Based on the researches, usually users are not familiar with diferent security mechanisms of the systems and do not understand how to use them in everyday life. Special research field analyzing user behavior in the technological systems and in computer security world is called human computer interaction (HCI), is also known as usable security. TLS or Transport Layer Security is one of the most commonly used secure protocols today. It is used to protect data that travels between client and server using HTTPS. Data protection is critical issue, especially when users are sending sensitive information. TLS uses cryptographic algorithms to protect data transmitted via HTTPS protocol. In this paper we will ofer balanced and more userfriendly generation process of one of the most frequently used security mechanism on websites Transport Layer Security (TLS) certificate for establishing HTTPS connection between client and server. Our system will check all the requirements of the website and its services to make users run more balanced systems. If system will found another approach with better value based on user requirements, client will be informed in understandable and easy to read form. As a result, user will get the best option for both security and usability sides in shortest period of time
tion, data breaches, phishing and diferent social engineering methods, all these user-oriented attacks are Secure communication is one of the most important very popular today because of not enough knowledge factors in digital world today. Every day users of inter- of the users. This fact is also caused by problems of net are sending and receiving a huge amount of data, usability of some security mechanism. Users cannot the information transmitted through the special chan- understand why and how to use these security models nels also known as protocols. With the grow of inter- in practice. net and networking systems, users tend to share data In this paper, we will ofer balanced and more userincreasingly over communication channels. Nowadays friendly generation process of one of the most frequenthere are many diferent data transfer protocols for dif- tly used security mechanism on websites Transport ferent purposes. For better security level communica- Layer Security (TLS) certificate for establishing HTTPS tion between client (internet browser) and server must connection between client and server. This approach be performed through encrypted protocol – Hypertext will increase usage of TLS certificates by website ownTransfer Protocol Secure (HTTPS). ers, consequently the level of user security on such
In most cases users of the systems are not paying websites will also be improved.
enough attention to their security. Based on the
researches, usually users are not familiar with diferent
security mechanisms of the systems and do not under- 2. Security Agains Usability
stand how to use them in everyday life [
But as we can see on Figure. 1 , that too much of usability in the system might have negative impact on security level. Important factor in this process is to ifnd the balance between security and usability. System must have strong security mechanism, but users must feel comfortable working with it.
Some of security mechanisms implemented to diferent multi-user systems today from point of view of usability are not eficient enough. Together with high level of security, usually such mechanisms are complex and hard to understand for average users of the • Authentication – during the visit of the website client gets a copy of TLS certificate from the server. It happens to ensure that web browser is connected to right website. Data in TLS certificate includes the name of domain and company information. • Integrity – transport layer security ensures the integrity of data. Which means that data must not modified during transition. With strong cryptographic algorithms the hacker is not able to change the content. The information is confirmed through special Message Authentication Code (MAC) also known as tag. • Confidentiality – data confidentiality prevents information from being leaked. It must be very dificult to intercept encrypted information for the hacker.
of TLS certificates. The main diference between paid and free TLS certificates is, that free could be only General purpose certificates also known as Domain Validation certificates (DV) without any support from CA. Another diference between free and paid certificates is validity of TLS. Free certificates usually are issued for 30 – 90 days and the owner of the website must re-generate them manually. But in some cases hosting provides users with auto re-generation service for TLS certificates. Validity period for paid TLS certificates usually is 1-2 years.
account is issuer of certificate. TLS certificates today are issued by diferent trusted organizations called Certification Authorities (CA). Biggest Certification Authorities are Comodo, Symantec, GoDaddy, DigiCert, Trustwave. Technically certificates issued by diferent authorities are similar and using the same security mechanisms during client-server protected communication. The only diference is in support and index of trust. Every modern web browser has special certificate authority built-in database. Once client wants to establish connection with the server, browser checks the authority of TLS certificate installed on concrete website by comparing it to the names in the list.
All types of Transport Layer Security certificates must be installed and well configured on server side. Usually clients are using default settings to configure TLS certificates, which is normal for beginners. After more detailed research we can say, that in some cases clients are using default settings during TLS certificate generation because they have no enough understanding of what is really happening and why it must be done. In Transport Layer Security certificate technology both symmetric and asymmetric cryptography are used.
