Proposed HTTPA Protocol (HTTPS Attestable) Uses TEEs to Secure the Web

guest · Oct 24, 2021

Proposed HTTPA Protocol Uses TEEs to Secure the Web
Intel researchers describe how Trusted Execution Environments can enhance HTTPS and boost Web security.
October 20, 2021
https://www.darkreading.com/emerging-tech/proposed-httpa-protocol-uses-tees-to-secure-web

While HTTPS is becoming the default online protocol for providing a fast and secure connection for websites and applications, there is still room for improvement. The HTTPA protocol is intended to enhance online security by running code in trusted execution environments (TEEs).

Intel software engineer Gordon King and Intel Labs research scientist Hans Wang outlined the proposed protocol – HTTPS-Attestable (HTTPA) – in a paper distributed this month through ArXiv.
Click to expand...

A TEE refers to enclaves in memory where sensitive computations can be run on sensitive details. Both Intel and ARM offer hardware-based TEEs: the Intel Software Guard Extension (Intel SGX) and TrustZone. Wang and King note in the paper that SGX provides in-memory encryption to help protect the runtime computation and reduce risks of illegal leaking or modifying private information.

"SGX also provides security assurances via remote attestation to the web client, including TCB identity, vendor identity and verification identity," the paper says.
Click to expand...

The idea behind HTTPA is that Web services can be more secure by carrying out computations in remote TEEs and giving clients a way to verify this was done.

"We propose a general solution to standardize attestation over HTTPS and establish multiple trusted connections to protect and manage requested data for selected HTTP domains," King and Wang state in the paper.
"Also, our solution leverages the current HTTPS protocol, so it does not introduce much complexity as other approaches."
Click to expand...

arXiv: HTTPA: HTTPS Attestable Protocol

Hypertext Transfer Protocol Secure (HTTPS) protocol has become integral part of the modern internet technology. It is currently the primary protocol for commercialized web applications. It can provide a fast, secure connection with a certain level of privacy and integrity, and it has become a basic assumption on most web services on the internet.

However, HTTPS cannot provide security assurances on the request data in compute, so the computing environment remains uncertain risks and vulnerabilities. A hardware-based trusted execution environment (TEE) such as Intel Software Guard Extension (SGX) provides in-memory encryption to help protect the runtime computation to reduce risks of illegal leaking or modifying private information.
Click to expand...

Log in or Sign up

Proposed HTTPA Protocol (HTTPS Attestable) Uses TEEs to Secure the Web

guest Guest

Log in or Sign up

Proposed HTTPA Protocol (HTTPS Attestable) Uses TEEs to Secure the Web

guest Guest

Useful Searches