Practical authentication in large-scale internet applications

Network security;Web security;VoIP security;Session hijacking;Man-in-the-middle attacks

Dacosta, Italo ; Computing

University:Georgia Institute of Technology

Department:Computing

关键词: Network security;    Web security;    VoIP security;    Session hijacking;    Man-in-the-middle attacks;   

Others  :  https://smartech.gatech.edu/bitstream/1853/44863/1/dacosta_italo_i_201208_phd.pdf

美国|英语

来源: SMARTech Repository

【 摘 要 】

Due to their massive user base and request load, large-scale Internet applications have mainly focused on goals such as performance and scalability. As a result, many of these applications rely on weaker but more efficient and simpler authentication mechanisms. However, as recent incidents have demonstrated, powerful adversaries are exploiting the weaknesses in such mechanisms. While more robust authentication mechanisms exist, most of them fail to address the scale and security needs of these large-scale systems. In this dissertation we demonstrate that by taking into account the specific requirements and threat model of large-scale Internet applications, we can design authentication protocols for such applications that are not only more robust but also have low impact on performance, scalability and existing infrastructure. In particular, we show that there is no inherent conflict between stronger authentication and other system goals. For this purpose, we have designed, implemented and experimentally evaluated three robust authentication protocols: Proxychain, for SIP-based VoIP authentication; One-Time Cookies (OTC), for Web session authentication; and Direct Validation of SSL/TLS Certificates (DVCert), for server-side SSL/TLS authentication. These protocols not only offer better security guarantees, but they also have low performance overheads and do not require additional infrastructure. In so doing, we provide robust and practical authentication mechanisms that can improve the overall security of large-scale VoIP and Web applications.