TWC: Small: Middleware for Certificate-Based Authentication

每当有人使用手机或电脑连接到互联网网站时，软件就会确定连接是否安全或被攻击者拦截。不幸的是，该软件容易出错，使用户容易受到网络钓鱼攻击、身份盗窃和未经授权的加密流量检查而侵犯其隐私或窃取其个人信息。提出了许多解决方案，但软件在许多平台上分散，并且冗余或不正确地实现。本研究的目标是开发一个信任平台，将决策过程整合到一个位置，为所有现有和未来的应用程序提供正确，一致和可用的服务。该平台旨在使研究人员更容易测试和部署用于检测可信互联网网站的替代方法。该研究强调可用性，使用户不会面临的错误消息，他们很难理解或采取行动。该项目设计和分析的中间件，巩固基于证书的身份验证在操作系统中。它是为Linux和Android设计的，并自动覆盖目前在许多现有应用程序中发现的破碎的决策过程。开发人员在构建应用程序时不再需要提供自己的证书验证功能。该平台支持各种证书身份验证插件，例如动态证书钉扎、众包公证服务和策展根存储。 策略配置使用户或组织能够定义如何组合来自多个插件的响应以做出最终的信任决策。可用性研究的重点是需要用户与系统交互的所有方面：安装系统、配置安全和隐私偏好、选择身份验证提供商以及接收可操作的通知和警告。这项研究有利于国家安全，解决了许多弱点，在目前的信任系统与新的认证服务。该项目通过提供一个开源平台来轻松扩展当前的信任系统，为安全社区做出了贡献。

Every time someone uses a phone or computer to connect to an Internet site, software determines whether the connection is safe or being intercepted by attackers. Unfortunately, this software is error-prone, leaving users vulnerable to having their privacy violated or their personal information stolen due to phishing attacks, identity theft, and unauthorized inspection of their encrypted traffic. A number of solutions are being proposed, but the software is fragmented across many platforms and redundantly or incorrectly implemented. The goal of this research is to develop a trust platform that consolidates the decision-making process into a single location to provide a correct, consistent, and usable service for all existing and future applications. The platform is designed to make it easier for researchers to test and deploy alternative methods for detecting trustworthy Internet sites. The research emphasizes usability, so that users are not faced with error messages that are difficult for them to understand or act on.The project designs and analyzes middleware that consolidates certificate-based authentication in the operating system. It is designed for both Linux and Android, and automatically overrides the broken decision-making process currently found in many existing applications. Developers are no longer required to provide their own certificate validation function when building applications. The platform supports a variety of plugins for certificate authentication, such as dynamic certificate pinning, crowd-sourced notary services, and a curated root store. Policy configuration enables users or organizations to define how responses from multiple plugins are combined to make a final trust decision. Usability studies are focused on all aspects that require user interaction with the system: installing the system, configuring security and privacy preferences, choosing authentication providers, and receiving actionable notifications and warnings. This research benefits national security by addressing numerous weaknesses in the current trust system with new authentication services. The project contributes to the security community by providing an open source platform for easily extending the current trust system.