权益分类	功能权益	普通用户	{{item.name}}会员
{{category.name}}	{{benefitItem.name}}

Analysis of Certificate Transparency using Probabilistic Verification

使用概率验证分析证书透明度

基本信息

批准号：
1832982
负责人：
金额：
--
依托单位：
University of Birmingham
依托单位国家：
英国
项目类别：
Studentship
财政年份：
2016
资助国家：
英国
起止时间：
2016 至无数据
项目状态：
已结题

来源：
https://gtr.ukri.org/projects?ref=studentship-1832982
关键词：
Analysis Certificate Transparency using Probabilistic

项目摘要

Public key certificates are vital for internet security as they help users know which websites have been properly authenticated. However, there have been reports of certificates being issued incorrectly by supposedly trusted third parties. This led to them being exploited in man-in-the-middle attacks with devastating results. To improve the auditing of issued certificates, one idea proposed is to have them be submitted to a public, append-only log that anybody can view. This is part of an open framework called certificate transparency. However, a problem with this system is that a subset of users can be made to exclusively contact a `fake' log that contains fraudulent certificates. To prevent this, clients across the network could be made to gossip with each other and verify if they are seeing the same version of the log. Researchers such as Chuat et al have designed gossip protocols which disseminate information whenever misbehaviour from the log is noticed. At present it is not known how effective these protocols are in detecting attacks. For this research project, we would like to apply probabilistic model checking to analyse how these protocols behave and look for potential weaknesses. We also seek to propose any recommendations to improve the performance and detectability of these protocols. Finally, we will apply our methods to other systems that use gossip protocols to help users verify consistency for other transparency logs.

公钥证书对于互联网安全至关重要，因为它们可以帮助用户了解哪些网站已经正确验证。然而，有报告说，证书是由所谓的可信第三方错误地颁发的。这导致他们在中间人攻击中被利用，造成毁灭性的后果。为了改进对已颁发证书的审计，一个建议是将它们提交给一个任何人都可以查看的公共的、只允许添加的日志。这是一个叫做证书透明性的开放框架的一部分。然而，该系统的一个问题是，可以使一部分用户专门联系包含欺诈性证书的“假”日志。为了防止这种情况，可以让网络上的客户端相互八卦，并验证它们是否看到相同版本的日志。Chuat等研究人员设计了八卦协议，只要日志中的不当行为被注意到，就可以传播信息。目前还不知道这些协议在检测攻击方面有多有效。对于这个研究项目，我们希望应用概率模型检查来分析这些协议的行为并寻找潜在的弱点。我们还试图提出任何建议，以提高这些协议的性能和可检测性。最后，我们将把我们的方法应用到其他使用gossip协议的系统中，以帮助用户验证其他透明日志的一致性。