Asymmetric cryptography is used every time when client is establishing connection with server. RSA cryptographic algorithm is used at the first stage. Once connection is established and special key called session key is transmitted, symmetric cryptography begins the work. In working process of TLS hybrid encryption methods are used, and it is because of two main reasons - security and eficiency. Asymmetric cryptography is more secure due to public key encryption mechanism, but this method has lower speed. To ensure higher speed, on the second stage, when session key is already transmitted, TLS security mechanism uses symmetric cryptography. Instead of using heavy asymmetric cryptography for transmitting data, it is used only once during establishing connection between client and server. It is done to provide secure transmission of session key. User of the website can check the data of TLS certificate used on the website including the information about public key length and used algorithm [9].
On figure 3 we can see that website uses RSA encryption algorithm and length of public key is 2048 Bits, which is standard based on National Institute of Standards and Technology (NIST) recommendations.
Some hosting companies with free certificates included services provide management system to configure TLS manually. Hetzner Online GmbH is hosting provider with diferent data centers located in Germany. For some packages they ofer free TLS certificate generation models right inside the managing panel of the nario. If the website is used only for informational purhosting. Users can manually generate and use certifi- poses we need one balanced security mechanism, but cates provided by Let’s Encrypt Authority X3. Trans- if website holds diferent sensitive information, like port Layer Security certificate generation process for user personal data, it is completely diferent situation such certificates has two stages – issue procedure and and in this case security level must be increased [10]. DNS validation processes. On the first stage to run We already know that with growth of security level, certificate generation process user must define the fol- the usability of the system inevitably decreases. Some lowing: Domain name; DNS validation; TLS certificate user-friendly TLS certificate generation mechanisms name; Common names; Key length; Such certificates are ofered but they still have problems with eficiency. support Domain Name Service (DNS) based validation, From example of Let’s Encrypt TLS certificates generwhich is requires special TXT records in configuration ation process provided by Hetzner Online GmbH we of the hosting. Once information is entered, TLS cer- can learn, that main parameters of certificate configutificate obtaining procedure is starting. ration must be set by user, which could lead to a prob
The system automatically generates self-signed cer- lem of security on the website, especially if the website tificate with parameters entered by user during first is built as online commerce or data exchange platform, stage. Every five minutes the system is trying to get where users are sending and receiving personal data. the certificate. Once the certificate is obtained selfsigned certificate becomes Let’s Encrypt certificate in- 5.2. Security Problems stead and the website is ready to establish secure connection trough HTTPS protocol.
rity mechanisms he will try to not use complicated 5.1. Usability Problems for The Client systems despite their importance. Most security problems in multi user systems are coming from lack of Sometimes Transport Layer Security (TLS) certificates client knowledge. Well- formed and easy to use segeneration process is done by the owners of the web- curity mechanisms will solve a lot of cyber security sites. Wrong configuration of certificate can have neg- problems and will help to avoid diferent user-oriented ative impact on security and eficiency of the website. attacks in real life [11].
User must know each parameter of certificate which will be used for generation process. We think that more eficient way of generating TLS certificate for the website is to make user act based on concrete sce
Based on the researches in cyber security, the most eficient user-oriented security systems are built with high level of usability in mind. While security system is partly or fully managed by the human secure design concepts and methods will have great impact on entire security level of that system [12],[13]. Secure design is aimed on developing strong security mechanism with user-friendly and understandable interface and functionality. The design cycle consists of diferent stages of building the main structure: • Implementation – on this stage technical part of the system must be integrated. All security measures must be considered and diferent scenarios must be analyzed.
• Design – main structure of the system, which is the most important part in human system interaction process. Must be considered diferent factors. Interface must correspond to use cases.
Based on researches in secure design and cyber security mechanisms implementation techniques we created more usable Transport Security Layer (TLS) certificate generation method, which will help owners of diferent web-based systems make secure decision during certificate generation. As generation process of • Requirements – defining the requirements for TLS certificate consist of diferent parameters, we ininteraction with the system. Main direction, tasks cluded most commonly used types of the websites, cerand rules inside the system. tificate authorities and some user data to special web• Analysis – building the conceptual model of en- based form. As we can see on figure 4, form has field tire system based on research and practical anal- for client email, type of the website based on industry, ysis of the requirements. domain name and issuer or certificate authority. After submitting this simple data, system will automatically generate the best balanced option of generation certificate. Full instruction and details will send to email of the user in understandable and easy to read form.
