Changzheng Wei
Haibing Guan
ABSTRACT
Protecting the customer's SSL private key is the paramount issue to persuade the website owners to migrate their contents onto the cloud infrastructure, besides the advantages of cloud infrastructure in terms of flexibility, efficiency, scalability and elasticity. The emerging Keyless SSL solution retains on-premise custody of customers' SSL private keys on their own servers. However, it suffers from significant performance degradation and limited scalability, caused by the long distance connection to Key Server for each new coming end-user request. The performance improvements using persistent session and key caching onto cloud will degrade the key invulnerability and discourage the website owners because of the cloud's security bugs.
In this paper, the challenges of secured key protection and distribution are addressed in philosophy of "Storing the trusted DATA on untrusted platform and transmitting through untrusted channel". To this end, a three-phase hierarchical key management scheme, called STYX1 is proposed to provide the secured key protection together with hardware assisted service acceleration for cloud-based content delivery network (CCDN) applications. The STYX is implemented based on Intel Software Guard Extensions (SGX), Intel QuickAssist Technology (QAT) and SIGMA (SIGn-and-MAc) protocol. STYX can provide the tight key security guarantee by SGX based key distribution with a light overhead, and it can further significantly enhance the system performance with QAT based acceleration. The comprehensive evaluations show that the STYX not only guarantees the absolute security but also outperforms the direct HTTPS server deployed CDN without QAT by up to 5x throughput with significant latency reduction at the same time.
- Intel corp., intel quickassist technology. https://01.org/packet-processing/intelGoogle Scholar
- Intel corp., intel software guard extensions: Intel attestation service api. https://software.intel.com/sites/default/files/managed/3d/c8/IAS_1_0_API_spec_1_1_Final.pdf.Google Scholar
- Intel corp., intel software guard extensions (intel sgx). https://software.intel.com/en-us/sgx.Google Scholar
- Intel corp, intelÂő xeonÂő processor e5-2600 v2 product family and intelÂő communications chipset 89xx series,. https://wwwssl.intel.com/content/www/us/en/intelligent-systems/highland-forest/xeon-e5-2600-v2-large-scale-communications-brief.html.Google Scholar
- Amazon. Amazon cloudfront âĂŞ content delivery network (cdn). https://aws.amazon.com/cloudfront/.Google Scholar
- Armin, J., Foti, P., and Cremonini, M. 0-day vulnerabilities and cybercrime. In Availability, Reliability and Security (ARES), 2015 10th International Conference on (2015), IEEE, pp. 711--718.Google ScholarDigital Library
- Baumann, A., Peinado, M., and Hunt, G. Shielding applications from an untrusted cloud with haven. ACM Transactions on Computer Systems (TOCS) 33, 3 (2015), 8.Google ScholarDigital Library
- Blog, V. C. Analysis of "average session duration" in google analytics. https://www.visma.com/blog/analysis-reporting-average-session-duration-google-analytics/.Google Scholar
- Bresson, E., Chevassut, O., Pointcheval, D., and Quisquater, J.-J. Provably authenticated group diffie-hellman key exchange. In Proceedings of the 8th ACM conference on Computer and Communications Security (2001), ACM, pp. 255--264. Google ScholarDigital Library
- Brickell, E., and Li, J. Enhanced privacy id: A direct anonymous attestation scheme with enhanced revocation capabilities. In Proceedings of the 2007 ACM Workshop on Privacy in Electronic Society (New York, NY, USA, 2007), WPES '07, ACM, pp. 21--30. Google ScholarDigital Library
