By Topic

Scalable Web Content Attestation

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$33 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

5 Author(s)
Thomas Moyer ; Comput. Sci. & Eng. Dept., Pennsylvania State Univ., University Park, PA, USA ; Kevin Butler ; Joshua Schiffman ; Patrick McDaniel
more authors

The Web is a primary means of information sharing for most organizations and people. Currently, a recipient of Web content knows nothing about the environment in which that information was generated other than the specific server from whence it came (and even that information can be unreliable). In this paper, we develop and evaluate the Spork system that uses the trusted platform module (TPM) to tie the Web server integrity state to the Web content delivered to browsers, thus allowing a client to verify that the origin of the content was functioning properly when the received content was generated and/or delivered. We discuss the design and implementation of the Spork service and its browser-side Firefox validation extension. In particular, we explore the challenges and solutions of scaling the delivery of mixed static and dynamic content using exceptionally slow TPM hardware. We perform an in-depth empirical analysis of the Spork system within Apache Web servers. This analysis shows Spork can deliver nearly 8,000 static or over 7,000 dynamic integrity-measured Web objects per-second. More broadly, we identify how TPM-based content Web services can scale with manageable overheads and deliver integrity-measured content with manageable overhead.

Published in:

Computer Security Applications Conference, 2009. ACSAC '09. Annual

Date of Conference:

7-11 Dec. 2009