PorKI: Portable PKI Credentials via Proxy Certificates

Abstract

Abstract. Authenticating human users using public key cryptography provides a number of useful security properties, such as being able to authenticate to remote party without giving away a secret. However, in many scenarios, users need to authenticate from a number of client machines, of varying degrees of trustworthiness. In previous work, we proposed an approach to solving this problem by giving users portable devices which wirelessly issue temporary, limited-use proxy certificates to the clients. In this paper, we describe our complete prototype, enabling the use of proxy credentials issued from a mobile device to securely authenticate users to remote servers via a shared (or otherwise not trusted) device. In particular, our PorKI implementation combines out-of-band authentication (via 2D barcode images), standard Proxy Certificates, and platform attestation to provide usable and secure temporary credentials for web-based applications.

Using a Smartphone to Access Personalized Web Services on a Workstation

“…Related solutions in literature, such as [10], rely on a smartphone and transfer a proxy credential to the browser on the workstation. The browser can then use this credential to set up mutually authenticated HTTPS sessions with servers.…”

A Smart Card Based Solution for User-Centric Identity Management

“…Our work generalizes the PAD concept to a personal identification device with extended functionality (e.g., support for multiple identity providers, deanonymization) and a concrete implementation is presented. A similar approach is taken in PorKI [12] where users can delegate temporary proxy credentials to workstations using their mobile devices.…”

Access control in and for the real world

“…Later work on the PorKI project that is not reflected here is discussed by Pala et al[68] 4. In many cases, users will have separate keypairs for signing and encryption purposes.…”

“…Our lab later demonstrated the feasibility of adapting PorKI to smartphones by implementing it on an iPhone [68]…”