research-article

STYX: a trusted and accelerated hierarchical SSL key management and distribution system for cloud based CDN application

Authors:

Changzheng Wei,

Haibing GuanAuthors Info & Claims

SoCC '17: Proceedings of the 2017 Symposium on Cloud Computing

Pages 201 - 213

https://doi.org/10.1145/3127479.3127482

Published: 24 September 2017 Publication History

Abstract

Protecting the customer's SSL private key is the paramount issue to persuade the website owners to migrate their contents onto the cloud infrastructure, besides the advantages of cloud infrastructure in terms of flexibility, efficiency, scalability and elasticity. The emerging Keyless SSL solution retains on-premise custody of customers' SSL private keys on their own servers. However, it suffers from significant performance degradation and limited scalability, caused by the long distance connection to Key Server for each new coming end-user request. The performance improvements using persistent session and key caching onto cloud will degrade the key invulnerability and discourage the website owners because of the cloud's security bugs.

In this paper, the challenges of secured key protection and distribution are addressed in philosophy of "Storing the trusted DATA on untrusted platform and transmitting through untrusted channel". To this end, a three-phase hierarchical key management scheme, called STYX¹ is proposed to provide the secured key protection together with hardware assisted service acceleration for cloud-based content delivery network (CCDN) applications. The STYX is implemented based on Intel Software Guard Extensions (SGX), Intel QuickAssist Technology (QAT) and SIGMA (SIGn-and-MAc) protocol. STYX can provide the tight key security guarantee by SGX based key distribution with a light overhead, and it can further significantly enhance the system performance with QAT based acceleration. The comprehensive evaluations show that the STYX not only guarantees the absolute security but also outperforms the direct HTTPS server deployed CDN without QAT by up to 5x throughput with significant latency reduction at the same time.

References

[1]

Intel corp., intel quickassist technology. https://01.org/packet-processing/intel

[2]

Intel corp., intel software guard extensions: Intel attestation service api. https://software.intel.com/sites/default/files/managed/3d/c8/IAS_1_0_API_spec_1_1_Final.pdf.

[3]

Intel corp., intel software guard extensions (intel sgx). https://software.intel.com/en-us/sgx.

[4]

Intel corp, intelÂő xeonÂő processor e5-2600 v2 product family and intelÂő communications chipset 89xx series,. https://wwwssl.intel.com/content/www/us/en/intelligent-systems/highland-forest/xeon-e5-2600-v2-large-scale-communications-brief.html.

[5]

Amazon. Amazon cloudfront âĂŞ content delivery network (cdn). https://aws.amazon.com/cloudfront/.

[6]

Armin, J., Foti, P., and Cremonini, M. 0-day vulnerabilities and cybercrime. In Availability, Reliability and Security (ARES), 2015 10th International Conference on (2015), IEEE, pp. 711--718.

Digital Library

[7]

Baumann, A., Peinado, M., and Hunt, G. Shielding applications from an untrusted cloud with haven. ACM Transactions on Computer Systems (TOCS) 33, 3 (2015), 8.

Digital Library

[8]

Blog, V. C. Analysis of "average session duration" in google analytics. https://www.visma.com/blog/analysis-reporting-average-session-duration-google-analytics/.

[9]

Bresson, E., Chevassut, O., Pointcheval, D., and Quisquater, J.-J. Provably authenticated group diffie-hellman key exchange. In Proceedings of the 8th ACM conference on Computer and Communications Security (2001), ACM, pp. 255--264.

Digital Library

[10]

Brickell, E., and Li, J. Enhanced privacy id: A direct anonymous attestation scheme with enhanced revocation capabilities. In Proceedings of the 2007 ACM Workshop on Privacy in Electronic Society (New York, NY, USA, 2007), WPES '07, ACM, pp. 21--30.

Digital Library

[11]

Brickell, E., and Li, J. Enhanced privacy id from bilinear pairing. Cryptology ePrint Archive, Report 2009/095, 2009.

[12]

Brickell, E., and Li, J. Enhanced privacy id from bilinear pairing for hardware authentication and attestation. International Journal of Information Privacy, Security and Integrity 2 1, 1 (2011), 3--33.