- Brickell, E., and Li, J. Enhanced privacy id from bilinear pairing. Cryptology ePrint Archive, Report 2009/095, 2009.Google Scholar
- Brickell, E., and Li, J. Enhanced privacy id from bilinear pairing for hardware authentication and attestation. International Journal of Information Privacy, Security and Integrity 2 1, 1 (2011), 3--33.Google Scholar
- Brickell, E., and Li, J. Enhanced privacy id: A direct anonymous attestation scheme with enhanced revocation capabilities. IEEE Transactions on Dependable and Secure Computing 9, 3 (May 2012), 345--360. Google ScholarDigital Library
- Brown, R. Sec 1: elliptic curve cryptography. standards for efficient cryptography group (secg), 2016.Google Scholar
- Cangialosi, F., Chung, T., Choffnes, D., Levin, D., Maggs, B. M., Mislove, A., and Wilson, C. Measurement and analysis of private key sharing in the https ecosystem. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (2016), ACM, pp. 628--640. Google ScholarDigital Library
- Chandramouli, R., Iorga, M., and Chokhani, S. Cryptographic Key Management Issues and Challenges in Cloud Services. Springer New York, New York, NY, 2014, pp. 1--30.Google Scholar
- Choon, J. C., and Cheon, J. H. An identity-based signature from gap diffie-hellman groups. In International Workshop on Public Key Cryptography (2003), Springer, pp. 18--30. Google ScholarCross Ref
- Cloudflare. How will keyless ssl affect performance? https://support.cloudflare.com/hc/en-us/articles/203243090-How-will-Keyless-SSL-affect-performance-.Google Scholar
- Cloudflare. Keyless ssl: The nitty gritty technical details. https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/.Google Scholar
- Coppolino, L., DâĂŹAntonio, S., Mazzeo, G., and Romano, L. Cloud security: Emerging threats and current solutions. Computers & Electrical Engineering (2016).Google Scholar
- Costan, V., and Devadas, S. Intel sgx explained. Tech. rep., Cryptology ePrint Archive, Report 2016/086, 2016. https://eprint.iacr.org/2016/086.Google Scholar
- Cramer, R., and Shoup, V. Signature schemes based on the strong rsa assumption. ACM Transactions on Information and System Security (TISSEC) 3, 3 (2000), 161--185. Google ScholarDigital Library
- Durumeric, Z., Kasten, J., Adrian, D., Halderman, J. A., Bailey, M., Li, F., Weaver, N., Amann, J., Beekman, J., Payer, M., et al. The matter of heartbleed. In Proceedings of the 2014 Conference on Internet Measurement Conference (2014), ACM, pp. 475--488. Google ScholarDigital Library
- Fan, C. I., Wu, C. N., Hsu, J. C., Tseng, Y. F., and Chen, W. T. Anonymous credential scheme supporting active revocation. In 2014 Ninth Asia Joint Conference on Information Security (Sept 2014), pp. 127--132. Google ScholarCross Ref
- Google. https://support.google.com/analytics/answer/1006253?hl=en.Google Scholar
- Google. Google cloud cdn documentation. https://cloud.google.com/cdn/docs/.Google Scholar
- Grossklags, J., Christin, N., and Chuang, J. Secure or insure?: a game-theoretic analysis of information security games. In Proceedings of the 17th international conference on World Wide Web (2008), ACM, pp. 209--218. Google ScholarDigital Library
- Hankerson, D., Menezes, A. J., and Vanstone, S. Guide to elliptic curve cryptography. Springer Science & Business Media, 2006.Google ScholarDigital Library
- Hofmann, O. S., Kim, S., Dunn, A. M., Lee, M. Z., and Witchel, E. Inktag: Secure applications on an untrusted operating system. SIGPLAN Not. 48, 4 (Mar. 2013), 265--278. Google ScholarDigital Library
- Intel. Corp., intel system studio 2017. https://software.intel.com/en-us/intel-system-studio.Google Scholar
- Intel. Corp., intel vtuneâĎć amplifier 2017. https://software.intel.com/en-us/intel-vtune-amplifier-xe.Google Scholar
