Topics in Authentication Technology and Computer Security

该计划探讨涉及互联网身份验证的开放式安全问题，包括用户和网站的身份验证，安全软件安装和移动的设备的安全性;并旨在设计新的机制，提高互联网的安全性。第一个目标是解决安全套接字层机制（Web浏览器使用的Internet核心安全基础设施）及其底层证书颁发机构基础设施和信任模型中的已知安全问题和设计缺陷。我们探索安全问题的根本原因，并通过进化和革命性的方法（包括重新设计信任模型基础设施）设计和测试解决当前威胁的工具。第二个推力追求设计一个基本的方法和全面的框架，系统评估用户身份验证机制，广泛强调跨可用性，可部署性和安全标准;它的使用，以准确地识别需求匹配的身份验证机制与特定的应用程序环境;和设计和评估新的机制与可识别的优势。第三个重点是探索移动终端安全的认证方面--网站和用户认证，以及安全软件安装--包括设计和评估特别适合移动终端限制的新颖机制（例如，大小、输入方式）。为了避免与安装恶意应用软件的非专家用户相关的安全威胁，重新设计被探索，包括操作系统机制平衡安全性（软件隔离）和功能性（跨应用共享）。所探讨的问题是社会最重要的网络安全挑战之一，影响到从公民个人到企业和政府，再到技术提供商的所有互联网用户，解决方案提高了关键互联网基础设施的可信度。我们期望基础研究成果能够通过设计更好的身份验证和更安全、更有弹性的软件安装方法，为现实世界的互联网安全做出贡献;并通过协调利益相关者改善互联网基础设施，看到它们被部署在移动的设备和主要浏览器上。

The program explores open security problems involving Internet authentication, including authentication of users and websites, secure software installation, and security of mobile devices; and aims to design new mechanisms improving Internet security. A first thrust seeks to address known security issues and design flaws in the Secure Sockets Layer mechanism (the Internet's core security infrastructure used by web browsers), and its underlying certificate authority infrastructure and trust model. We explore root causes of security issues, and design and test tools addressing current threats through evolutionary and revolutionary approaches including redesign of trust model infrastructure. A second thrust pursues design of a foundational methodology and comprehensive framework for systematic evaluation of user authentication mechanisms, with broad emphasis across usability, deployability, and security criteria; its use to accurately identify requirements matching authentication mechanisms with specific application environments; and design and evaluation of new mechanisms with identifiable advantages. A third thrust explores authentication aspects of mobile device security--web site and user authentication, and secure software installation--including design and evaluation of novel mechanisms specifically suiting mobile device limitations (e.g., size, input modalities). To avoid security threats related to non-expert users installing malicious application software, redesign is explored including operating system mechanisms balancing security (software isolation) and functionality (cross-application sharing). The problems explored are among society's most important cyber-security challenges, impacting all Internet users from private citizens, to business and government, to technology providers, and solutions increase trustworthiness of critical Internet infrastructure. We expect fundamental research results that contribute to stronger real-world Internet security through the design of better authentication and more secure, resilient software installation methods; and to see them deployed, including on mobile devices and in major browsers, through coordinating stakeholders to improve the Internet infrastructure.