Server Location Verification and Server Location Pinning: Augmenting TLS Authentication [article]

AbdelRahman Abdou, P.C. van Oorschot
<span title="2016-08-16">2016</span> <i > arXiv </i> &nbsp; <span class="release-stage" >pre-print</span>
We introduce the first known mechanism providing realtime server location verification. Its uses include enhancing server authentication (e.g., augmenting TLS) by enabling browsers to automatically interpret server location information. We describe the design of this new measurement-based technique, Server Location Verification (SLV), and evaluate it using PlanetLab. We explain how SLV is compatible with the increasing trends of geographically distributed content dissemination over the
more &raquo; ... without causing any new interoperability conflicts. Additionally, we introduce the notion of (verifiable) "server location pinning" within TLS (conceptually similar to certificate pinning) to support SLV, and evaluate their combined impact using a server-authentication evaluation framework. The results affirm the addition of new security benefits to the existing SSL/TLS-based authentication mechanisms. We implement SLV through a location verification service, the simplest version of which requires no server-side changes. We also implement a simple browser extension that interacts seamlessly with the verification infrastructure to obtain realtime server location-verification results.
<span class="external-identifiers"> <a target="_blank" rel="external noopener" href="https://arxiv.org/abs/1608.03939v2">arXiv:1608.03939v2</a> <a target="_blank" rel="external noopener" href="https://fatcat.wiki/release/cwvzp26effhjljirh3ag6tn6ni">fatcat:cwvzp26effhjljirh3ag6tn6ni</a> </span>
<a target="_blank" rel="noopener" href="https://web.archive.org/web/20200824054538/https://arxiv.org/pdf/1608.03939v2.pdf" title="fulltext PDF download" data-goatcounter-click="serp-fulltext" data-goatcounter-title="serp-fulltext"> <button class="ui simple right pointing dropdown compact black labeled icon button serp-button"> <i class="icon ia-icon"></i> Web Archive [PDF] <div class="menu fulltext-thumbnail"> <img src="https://blobs.fatcat.wiki/thumbnail/pdf/16/ab/16ab855af1db8fcd1e22fbb7e45a114bd9eb8a6d.180px.jpg" alt="fulltext thumbnail" loading="lazy"> </div> </button> </a> <a target="_blank" rel="external noopener" href="https://arxiv.org/abs/1608.03939v2" title="arxiv.org access"> <button class="ui compact blue labeled icon button serp-button"> <i class="file alternate outline icon"></i> arxiv.org </button> </a>