2016 Fourth IEEE Workshop on Hot Topics in Web Systems and Technologies (HotWeb)最新文献_第2页

Towards User Re-Authentication on Mobile Devices via On-Screen Keyboard 通过屏幕键盘在移动设备上实现用户重新认证

2016 Fourth IEEE Workshop on Hot Topics in Web Systems and Technologies (HotWeb) Pub Date : 2016-10-01 DOI: 10.1109/HotWeb.2016.22

Zijiang Hao, Qun A. Li

引用次数: 7

Client-Centric Content Delivery Network 以客户为中心的内容交付网络

2016 Fourth IEEE Workshop on Hot Topics in Web Systems and Technologies (HotWeb) Pub Date : 2016-10-01 DOI: 10.1109/HotWeb.2016.9

Sipat Triukose, M. Rabinovich

引用次数: 1

Greedy Maximization Framework for Graph-Based Influence Functions 基于图的影响函数贪心最大化框架

2016 Fourth IEEE Workshop on Hot Topics in Web Systems and Technologies (HotWeb) Pub Date : 2016-08-13 DOI: 10.1109/HotWeb.2016.14

E. Cohen

引用次数: 2

PROVIDE: Hiding from Automated Network Scans with Proofs of Identity 提供:隐藏自动网络扫描与身份证明

2016 Fourth IEEE Workshop on Hot Topics in Web Systems and Technologies (HotWeb) Pub Date : 2016-07-01 DOI: 10.1109/HOTWEB.2016.20

W. Koch, Azer Bestavros

{"title":"PROVIDE: Hiding from Automated Network Scans with Proofs of Identity","authors":"W. Koch, Azer Bestavros","doi":"10.1109/HOTWEB.2016.20","DOIUrl":"https://doi.org/10.1109/HOTWEB.2016.20","url":null,"abstract":"Network scanners are a valuable tool for researchers and administrators, however they are also used by malicious actors to identify vulnerable hosts on a network. Upon the disclosure of a security vulnerability, scans are launched within hours. These opportunistic attackers enumerate blocks of IP addresses in hope of discovering an exploitable host. Fortunately, defensive measures such as port knocking protocols (PKPs) allow a service to remain stealth to unauthorized IP addresses. The service is revealed only when a client includes a special authentication token (AT) in the IP/TCP header. However this AT is generated from a secret shared between the clients/servers and distributed manually to each endpoint. As a result, these defense measures have failed to be widely adopted by other protocols such as HTTP/S due to challenges in distributing the shared secrets. In this paper we propose a scalable solution to this problem for services accessed by domain name. We make the following observation: automated network scanners access servers by IP address, while legitimate clients access the server by name. Therefore a service should only reveal itself to clients who know its name. Based on this principal, we have created a proof of the verifier's identity (a.k.a. PROVIDE) protocol that allows a prover (legitimate user) to convince a verifier (service) that it is knowledgeable of the verifier's identity. We present a PROVIDE implementation using a PKP and DNS (PKP+DNS) that uses DNS TXT records to distribute identification tokens (IDTs) while DNS PTR records for the service's domain name are prohibited to prevent reverse DNS lookups. Clients are modified to make an additional DNS TXT query to obtain the IDT which is used by the PKP to generate an AT. The inclusion of an AT in the packet header, generated from the DNS TXT query, is proof the client knows the service's identity. We analyze the effectiveness of this mechanism with respect to brute force attempts for various strength ATs and discuss practical considerations.","PeriodicalId":408635,"journal":{"name":"2016 Fourth IEEE Workshop on Hot Topics in Web Systems and Technologies (HotWeb)","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126814291","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7