[13]

Brickell, E., and Li, J. Enhanced privacy id: A direct anonymous attestation scheme with enhanced revocation capabilities. IEEE Transactions on Dependable and Secure Computing 9, 3 (May 2012), 345--360.

Digital Library

[14]

Brown, R. Sec 1: elliptic curve cryptography. standards for efficient cryptography group (secg), 2016.

[15]

Cangialosi, F., Chung, T., Choffnes, D., Levin, D., Maggs, B. M., Mislove, A., and Wilson, C. Measurement and analysis of private key sharing in the https ecosystem. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (2016), ACM, pp. 628--640.

Digital Library

[16]

Chandramouli, R., Iorga, M., and Chokhani, S. Cryptographic Key Management Issues and Challenges in Cloud Services. Springer New York, New York, NY, 2014, pp. 1--30.

[17]

Choon, J. C., and Cheon, J. H. An identity-based signature from gap diffie-hellman groups. In International Workshop on Public Key Cryptography (2003), Springer, pp. 18--30.

[18]

Cloudflare. How will keyless ssl affect performance? https://support.cloudflare.com/hc/en-us/articles/203243090-How-will-Keyless-SSL-affect-performance-.

[19]

Cloudflare. Keyless ssl: The nitty gritty technical details. https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/.

[20]

Coppolino, L., DâĂ&Zacute;Antonio, S., Mazzeo, G., and Romano, L. Cloud security: Emerging threats and current solutions. Computers & Electrical Engineering (2016).

[21]

Costan, V., and Devadas, S. Intel sgx explained. Tech. rep., Cryptology ePrint Archive, Report 2016/086, 2016. https://eprint.iacr.org/2016/086.

[22]

Cramer, R., and Shoup, V. Signature schemes based on the strong rsa assumption. ACM Transactions on Information and System Security (TISSEC) 3, 3 (2000), 161--185.

Digital Library

[23]

Durumeric, Z., Kasten, J., Adrian, D., Halderman, J. A., Bailey, M., Li, F., Weaver, N., Amann, J., Beekman, J., Payer, M., et al. The matter of heartbleed. In Proceedings of the 2014 Conference on Internet Measurement Conference (2014), ACM, pp. 475--488.

Digital Library

[24]

Fan, C. I., Wu, C. N., Hsu, J. C., Tseng, Y. F., and Chen, W. T. Anonymous credential scheme supporting active revocation. In 2014 Ninth Asia Joint Conference on Information Security (Sept 2014), pp. 127--132.

[25]

Google. https://support.google.com/analytics/answer/1006253?hl=en.

[26]

Google. Google cloud cdn documentation. https://cloud.google.com/cdn/docs/.

[27]

Grossklags, J., Christin, N., and Chuang, J. Secure or insure?: a game-theoretic analysis of information security games. In Proceedings of the 17th international conference on World Wide Web (2008), ACM, pp. 209--218.

Digital Library

[28]

Hankerson, D., Menezes, A. J., and Vanstone, S. Guide to elliptic curve cryptography. Springer Science & Business Media, 2006.

Digital Library

[29]

Hofmann, O. S., Kim, S., Dunn, A. M., Lee, M. Z., and Witchel, E. Inktag: Secure applications on an untrusted operating system. SIGPLAN Not. 48, 4 (Mar. 2013), 265--278.

Digital Library

[30]

Intel. Corp., intel system studio 2017. https://software.intel.com/en-us/intel-system-studio.

[31]

Intel. Corp., intel vtuneâĎć amplifier 2017. https://software.intel.com/en-us/intel-vtune-amplifier-xe.

[32]

Jin, G., Song, L., Zhang, W., Lu, S., and Liblit, B. Automated atomicity-violation fixing. In ACM SIGPLAN Notices (2011), vol. 46, ACM, pp. 389--400.

Digital Library

[33]

Johnson, S., Scarlata, V., Rozas, C., Brickell, E., and Mckeen, F. Intel software guard extensions: Epid provisioning and attestation services. White Paper (2016).

[34]

Joux, A. A one round protocol for tripartite diffie-hellman. In International Algorithmic Number Theory Symposium (2000), Springer, pp. 385--393.