- Jin, G., Song, L., Zhang, W., Lu, S., and Liblit, B. Automated atomicity-violation fixing. In ACM SIGPLAN Notices (2011), vol. 46, ACM, pp. 389--400. Google ScholarDigital Library
- Johnson, S., Scarlata, V., Rozas, C., Brickell, E., and Mckeen, F. Intel software guard extensions: Epid provisioning and attestation services. White Paper (2016).Google Scholar
- Joux, A. A one round protocol for tripartite diffie-hellman. In International Algorithmic Number Theory Symposium (2000), Springer, pp. 385--393. Google ScholarCross Ref
- Kaliski, B. Public-key cryptography standards (pkcs)# 8: Private-key information syntax specification version 1.2. RFC 5208, IETF (2008).Google Scholar
- Kim, S., Shin, Y., Ha, J., Kim, T., and Han, D. A first step towards leveraging commodity trusted execution environments for network applications. In Proceedings of the 14th ACM Workshop on Hot Topics in Networks (2015), ACM, p. 7. Google ScholarDigital Library
- Krawczyk, H. Sigma: The 'sign-and-mac' approach to authenticated diffie-hellman and its use in the ike protocols. In Annual International Cryptology Conference (2003), Springer, pp. 400--425. Google ScholarCross Ref
- Liang, J., Jiang, J., Duan, H., Li, K., Wan, T., and Wu, J. When https meets cdn: A case of authentication in delegated service. In 2014 IEEE Symposium on Security and Privacy (May 2014), pp. 67--82. Google ScholarDigital Library
- Litton, J., Vahldiek-Oberwagner, A., Elnikety, E., Garg, D., Bhattacharjee, B., and Druschel, P. Light-weight contexts: An os abstraction for safety and performance. In Proceedings of the 12th USENIX Conference on Operating Systems Design and Implementation (Berkeley, CA, USA, 2016), OSDI'16, USENIX Association, pp. 49--64.Google Scholar
- Miller, V. S. Use of elliptic curves in cryptography. In Conference on the Theory and Application of Cryptographic Techniques (1985), Springer, pp. 417--426.Google ScholarDigital Library
- Mutton, P. Half a million widely trusted websites vulnerable to heartbleed bug, 2014.Google Scholar
- Nikiforakis, N., Meert, W., Younan, Y., Johns, M., and Joosen, W. Session-shield: Lightweight protection against session hijacking. In International Symposium on Engineering Secure Software and Systems (2011), Springer, pp. 87--100. Google ScholarCross Ref
- Noubir, G., and Sanatinia, A. Trusted code execution on untrusted platform using intel sgx. Virus Bulletin (2016).Google Scholar
- Odelu, V., Das, A. K., and Goswami, A. A secure biometrics-based multi-server authentication protocol using smart cards. IEEE Transactions on Information Forensics and Security 10, 9 (Sept 2015), 1953--1966. Google ScholarDigital Library
- OpenSSL. https://www.openssl.org/.Google Scholar
- Reese, W. Nginx: the high-performance web server and reverse proxy. Linux Journal 2008, 173 (2008), 2.Google Scholar
- Rescorla, E. Security holes... who cares? In USENIX Security (2003), Washington, DC.Google Scholar
- Rsa, A., and Note, L. T. Pkcs#8: Private-key information syntax standard, 1993.Google Scholar
- Sanatinia, A., and Noubir, G. Honey onions: a framework for characterizing and identifying misbehaving tor hsdirs. arXiv preprint arXiv:1610.06140 (2016).Google Scholar
- Schuster, F., Costa, M., Fournet, C., Gkantsidis, C., Peinado, M., Mainar-Ruiz, G., and Russinovich, M. Vc3: Trustworthy data analytics in the cloud using sgx. In Security and Privacy (SP), 2015 IEEE Symposium on (2015), IEEE, pp. 38--54.Google ScholarDigital Library
- Sidiroglou, S., Laadan, O., Perez, C., Viennot, N., Nieh, J., and Keromytis, A. D. Assure: automatic software self-healing using rescue points. ACM SIGARCH Computer Architecture News 37, 1 (2009), 37--48. Google ScholarDigital Library
- Sinha, R., Rajamani, S., Seshia, S., and Vaswani, K. Moat: Verifying confidentiality of enclave programs. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (2015), ACM, pp. 1169--1184. Google ScholarDigital Library
