基于X.509证书测量的隐私泄露分析

发布时间：2018-04-04 09:08

本文选题：HTTPS　切入点：X.证书　出处：《计算机学报》2014年01期

【摘要】：SSL协议由于易于部署以及集成在Web浏览器中的天然属性,被广泛应用于保障网页浏览、电子邮件、文件传输等应用服务的信息传输安全,其中最典型的应用是HTTPS.然而,实践中往往由于HTTPS服务的部署存在问题,比如服务器采用自签名X.509证书等,给用户带来严重的安全威胁,包括信息遭窃取、用户身份和行为隐私泄露等.本文从标识服务器身份的X.509证书出发,通过对真实环境HTTPS服务端证书的大范围测量和分析来揭示采用自签名证书的HTTPS服务存在的应用服务类型泄露问题,以及由此引起的用户网络行为隐私泄露威胁.针对大规模真实环境中用户网络行为的测量分析和海量日志挖掘结果表明,X.509自签名证书提供了较强区分服务器加密应用类型的身份信息,加密HTTPS应用服务器的身份隐藏手段在很大程度上可以通过统计行为分析来识破,提供相同或相似的特定应用服务的服务器的被正确分类的准确率最高可达95%.
[Abstract]:The SSL protocol is widely used to ensure the security of information transmission in web browsing, email, file transfer and other applications due to its easy deployment and the natural properties integrated in Web browsers, among which the most typical application is HTTP.However, in practice, some problems often exist in the deployment of HTTPS services, such as the server using self-signed X.509 certificate, which brings serious security threats to users, including information theft, user identity and behavior privacy disclosure.Based on the X.509 certificate that identifies the identity of the server, this paper reveals the application service type leakage problem of the HTTPS service using the self-signed certificate by measuring and analyzing the real environment HTTPS server certificate in a wide range.And the resulting user network behavior privacy disclosure threat.The measurement and analysis of user network behavior in large-scale real environment and massive log mining results show that X.509 self-signed certificate provides a strong distinction between server encryption application type identity information.To a large extent, the encryption of HTTPS application server identity hiding means can be detected by statistical behavior analysis. The accuracy of correct classification of servers providing the same or similar specific application services can be up to 9595%.
【作者单位】：北京邮电大学计算机学院;中国科学院信息工程研究所;
【基金】：国家“八六三”高技术研究发展计划项目基金(2011AA010703) 国家科技支撑计划(2012BAH46B02) 中国科学院战略性先导科技专项课题(XDA06030200) 国家自然科学基金项目(61070184)资助~~
【分类号】：TP393.08

【参考文献】