[35]

Kaliski, B. Public-key cryptography standards (pkcs)# 8: Private-key information syntax specification version 1.2. RFC 5208, IETF (2008).

[36]

Kim, S., Shin, Y., Ha, J., Kim, T., and Han, D. A first step towards leveraging commodity trusted execution environments for network applications. In Proceedings of the 14th ACM Workshop on Hot Topics in Networks (2015), ACM, p. 7.

Digital Library

[37]

Krawczyk, H. Sigma: The 'sign-and-mac' approach to authenticated diffie-hellman and its use in the ike protocols. In Annual International Cryptology Conference (2003), Springer, pp. 400--425.

[38]

Liang, J., Jiang, J., Duan, H., Li, K., Wan, T., and Wu, J. When https meets cdn: A case of authentication in delegated service. In 2014 IEEE Symposium on Security and Privacy (May 2014), pp. 67--82.

Digital Library

[39]

Litton, J., Vahldiek-Oberwagner, A., Elnikety, E., Garg, D., Bhattacharjee, B., and Druschel, P. Light-weight contexts: An os abstraction for safety and performance. In Proceedings of the 12th USENIX Conference on Operating Systems Design and Implementation (Berkeley, CA, USA, 2016), OSDI'16, USENIX Association, pp. 49--64.

[40]

Miller, V. S. Use of elliptic curves in cryptography. In Conference on the Theory and Application of Cryptographic Techniques (1985), Springer, pp. 417--426.

Digital Library

[41]

Mutton, P. Half a million widely trusted websites vulnerable to heartbleed bug, 2014.

[42]

Nikiforakis, N., Meert, W., Younan, Y., Johns, M., and Joosen, W. Session-shield: Lightweight protection against session hijacking. In International Symposium on Engineering Secure Software and Systems (2011), Springer, pp. 87--100.

[43]

Noubir, G., and Sanatinia, A. Trusted code execution on untrusted platform using intel sgx. Virus Bulletin (2016).

[44]

Odelu, V., Das, A. K., and Goswami, A. A secure biometrics-based multi-server authentication protocol using smart cards. IEEE Transactions on Information Forensics and Security 10, 9 (Sept 2015), 1953--1966.

Digital Library

[45]

OpenSSL. https://www.openssl.org/.

[46]

Reese, W. Nginx: the high-performance web server and reverse proxy. Linux Journal 2008, 173 (2008), 2.

[47]

Rescorla, E. Security holes... who cares? In USENIX Security (2003), Washington, DC.

[48]

Rsa, A., and Note, L. T. Pkcs#8: Private-key information syntax standard, 1993.

[49]

Sanatinia, A., and Noubir, G. Honey onions: a framework for characterizing and identifying misbehaving tor hsdirs. arXiv preprint arXiv:1610.06140 (2016).

[50]

Schuster, F., Costa, M., Fournet, C., Gkantsidis, C., Peinado, M., Mainar-Ruiz, G., and Russinovich, M. Vc3: Trustworthy data analytics in the cloud using sgx. In Security and Privacy (SP), 2015 IEEE Symposium on (2015), IEEE, pp. 38--54.

Digital Library

[51]

Sidiroglou, S., Laadan, O., Perez, C., Viennot, N., Nieh, J., and Keromytis, A. D. Assure: automatic software self-healing using rescue points. ACM SIGARCH Computer Architecture News 37, 1 (2009), 37--48.

Digital Library

[52]

Sinha, R., Rajamani, S., Seshia, S., and Vaswani, K. Moat: Verifying confidentiality of enclave programs. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (2015), ACM, pp. 1169--1184.

Digital Library

[53]

Stebila, D., and Sullivan, N. An analysis of tls handshake proxying. In 2015 IEEE Trustcom/BigDataSE/ISPA (Aug 2015), vol. 1, pp. 279--286.

Digital Library

[54]

Steiner, M., Tsudik, G., and Waidner, M. Diffie-hellman key distribution extended to group communication. In Proceedings of the 3rd ACM conference on Computer and communications security (1996), ACM, pp. 31--37.

Digital Library

[55]

Wang, Y. Public key cryptography standards: Pkcs. arXiv preprint arXiv:1207.5446 (2012).

