Grant: Discovery Grants Program - Individual

The program explores open security problems involving Internet authentication, including authentication of users and websites, secure software installation, and security of mobile devices; and aims to design new mechanisms improving Internet security. A first thrust seeks to address known security issues and design flaws in the Secure Sockets Layer mechanism (the Internet's core security infrastructure used by web browsers), and its underlying certificate authority infrastructure and trust model. We explore root causes of security issues, and design and test tools addressing current threats through evolutionary and revolutionary approaches including redesign of trust model infrastructure. A second thrust pursues design of a foundational methodology and comprehensive framework for systematic evaluation of user authentication mechanisms, with broad emphasis across usability, deployability, and security criteria; its use to accurately identify requirements matching authentication mechanisms with specific application environments; and design and evaluation of new mechanisms with identifiable advantages. A third thrust explores authentication aspects of mobile device security--web site and user authentication, and secure software installation--including design and evaluation of novel mechanisms specifically suiting mobile device limitations (e.g., size, input modalities). To avoid security threats related to non-expert users installing malicious application software, redesign is explored including operating system mechanisms balancing security (software isolation) and functionality (cross-application sharing). The problems explored are among society's most important cyber-security challenges, impacting all Internet users from private citizens, to business and government, to technology providers, and solutions increase trustworthiness of critical Internet infrastructure. We expect fundamental research results that contribute to stronger real-world Internet security through the design of better authentication and more secure, resilient software installation methods; and to see them deployed, including on mobile devices and in major browsers, through coordinating stakeholders to improve the Internet infrastructure.