Secure channel establishment in disadvantaged networks : Optimizing TLS using intercepting proxies

In-network middleboxes are vital for the Internet-of-Things (IoT) system security, but the widely adopted transport layer security (TLS) protocol blinds application-level middleboxes due to the encryption of traffic data. To resolve this problem, many solutions have been proposed to date. Among them, SplitTLS is widely adopted in the industry by proxy manufacturers. It requires TLS client to install customized root certificates and incurs additional security flaws, e.g., disabling server authentication and using weak cipher suites. Another approach is to customize the TLS protocol where middleboxes are enabled via either performing handshake directly with TLS endpoints or receiving session key materials in an out-of-band manner. Overall, current solutions would either jeopardize the original TLS handshake procedure or incur additional overheads on the endpoints. In this article, we design a new middlebox-enhanced TLS (ME-TLS), which enables endpoints to introduce authenticated middleboxes into a TLS session while control middleboxes' access permission and processing order of traffic data. Particularly, in our proposed ME-TLS, the handshake structure of TLS keeps unchanged and middleboxes work in a passive manner. That is, middleboxes in the ME-TLS could recover session key materials by monitoring handshake messages passively instead of interacting with endpoints; secondary secure channels for key transmission are also not needed in our ME-TLS. We implement our ME-TLS based on the TLS 1.3 protocol and evaluate its performances. The experimental results demonstrate that our proposal is practical and deployable for real-world IoT scenarios.

The unprecedented increase in web-based services and digital systems has prompted the dire need for secure information transmission all over the global networks. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols form the basis of web communication that will provide confidentiality, authenticity, and integrity of data communication between different systems. In this work, we have critically compared and contrasted Transport Layer Security (TLS) and Secure Socket Layer (SSL), considering their design architectures, cryptographic mechanisms, and operational performance in modern applications. We took advantage of recent literature, global best practices, and international standards such as IETF RFC 8446 (TLS 1.3) and NIST SP 800-52 Rev.2 to evaluate security capability, vulnerabilities, and the strategies for migrations. TLS 1.3 is now the basic standard due to its enhanced efficiency, lower latency of handshake, and better encryption through AEAD (Authenticated Encryption with Associated Data) algorithms; however, compatibility with legacy systems and inconsistencies in configuration pose serious challenges. We concluded by recommending the best practices for developers, system architects, and cybersecurity professionals to build robust, standards-compliant web applications

Transport Layer Security (TLS) is a widely used protocol for secure channel establishment. However, TLS lacks any inherent mechanism for validating the security state of the endpoint software and its platform. To overcome this limitation, recent works have combined remote attestation (RA) and TLS, named attested TLS. The most popular attested TLS protocol for confidential computing is Intel’s RA-TLS, which is used in multiple industrial projects. However, Intel has neither specified the protocol nor the desired properties. Moreover, despite its wide usage in security-critical use cases, there is no formal reasoning for the security of attested TLS for confidential computing in general and RA-TLS in particular. Using the state-of-the-art symbolic security analysis tool ProVerif, we formalized and found vulnerabilities in RA-TLS from both RA and TLS perspectives. We also propose mitigations for the vulnerabilities. During the formalization process, we found that despite several formal verification efforts for TLS to ensure its security, the validation of corresponding formal models has been largely overlooked. We demonstrate that a simple validation framework could discover crucial issues in state-of-the-art formalization of TLS 1.3 key schedule in ProVerif. Particularly, we found that 11 out of 14 keys in that formalization deviate from the corresponding TLS specifications. These issues have been acknowledged and fixed by the authors. Finally, we provide recommendations for protocol designers and the formal verification community based on the lessons learned in the formal verification and validation.

This paper presents the results of work by the author on application and comparative performance of IP Security (IPSec) and Secure Socket Layer (SSL) protocols in a Microsoft .NET 3-tier client-server network. To evaluate the performance of each security protocol, the author created a typical 3-tier client-server e-commerce model in which data communication passed through three distinct pathways: (1) channel between client and Web server over Internet, (2) channel between the Web server and application server, (3) channel between the application server and database server. The primary focus in this paper remains on the third channel where IPSec and SSL were used to connect the application server to the database server. A preliminary analysis of the collected data sheds light on performance of IPSec and SSL in Microsoft .NET environment. It also suggests that in pathways where SSL and IPSec could be used interchangeably, the selection of the most suitable security protocol ought to be dynamic.

The Secure Sockets Layer (SSL) protocol and its standards-track successor, the Transport Layer Security (TLS) protocol, were developed more than a decade ago and have generally withstood scrutiny in that the protocols themselves haven't been found to have security flaws. Marsh Ray and Steve Dispensa discovered a design flaw in the TLS protocol that affects all versions of the protocol up to and including the current version.Whereas the vulnerability itself is serious, it need not affect many deployments once administrators apply suitable patches to disable renegotiation, leaving TLS sufficiently secure in most cases because exploiting the vulnerability requires the attacker to be an active man-in-themiddle, redirecting traffic between victims (for example, a browser and a Web server). However, because security problems only ever get worse, a change to the protocol is required. The vulnerability is an interesting attack in itself, but perhaps more interesting is the question, why didn't we see this earlier? In this article, the author explore this question but, unfortunately, can't answer it. Hopefully, simply asking the question might prompt developers to re-examine assumptions they've forgotten they've even made.

The rapid advancement of digital communication technologies has increased the need for secure remote access within corporate environments.This study develops and implements a secure network architecture for PT Tanjungenim Lestari Pulp & Paper using Virtual Private Network (VPN) mechanisms based on Internet Protocol Security (IPsec) and Secure Socket Layer (SSL).The existing network, which utilizes a star topology and file-sharing mechanisms, was found to lack sufficient security, particularly in protecting data transmission to external partner companies.The proposed system integrates IPsecbased VPN tunneling to ensure encrypted communication channels and SSL certificates to safeguard FTP authentication processes.Data were collected through action research and document studies, followed by network design, IP addressing, router configuration, VPN deployment, FTP server installation (VSFTPD), and file transfer testing.The results demonstrate successful establishment of secure tunnels, encrypted data exchange, and protection against credential interception during authentication.This study concludes that implementing IPsec VPN and SSL-secured FTP significantly enhances remote access security, maintains data confidentiality, and strengthens the overall network infrastructure of PT Tanjungenim Lestari Pulp & Paper.

This review chapter provides an in-depth exploration of various aspects of data security, ranging from foundational principles to advanced techniques. It sheds light on the importance of maintaining confidentiality, integrity, and availability of data and presents a comprehensive overview of technologies and methodologies that can be employed to achieve robust data security. In today's digital age, ensuring the security and protection of data has become paramount. This research chapter explores various topics related to data security, including confidentiality, integrity, and availability. It also delves into the role of blockchain technology, zero-trust architecture, secure coding practices, legal and ethical considerations, homomorphic encryption, secure multi-party computation, hash functions and digital signatures, secure communication protocols, cryptocurrency and blockchain security, as well as cryptanalysis and side-channel attacks.It highlights various techniques and technologies that can be employed to protect data confidentiality, including encryption and access control mechanisms. Blockchain technology has emerged as a groundbreaking solution for enhancing data security. Zero-trust architecture challenges traditional security models by adopting a holistic and dynamic approach to data protection. Secure coding practices and DevSecOps play a vital role in developing secure software applications. The chapter investigates the importance of integrating security measures throughout the software development lifecycle. It emphasizes the adoption of secure coding practices and the implementation of DevSecOps methodologies to build resilient and secure software systems. Legal and ethical considerations are crucial when addressing data security. Homomorphic encryption and secure multi-party computation are advanced cryptographic techniques that allow data to be processed securely while encrypted. The chapter examines the principles and applications of these techniques, highlighting their significance in scenarios where privacy is paramount. Hash functions and digital signatures form the backbone of data authentication and integrity. The chapter discusses the properties and applications of hash functions and digital signatures in verifying the integrity and authenticity of data. Secure communication protocols are essential for protecting data during transmission. The chapter explores various secure communication protocols, such as Transport Layer Security (TLS), and examines their role in ensuring data confidentiality, integrity, and authenticity. Cryptocurrency and blockchain security focus on the secure storage and transfer of digital assets. The research chapter investigates the security considerations specific to cryptocurrencies and explores how block chain technology can mitigate vulnerabilities and ensure the trustworthiness of transactions. Cryptanalysis and side-channel attacks are threats to cryptographic systems. The chapter discusses these attack techniques, highlighting their potential risks and the measures that can be taken to counter them.

