Abstract

Public Key Infrastructure (PKI) instills trust in certificates commonly used to secure email, web traffic, VPNs, file transfers, and other forms of network communication. Due to a number of successful attacks against certificate authorities, malicious parties have illegitimately acquired trusted certificates for widely used online services, government agencies, and other important organizations. These incidents, and the potential for future attacks of a similar nature, present notable risk to PKI and global security as a whole. The proposed Certificate Policy Framework (CPF) offers a mechanism for organizations to control which certificates are authorized to authenticate their services. This DNS-based protocol allows organizations to publish an access control list for any given hostname, where each entry in the ACL identifies a certificate and indicates whether the certificate should be blocked, warned upon, or permitted. Similarly, any CPF-compatible application can query DNS for CPF records to verify the integrity of the certificate from an authoritative viewpoint. In this work, we review limitations in PKI and certificate-based security and review existing work in this area. We will also discuss CPF in greater detail and demonstrate how it can be used to augment PKI to strengthen this widely adopted technology.

Library of Congress Subject Headings

Public key infrastructure (Computer security); Internet domain names; Internet addresses

Publication Date

2012

Document Type

Thesis

Student Type

- Please Select One -

Department, Program, or Center

Department of Computing Security (GCCIS)

Advisor

Border, Charles

Advisor/Committee Member

Johnson, Daryl

Advisor/Committee Member

Pan, Yin

Comments

Note: imported from RIT’s Digital Media Library running on DSpace to RIT Scholar Works. Physical copy available through RIT's The Wallace Library at: QA76.9.A25 L54 2012

Additional Files
MLidestriSupplement.pdf (414 kB)

Campus

RIT – Main Campus

Plan Codes

COMPSEC-MS

Download

Additional files available below

Share

COinS