2016/10/26 by Mark O'Neill, O'Neill, Mark, Scott Heidbrink +11
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Security and Verification in Computing #User Authentication and Security Systems #cs.CR
paper · pdf · doi:10.48550/arxiv.1610.08570
15 pages, 4 figures
arxiv created 2016/10/26 · openalex publication_date 2016/10/26 · arxiv updated 2016/10/28 · openalex created_date 2016/11/04 · openalex updated_date 2026/07/28
We describe TrustBase, an architecture that provides certificate-based authentication as an operating system service. TrustBase enforces best practices for certificate validation for all applications and transparently enables existing applications to be strengthened against failures of the CA system. The TrustBase system allows simple deployment of authentication systems that harden the CA system. This enables system administrators, for example, to require certificate revocation checks on all TLS connections, or require STARTTLS for email servers that support it. TrustBase is the first system that is able to secure all TLS traffic, using an approach compatible with all operating systems. We design and evaluate a prototype implementation of TrustBase on Linux, evaluate its security, and demonstrate that it has negligible overhead and universal compatibility with applications. To demonstrate the utility of TrustBase, we have developed six authentication services that strengthen certificate validation for all applications.