[56]

Wikipedia. Content delivery network. https://en.wikipedia.org/wiki/Content_delivery_network.

[57]

Wikipedia. Fiber. https://en.wikipedia.org/wiki/Fiber_(computer_science)#cite_note-flounder-1.

[58]

Wu, C.-H., Hong, J.-H., and Wu, C.-W. Rsa cryptosystem design based on the chinese remainder theorem. In Proceedings of the 2001 Asia and South Pacific Design Automation Conference (New York, NY, USA, 2001), ASP-DAC '01, ACM, pp. 391--395.

Digital Library

[59]

Xie, W., and Wang, J. A trusted connection based scheme for ad hoc network. In PROCEEDINGS OF 2013 International Conference on Sensor Network Security Technology and Privacy Communication System (May 2013), pp. 34--38.

[60]

Zhang, F., and Zhang, H. Sok: A study of using hardware-assisted isolated execution environments for security. In Proceedings of the Hardware and Architectural Support for Security and Privacy 2016 (2016), ACM, p. 3.

Digital Library

[61]

Zhang, L., Choffnes, D., Levin, D., Dumitras, T., Mislove, A., Schulman, A., and Wilson, C. Analysis of ssl certificate reissues and revocations in the wake of heartbleed. In Proceedings of the 2014 Conference on Internet Measurement Conference (New York, NY, USA, 2014), IMC '14, ACM, pp. 489--502.

Digital Library

[62]

Zhao, M., Zhou, W., Gurney, A. J., Haeberlen, A., Sherr, M., and Loo, B. T. Private and verifiable interdomain routing decisions. In Proceedings of the ACM SIGCOMM 2012 conference on Applications, technologies, architectures, and protocols for computer communication (2012), ACM, pp. 383--394.

Digital Library

[63]

Zhao, M., Zhou, W., Gurney, A. J., Haeberlen, A., Sherr, M., and Loo, B. T. Private and verifiable interdomain routing decisions. IEEE/ACM Transactions on Networking 24, 2 (2016), 1011--1024.

Digital Library

Cited By

Shobiri BPourali SMigault DBoureanu IPreda SMannan MYoussef A(2024)LURK-T: Limited Use of Remote Keys With Added Trust in TLS 1.3IEEE Transactions on Network Science and Engineering10.1109/TNSE.2024.343283611:6(6313-6327)Online publication date: Dec-2024
https://doi.org/10.1109/TNSE.2024.3432836
Kang JPark JChoi SSim J(2024)Q-LAtte: An Efficient and Versatile LSTM Model for Quantized Attention-Based Time Series Forecasting in Building Energy ApplicationsIEEE Access10.1109/ACCESS.2024.340058812(69325-69341)Online publication date: 2024
https://doi.org/10.1109/ACCESS.2024.3400588
Ahn TKwak JKim S(2024)mdTLS: How to Make Middlebox-Aware TLS More Efficient?Information Security and Cryptology – ICISC 202310.1007/978-981-97-1238-0_3(39-59)Online publication date: 8-Mar-2024
https://doi.org/10.1007/978-981-97-1238-0_3
Show More Cited By

Index Terms

STYX: a trusted and accelerated hierarchical SSL key management and distribution system for cloud based CDN application

Recommendations

Performance Analysis of Cloud Computing Services for Many-Tasks Scientific Computing

Cloud computing is an emerging commercial infrastructure paradigm that promises to eliminate the need for maintaining expensive computing facilities by companies and institutes alike. Through the use of virtualization and resource time sharing, clouds ...
Deployment Strategies for Distributed Applications on Cloud Computing Infrastructures
CLOUDCOM '13: Proceedings of the 2013 IEEE International Conference on Cloud Computing Technology and Science - Volume 02

Cloud computing enables on-demand access to a shared pool of IT resources. In the case of Infrastructure as a Service (IaaS), the cloud user typically acquires Virtual Machines (VMs) from the provider. It is up to the user to decide at what time and for ...
Generalized Nash Equilibria for the Service Provisioning Problem in Cloud Systems