To provide secure content delivery, Transport Layer Security (TLS) has become a de facto standard over a couple of decades. However, TLS has a long history of security weaknesses and drawbacks. Thus, the security of TLS has been enhanced by addressing security problems through continuous version upgrades. Meanwhile, to provide fast content delivery globally, websites (or origin web servers) need to deploy and administer many machines in globally distributed environments. They often delegate the management of machines to web hosting services or content delivery networks (CDNs), where the security configurations of distributed servers may vary spatially depending on the managing entities or locations. Based on these spatial differences in TLS security, we find that the security level of TLS connections (and their web services) can be lowered. After collecting the information of (web) domains that exhibit different TLS versions and cryptographic options depending on clients' locations, we show that it is possible to redirect TLS handshake messages to weak TLS servers, which both the origin server and the client may not be aware of. We investigate 7M domains with these spatial differences of security levels in the wild and conduct the analyses to better understand the root causes of this phenomenon. We also measure redirection delays at various locations in the world to see whether there are noticeable delays in redirections.

Transport Layer Security (TLS) and its precursor Secure Sockets Layer (SSL) are the most widely deployed protocol to establish secure communication over insecure Internet Protocol (IP) networks. Providing a secure session layer on top of TCP, TLS is frequently the first defense layer encountered by adversaries who try to cause loss of confidentiality by sniffing live traffic or loss of integrity using man-in-the-middle attacks. Despite its wide deployment and evolution over the last 18 years, TLS remains vulnerable to a number of threats at the protocol layer and therefore does not provide strong security out-of-the-box, requiring tweaks to its configuration in order to provide the expected security benefits. This paper provides a summary of the current TLS threat surface together with a validated approach for minimizing the risk of TLS-compromise. The main contributions of this paper include 1) identification of configuration options that together maximize security guarantees in the context of recent TLS exploits and 2) specification of expected flows and automated comparison with observed flows to flag inconsistencies.

Normally, secure communication between client-server applications is established using secure channel technologies such as Transport Layer Security (TLS). TLS is cryptographic protocol which ensures secure transmission of data and authenticity of communication at each endpoint platform. However, the protocol does not provide any trustworthiness assurance of the involved endpoint. This paper incorporates remote attestation in the TLS key exchange protocol to solve this issue.The proposed embedded attestation extension in TLS protocol will provide assurance of sender's platforms integrity to receiver, and vice versa.The CA responsibility in TLS is replaced using own Trusted Certificate Authority (TCA) in our protocol. The credibility of the proposed protocol is studied to secure against replay attack and collusion attack. The proof is performed using AVISPA with High Level Protocol Specification (HLPSL) through Dolev-Yao intruder model implementation of the proposed protocol.

Chapter 59 - Virtual Private Networks

Transport Layer Security (TLS) is one of the most popular security protocols for end-to-end communications. The handshake process of TLS has high computation complexity and heavy delay, while the devices in Internet of Things (IoT) always have limited resources. Therefore, it is hard to deploy TLS in IoT. To tackle this problem, we propose a novel method to simplify the TLS handshake protocol based on Software Defined Network (SDN) for a general end-to-end communication scenario. Firstly, instead of doing the Diffie-Hellman key exchange to calculate the premaster secret of TLS, the controller is used to generate the premaster secret dynamically and then distributes this secret to the IoT devices through the encrypted channel between the SDN switch and the controller. Secondly, the certificate verification of TLS is transferred from the IoT devices to the more powerful controller. Furthermore, the security of our simplified protocol is validated by the deduction of BAN logic and the analysis for malicious attacks. The experimental results show that our protocol reduces both the latency in the whole handshake process and the computational overhead in the IoT devices compared with the traditional TLS.

With more and more security threat events happened aiming at financial web services, there is an increasing amount of transactions performed over the Internet. As a de-facto standard the security protocol SSL (Secure Sockets Layer) or TLS (Transport Layer Security) is used to create a secure connection to web services. This paper analyze the weakness of the SSL and TLS protocols, based on which, we designed and implemented a root-kit for network based SSL and TLS traffic decrypt ion , which is called SSL-DP. With the experiment of SSL-DP we can see that SSL/TLS protocol is not secure enough to protect the important network information such as E-commerce etc.

In recent times, secure communication protocols over web such as HTTPS (Hypertext Transfer Protocol Secure) are being widely used instead of plain web communication protocols like HTTP (Hypertext Transfer Protocol). HTTPS provides end-to-end encryption between the user and service. Nowadays, organizations use network firewalls and/or intrusion detection and prevention systems (IDPS) to analyze the network traffic to detect and protect against attacks and vulnerabilities. Depending on the size of organization, these devices may differ in their capabilities. Simple network intrusion detection system (NIDS) and firewalls generally have no feature to inspect HTTPS or encrypted traffic, so they rely on unencrypted traffic to manage the encrypted payload of the network. Recent and powerful next-generation firewalls have Secure Sockets Layer (SSL) inspection feature which are expensive and may not be suitable for every organizations. A virtual private network (VPN) is a service which hides real traffic by creating SSL-protected channel between the user and server. Every Internet activity is then performed under the established SSL tunnel. The user inside the network with malicious intent or to hide his activity from the network security administration of the organization may use VPN services. Any VPN service may be used by users to bypass the filters or signatures applied on network security devices. These services may be the source of new virus or worm injected inside the network or a gateway to facilitate information leakage. In this paper, we have proposed a novel approach to detect VPN activity inside the network. The proposed system analyzes the communication between user and the server to analyze and extract features from network, transport, and application layer which are not encrypted and classify the incoming traffic as malicious, i.e., VPN traffic or standard traffic. Network traffic is analyzed and classified using DNS (Domain Name System) packets and HTTPS- (Hypertext Transfer Protocol Secure-) based traffic. Once traffic is classified, the connection based on the server’s IP, TCP port connected, domain name, and server name inside the HTTPS connection is analyzed. This helps in verifying legitimate connection and flags the VPN-based traffic. We worked on top five freely available VPN services and analyzed their traffic patterns; the results show successful detection of the VPN activity performed by the user. We analyzed the activity of five users, using some sort of VPN service in their Internet activity, inside the network. Out of total 729 connections made by different users, 329 connections were classified as legitimate activity, marking 400 remaining connections as VPN-based connections. The proposed system is lightweight enough to keep minimal overhead, both in network and resource utilization and requires no specialized hardware.

As the majority of Internet traffic is encrypted by the Transport Layer Security (TLS) protocol, recent advances leverage Deep Learning (DL) models to conduct encrypted traffic classification. We propose Rosetta to enable robust TLS encrypted traffic classification for existing DL models. It leverages TCP-aware traffic augmentation mechanisms and self-supervised learning to understand implicit TCP semantics, and hence extracts robust features of TLS flows. Extensive experiments show that Rosetta can significantly improve the classification performance of existing DL models on TLS traffic in diverse network environments.