论文标题
眼罩：将私钥在PKI和CDN中保持看不见
Blindfold: Keeping Private Keys in PKIs and CDNs out of Sight
论文作者
论文摘要
公共密钥基础架构（PKI）是一种基于证书的技术，可帮助身份验证系统身份。 HTTPS/TLS主要依赖PKI来最大程度地减少Internet的欺诈。如今，网站利用CDN来改善针对网络攻击的用户体验，性能和弹性。但是，将HTTPS/TLS与CDN相结合，提出了新的安全挑战。在任何PKI系统中，保持私钥私有至关重要。但是，违反该基本假设已成为CDN驱动网站的规范。已经提出了几种解决方案，以使HTTPS友好。但是，保护私钥免受一代的影响；以及如何通过恶意（CDN）管理员和恶意软件来保护它们，但仍未得到探索。我们利用可信赖的执行环境来保护私钥，从不将其暴露于人类操作员或不受信任的软件。我们设计了眼罩，以保护HTTPS/TLS基础架构中的私钥，包括CAS，网站本地服务器和CDN。我们实施了一个原型来评估眼罩的性能，并在微观和宏观水平上进行了多个实验。我们发现，眼罩在密钥一代中略高于SOFTHSM，而证书发行运营滞后0.01％。
Public key infrastructure (PKI) is a certificate-based technology that helps in authenticating systems identities. HTTPS/TLS relies mainly on PKI to minimize fraud over the Internet. Nowadays, websites utilize CDNs to improve user experience, performance, and resilience against cyber attacks. However, combining HTTPS/TLS with CDNs has raised new security challenges. In any PKI system, keeping private keys private is of utmost importance. However, it has become the norm for CDN-powered websites to violate that fundamental assumption. Several solutions have been proposed to make HTTPS CDN-friendly. However, protection of private keys from the very instance of generation; and how they can be made secure against exposure by malicious (CDN) administrators and malware remain unexplored. We utilize trusted execution environments to protect private keys by never exposing them to human operators or untrusted software. We design Blindfold to protect private keys in HTTPS/TLS infrastructures, including CAs, website on-premise servers, and CDNs. We implemented a prototype to assess Blindfold's performance and performed several experiments on both the micro and macro levels. We found that Blindfold slightly outperforms SoftHSM in key generation by 1% while lagging by 0.01% for certificate issuance operations.