In recent years, the evolution and the widespread adoption of virtualization, service-oriented architectures, autonomic, and utility computing have converged letting a new paradigm to emerge: cloud computing. Clouds allow the on-demand delivering of ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

SoCC '17: Proceedings of the 2017 Symposium on Cloud Computing

September 2017

672 pages

ISBN:9781450350280

DOI:10.1145/3127479

Copyright © 2017 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 24 September 2017

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

National Natural Science Funds for Distinguished Young Scholar
National Key Research & Development Program of China

Conference

SoCC '17

Sponsor:

SoCC '17: ACM Symposium on Cloud Computing

September 24 - 27, 2017

California, Santa Clara

Acceptance Rates

Overall Acceptance Rate 169 of 722 submissions, 23%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

13
Total Citations
View Citations
465
Total Downloads

Downloads (Last 12 months)12
Downloads (Last 6 weeks)2

Reflects downloads up to 28 Dec 2024

Other Metrics

View Author Metrics

Citations

Cited By

Shobiri BPourali SMigault DBoureanu IPreda SMannan MYoussef A(2024)LURK-T: Limited Use of Remote Keys With Added Trust in TLS 1.3IEEE Transactions on Network Science and Engineering10.1109/TNSE.2024.343283611:6(6313-6327)Online publication date: Dec-2024
https://doi.org/10.1109/TNSE.2024.3432836
Kang JPark JChoi SSim J(2024)Q-LAtte: An Efficient and Versatile LSTM Model for Quantized Attention-Based Time Series Forecasting in Building Energy ApplicationsIEEE Access10.1109/ACCESS.2024.340058812(69325-69341)Online publication date: 2024
https://doi.org/10.1109/ACCESS.2024.3400588
Ahn TKwak JKim S(2024)mdTLS: How to Make Middlebox-Aware TLS More Efficient?Information Security and Cryptology – ICISC 202310.1007/978-981-97-1238-0_3(39-59)Online publication date: 8-Mar-2024
https://doi.org/10.1007/978-981-97-1238-0_3
Yoon DChung TKim Y(2023)Delegation of TLS Authentication to CDNs using Revocable Delegated CredentialsProceedings of the 39th Annual Computer Security Applications Conference10.1145/3627106.3627144(113-123)Online publication date: 4-Dec-2023
https://dl.acm.org/doi/10.1145/3627106.3627144
Zhang ZZhang HWang JHu XLi JYu WYu PLi WCui BZhu GSood KWill BGuan H(2023)QKPT: Securing Your Private Keys in Cloud With Performance, Scalability and TransparencyIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2021.313740320:1(478-491)Online publication date: 1-Jan-2023
https://doi.org/10.1109/TDSC.2021.3137403
Xin RLin SYang X(2023)Quantifying User Password Exposure to Third-Party CDNsPassive and Active Measurement10.1007/978-3-031-28486-1_27(652-668)Online publication date: 10-Mar-2023
https://doi.org/10.1007/978-3-031-28486-1_27
Lin SXin RGoel AYang XYin HStavrou ACremers CShi E(2022)InviCloakProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security10.1145/3548606.3559336(1947-1961)Online publication date: 7-Nov-2022
https://dl.acm.org/doi/10.1145/3548606.3559336
Hu XLi JWei CLi WZeng XYu PGuan H(2021)STYX: A Hierarchical Key Management System for Elastic Content Delivery Networks on Public CloudsIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2019.291827818:2(843-857)Online publication date: 1-Mar-2021
https://dl.acm.org/doi/10.1109/TDSC.2019.2918278
Chuat LAbdou ASasse RSprenger CBasin DPerrig A(2020)SoK: Delegation and Revocation, the Missing Links in the Web's Chain of Trust2020 IEEE European Symposium on Security and Privacy (EuroS&P)10.1109/EuroSP48549.2020.00046(624-638)Online publication date: Oct-2020
https://doi.org/10.1109/EuroSP48549.2020.00046
Park MKim JKim YCho EPark SSohn SKang MKwon T(2020)An SGX-Based Key Management Framework for Data Centric NetworkingIEEE Access10.1109/ACCESS.2020.29783468(45198-45210)Online publication date: 2020
https://doi.org/10.1109/ACCESS.2020.2978346
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents