Abstract:Hypertext Transfer Protocol Secure (HTTPS) protocol has become an integral part of modern Internet technology. Currently, it is the primary protocol for commercialized web applications. It can provide a fast, secure connection with a certain level of privacy and integrity, and it has become a basic assumption on most web services on the Internet. However, HTTPS alone cannot provide security assurances on request data in computing, so the computing environment remains uncertain of risks and vulnerabilities. A hardware-based trusted execution environment (TEE) such as Intel Software Guard Extension (Intel SGX) or Intel Trust Domain Extensions (Intel TDX) provides in-memory encryption to help protect runtime computation to reduce risks of illegal leaking or modifying private information. (Note that we use SGX as an example for illustration in the following texts.) The central concept of SGX enables computation inside an enclave, a protected environment that encrypts the codes and data pertaining to a security-sensitive computation. In addition, SGX provides security assurances via remote attestation to the web client to verify, including TCB identity, vendor identity, and verification identity. Here, we propose an HTTP protocol extension, called HTTPS Attestable (HTTPA), by including a remote attestation process onto the HTTPS protocol to address the privacy and security concerns on the web and the access of trust over the Internet. With HTTPA, we can provide security assurances for verification to establish trustworthiness with web services and ensure the integrity of request handling for web users. We expect that remote attestation will become a new trend adopted to reduce the security risks of web services. We propose the HTTPA protocol to unify the web attestation and accessing Internet services in a standard and efficient way.

Data integrity related markup language and HTTP protocol support for web intermediaries

An RDF-Based Annotation Framework for Providing Web Resources Integrity

Handling Dynamic Information Release

A Framework Of Universal Web Services

Multipurpose multilevel multichannel information hiding framework for multimedia protection, authentication and traitor tracing

HTTPA: HTTPS Attestable Protocol

Content Description Model and Framework for Efficient Content Distribution

Task Delegation in Active Web Intermediary Network

XML Data Integrity Based on Concatenated Hash Function

Content Consistency Model for Pervasive Internet Access.

WAIT: Protecting the Integrity of Web Applications with Binary-Equivalent Transparency

Content Delivered on Internet - How Much Can We Trust?

A Proxy Auditing Protocol for Data Storage in Cloud Computing

A New Public Remote Integrity Checking Scheme with User Privacy

Modes of Real-Time Content Transformation for Web Intermediaries in Active Network

BlockProof: A Framework for Verifying Authenticity and Integrity of Web Content

A Privacy-Preserving Remote Data Integrity Checking Protocol with Data Dynamics and Public Verifiability

Empirical Study on Web Content Consistency

Blockchain-Based Proxy-Oriented Data Integrity Checking Mechanism in Cloud-Assisted Intelligent Transportation Systems

The Trust Model Oriented Proxy:Design,Implement

Making Web Annotations Persistent over Time