ANALYZING SECURITY AND USER PRIVACY IN NETWORK SECURITY PROTOCOLS

Abstract

With the ubiquity of network communications nowadays, network security protocols serve a key role in protecting users from the hostile Internet environment, safeguarding both security and privacy of the transmitted information. As a result of the complications in protocol development life cycle from design to implementation, the network security protocols, such as SSL/TLS and single sign-on (SSO) protocols, have been continually found error-prone. Given their critical role, vulnerabilities (such as logic flaws in the protocol design and certificate validation failure in the implementation) could easily compromise the end-to-end confidentiality, integrity and authentication. Additionally, those vulnerabilities also enable the adversaries to profile the network users based on their fine-grained online activity data. Hence, analyzing such security and user privacy properties in network security protocols become vital throughout the steps for deploying them in practice.

In this thesis, we focus on the security and privacy of the network security protocols by scrutinizing them on the design level (e.g., the protocol specifications, logics and control flows) and the implementation level (e.g., APIs, libraries, user interfaces and relevant applications).