- Stebila, D., and Sullivan, N. An analysis of tls handshake proxying. In 2015 IEEE Trustcom/BigDataSE/ISPA (Aug 2015), vol. 1, pp. 279--286.Google ScholarDigital Library
- Steiner, M., Tsudik, G., and Waidner, M. Diffie-hellman key distribution extended to group communication. In Proceedings of the 3rd ACM conference on Computer and communications security (1996), ACM, pp. 31--37. Google ScholarDigital Library
- Wang, Y. Public key cryptography standards: Pkcs. arXiv preprint arXiv:1207.5446 (2012).Google Scholar
- Wikipedia. Content delivery network. https://en.wikipedia.org/wiki/Content_delivery_network.Google Scholar
- Wikipedia. Fiber. https://en.wikipedia.org/wiki/Fiber_(computer_science)#cite_note-flounder-1.Google Scholar
- Wu, C.-H., Hong, J.-H., and Wu, C.-W. Rsa cryptosystem design based on the chinese remainder theorem. In Proceedings of the 2001 Asia and South Pacific Design Automation Conference (New York, NY, USA, 2001), ASP-DAC '01, ACM, pp. 391--395. Google ScholarDigital Library
- Xie, W., and Wang, J. A trusted connection based scheme for ad hoc network. In PROCEEDINGS OF 2013 International Conference on Sensor Network Security Technology and Privacy Communication System (May 2013), pp. 34--38.Google Scholar
- Zhang, F., and Zhang, H. Sok: A study of using hardware-assisted isolated execution environments for security. In Proceedings of the Hardware and Architectural Support for Security and Privacy 2016 (2016), ACM, p. 3. Google ScholarDigital Library
- Zhang, L., Choffnes, D., Levin, D., Dumitras, T., Mislove, A., Schulman, A., and Wilson, C. Analysis of ssl certificate reissues and revocations in the wake of heartbleed. In Proceedings of the 2014 Conference on Internet Measurement Conference (New York, NY, USA, 2014), IMC '14, ACM, pp. 489--502. Google ScholarDigital Library
- Zhao, M., Zhou, W., Gurney, A. J., Haeberlen, A., Sherr, M., and Loo, B. T. Private and verifiable interdomain routing decisions. In Proceedings of the ACM SIGCOMM 2012 conference on Applications, technologies, architectures, and protocols for computer communication (2012), ACM, pp. 383--394. Google ScholarDigital Library
- Zhao, M., Zhou, W., Gurney, A. J., Haeberlen, A., Sherr, M., and Loo, B. T. Private and verifiable interdomain routing decisions. IEEE/ACM Transactions on Networking 24, 2 (2016), 1011--1024. Google ScholarDigital Library
Index Terms
- STYX: a trusted and accelerated hierarchical SSL key management and distribution system for cloud based CDN application
Recommendations
Performance Analysis of Cloud Computing Services for Many-Tasks Scientific Computing
Cloud computing is an emerging commercial infrastructure paradigm that promises to eliminate the need for maintaining expensive computing facilities by companies and institutes alike. Through the use of virtualization and resource time sharing, clouds ...
Deployment Strategies for Distributed Applications on Cloud Computing Infrastructures
CLOUDCOM '13: Proceedings of the 2013 IEEE International Conference on Cloud Computing Technology and Science - Volume 02Cloud computing enables on-demand access to a shared pool of IT resources. In the case of Infrastructure as a Service (IaaS), the cloud user typically acquires Virtual Machines (VMs) from the provider. It is up to the user to decide at what time and for ...
Generalized Nash Equilibria for the Service Provisioning Problem in Cloud Systems
In recent years, the evolution and the widespread adoption of virtualization, service-oriented architectures, autonomic, and utility computing have converged letting a new paradigm to emerge: cloud computing. Clouds allow the on-demand delivering of ...
Comments