论文标题
TLS短暂的前瞻性授权
Short-Lived Forward-Secure Delegation for TLS
论文作者
论文摘要
在当今的互联网上，将TLS的端到端安全性与内容交付网络（CDN）相结合，同时确保连接的真实性会导致挑战性的委派问题。当CDN服务器提供内容时，他们必须将自己作为原点服务器进行身份验证，以与客户端建立有效的端到端TLS连接。在标准TLS中，后者需要访问服务器的秘密密钥。为了解决这个问题，存在多个解决方法以实现身份验证的授权。 在本文中，我们提出了一种解决方案，该解决方案使密钥共享不必要，并减少了对解决方法的需求。通过将基于身份的签名调整到此设置中，我们的解决方案提供了短暂的代表团。此外，通过启用远期安全，即使服务器的秘密密钥泄漏，现有的代表团也仍然有效。我们提供该计划的实施，并讨论集成到TLS堆栈中。在我们的评估中，我们表明，有效的实施与典型的网络往返相比，开销少。因此，我们提出了一种替代方法，用于网络上当前的授权实践。
On today's Internet, combining the end-to-end security of TLS with Content Delivery Networks (CDNs) while ensuring the authenticity of connections results in a challenging delegation problem. When CDN servers provide content, they have to authenticate themselves as the origin server to establish a valid end-to-end TLS connection with the client. In standard TLS, the latter requires access to the secret key of the server. To curb this problem, multiple workarounds exist to realize a delegation of the authentication. In this paper, we present a solution that renders key sharing unnecessary and reduces the need for workarounds. By adapting identity-based signatures to this setting, our solution offers short-lived delegations. Additionally, by enabling forward-security, existing delegations remain valid even if the server's secret key leaks. We provide an implementation of the scheme and discuss integration into a TLS stack. In our evaluation, we show that an efficient implementation incurs less overhead than a typical network round trip. Thereby, we propose an alternative approach to current delegation practices on the web.
