Automatically detecting the misuse of secrets: foundations, design principles, and applications
We develop foundations and several constructions for security protocols that can automatically detect, without false positives, if a secret (such as a key or password) has been misused. Such constructions can be used, e.g., to automatically shut down compromised services, or to automatically revoke...
| Hoofdauteurs: | , , , |
|---|---|
| Formaat: | Conference item |
| Gepubliceerd in: |
IEEE
2017
|
| _version_ | 1826260900127965184 |
|---|---|
| author | Milner, K Cremers, C Yu, J Ryan, M |
| author_facet | Milner, K Cremers, C Yu, J Ryan, M |
| author_sort | Milner, K |
| collection | OXFORD |
| description | We develop foundations and several constructions for security protocols that can automatically detect, without false positives, if a secret (such as a key or password) has been misused. Such constructions can be used, e.g., to automatically shut down compromised services, or to automatically revoke misused secrets to minimize the effects of compromise. Our threat model includes malicious agents, (temporarily or permanently) compromised agents, and clones. Previous works have studied domain-specific partial solutions to this problem. For example, Google's Certificate Transparency aims to provide infrastructure to detect the misuse of a certificate authority's signing key, logs have been used for detecting endpoint compromise, and protocols have been proposed to detect cloned RFID/smart cards. Contrary to these existing approaches, for which the designs are interwoven with domain-specific considerations and which usually do not enable fully automatic response (i.e., they need human assessment), our approach shows where automatic action is possible. Our results unify, provide design rationales, and suggest improvements for the existing domain-specific solutions. Based on our analysis, we construct several mechanisms for the detection of misuse. Our mechanisms enable automatic response, such as revoking keys or shutting down services, thereby substantially limiting the impact of a compromise. In several case studies, we show how our mechanisms can be used to substantially increase the security guarantees of a wide range of systems, such as web logins, payment systems, or electronic door locks. For example, we propose and formally verify an improved version of Cloudflare's Keyless SSL protocol that enables key misuse detection. |
| first_indexed | 2024-03-06T19:13:04Z |
| format | Conference item |
| id | oxford-uuid:176b99c3-3da7-4f82-92b1-afef6b5a024d |
| institution | University of Oxford |
| last_indexed | 2024-03-06T19:13:04Z |
| publishDate | 2017 |
| publisher | IEEE |
| record_format | dspace |
| spelling | oxford-uuid:176b99c3-3da7-4f82-92b1-afef6b5a024d2022-03-26T10:37:11ZAutomatically detecting the misuse of secrets: foundations, design principles, and applicationsConference itemhttp://purl.org/coar/resource_type/c_5794uuid:176b99c3-3da7-4f82-92b1-afef6b5a024dSymplectic Elements at OxfordIEEE2017Milner, KCremers, CYu, JRyan, MWe develop foundations and several constructions for security protocols that can automatically detect, without false positives, if a secret (such as a key or password) has been misused. Such constructions can be used, e.g., to automatically shut down compromised services, or to automatically revoke misused secrets to minimize the effects of compromise. Our threat model includes malicious agents, (temporarily or permanently) compromised agents, and clones. Previous works have studied domain-specific partial solutions to this problem. For example, Google's Certificate Transparency aims to provide infrastructure to detect the misuse of a certificate authority's signing key, logs have been used for detecting endpoint compromise, and protocols have been proposed to detect cloned RFID/smart cards. Contrary to these existing approaches, for which the designs are interwoven with domain-specific considerations and which usually do not enable fully automatic response (i.e., they need human assessment), our approach shows where automatic action is possible. Our results unify, provide design rationales, and suggest improvements for the existing domain-specific solutions. Based on our analysis, we construct several mechanisms for the detection of misuse. Our mechanisms enable automatic response, such as revoking keys or shutting down services, thereby substantially limiting the impact of a compromise. In several case studies, we show how our mechanisms can be used to substantially increase the security guarantees of a wide range of systems, such as web logins, payment systems, or electronic door locks. For example, we propose and formally verify an improved version of Cloudflare's Keyless SSL protocol that enables key misuse detection. |
| spellingShingle | Milner, K Cremers, C Yu, J Ryan, M Automatically detecting the misuse of secrets: foundations, design principles, and applications |
| title | Automatically detecting the misuse of secrets: foundations, design principles, and applications |
| title_full | Automatically detecting the misuse of secrets: foundations, design principles, and applications |
| title_fullStr | Automatically detecting the misuse of secrets: foundations, design principles, and applications |
| title_full_unstemmed | Automatically detecting the misuse of secrets: foundations, design principles, and applications |
| title_short | Automatically detecting the misuse of secrets: foundations, design principles, and applications |
| title_sort | automatically detecting the misuse of secrets foundations design principles and applications |
| work_keys_str_mv | AT milnerk automaticallydetectingthemisuseofsecretsfoundationsdesignprinciplesandapplications AT cremersc automaticallydetectingthemisuseofsecretsfoundationsdesignprinciplesandapplications AT yuj automaticallydetectingthemisuseofsecretsfoundationsdesignprinciplesandapplications AT ryanm automaticallydetectingthemisuseofsecretsfoundationsdesignprinciplesandapplications |