to make it easier for researchers to test and deploy alternative methods for detecting trustworthy Internet sites. The research emphasizes usability, so that users are not faced with error messages that are difficult for them to understand or act on.The project designs and analyzes middleware that consolidates certificate-based authentication in the operating system. It is designed for both Linux and Android, and automatically overrides the broken decision-making process currently found in many existing applications. Developers are no longer required to provide their own certificate validation function when building applications. The platform supports a variety of plugins for certificate authentication, such as dynamic certificate pinning, crowd-sourced notary services, and a curated root store. Policy configuration enables users or organizations to define how responses from multiple plugins are combined to make a final trust decision. Usability studies are focused on all aspects that require user interaction with the system: installing the system, configuring security and privacy preferences, choosing authentication providers, and receiving actionable notifications and warnings. This research benefits national security by addressing numerous weaknesses in the current trust system with new authentication services. The project contributes to the security community by providing an open source platform for easily extending the current trust system.