Firstly, the system will check information about the server from domain name provided by the user. For this process an open sources of information will be used. Based on information about services running on the server, system will generate the first part of recommendation for the user, which includes performance and information about optimized services running on the server of website. Afterwards the system will choose optimal length of the key for TLS certificate based on selected category of the website. If category of the website is related to financial operations or transmitting sensitive information like personal information of the users, conversations and file sharing – security level will be improved by increasing the length of generated key [14]. The next step is choos- Figure 4: Web-Based Recommendational Form ing of trusted certificate authority (CA). Prices and services of diferent CAs varies, usually it is based on customer service, support frequency and high trust index of diferent web browsers by default. If chosen by user CA meets all the requirements of concrete usage scenario, the system will approve it. But in the case when system can find more secure and usable way for the user, it will ofer another option together with detailed explanation why suggest version of security and usability mechanisms combination and also selected certificate authority is better for this particular case. The system will check all the requirements of the website and its services to ofer the best and balanced option.
As a result, user will get the best option for both secu- Figure 5: Configuration on Diferent Websites rity and usability sides in shortest period of time. This approach must increase the level of usability of generation correct TLS certificate based on the needs of the content error occurs when the webpage is loaded over user. HTTPS protocol, but some other resources such scripts,
As the ofered system is web-based, we are always graphics or another media are loaded over HTTP inseworking on improvements and making it more com- cure protocol. It this case, both HTTP and HTTPS confortable and easy to use. The main aim of such sys- tent is loaded at the same time. This situation might tems is to make end users and owners of diferent multi be problematic in the case of Man in the middle attack. user web platforms understand importance of security During this attack hacker can eavesdrop on a network mechanisms together with high level of usability. Be- and make some modifications of the trafic. cause any usable system won’t work without good se- In the frame of our research, we shared informacurity level behind it. tion about optimized TLS certificate generation mechanism with diferent organizations. In total information about the system being sent to owners of 100 web7. Work of The System on Pratice sites of diferent industries like sport, news portals, personal blogs of organizations and informational webOnly installation of TLS is not enough to make the sites. In the frame of our work we from 100 websites website work securely. There are diferent factors to TLS certificates was installed and configured correctly take into account while working with TLS certificate only on 45 websites. On 34 websites certificates was configuration. In some cases, users are getting errors not fully configured and on 21websites TLS was not on websites like mixed content. Which means that installed at all. Figure 5 demonstrates the number of certificate is installed but not well-configured. Mixed websites with installed TLS, installed but not well-conifgured TLS and without TLS at all. We collected data [5] S. Garfinkel, H. R. Lipford, Usable security: Hisabout certificates usage on web platforms and divided tory, themes, and challenges, Synthesis Lecresearch process into diferent stages: beginning; after tures on Information Security, Privacy, and Trust ifrst, second and third month. As we can see on Fig- 5 (2014) 1–124. ure 5 after getting information about TLS certificates [6] B. Rothke, Ssl and tls essentials: Securing the installation and correct configuration, security of a lot web, Security Management 44 (2000) 106–106. of website in the frame of our research was increased. [7] G. M. Farinella, C. Napoli, G. Nicotra, S. Riccobene, A context-driven privacy enforcement system for autonomous media capture devices, 8. Conclusions Multimedia Tools and Applications 78 (2019) 14091–14108.
Based on the work performed in the frame of our re- [8] S. Battiato, G. M. Farinella, C. Napoli, G. Nicosearch we can say that well-chosen Transport Layer tra, S. Riccobene, Recognizing context for priSecurity certificate has serious impact on security level vacy preserving of first person vision image seof entire web-based application or website. So, cor- quences, in: International conference on image rect configuration and type of certificate is extremely analysis and processing, Springer, 2017, pp. 580– important for multiuser systems which are using web 590. protocols. The ofered system is developed to improve [9] I. Ristic, Bulletproof ssl and tls: Understanding usability of certificate generation process, consequently and deploying ssl, TLS and PKI to Secure Servers the owners of web-based systems and websites can and Web Applications (2014). easily understand which configuration is needed for [10] S. Mangard, A. Y. Poschmann, Constructive sideparticular scenario. Based on recommendations of the channel analysis and secure design, Lecture system, web-based applications and websites owners Notes in Computer Science 9064 (2015). can perform generation of needed security mechanism [11] A. Gagnidze, M. Iavich, G. Iashvili, Novel version with better understanding. This fact will seriously in- of merkle cryptosystem, Bull. Georg. Natl. Acad. crease the level of security of web-based applications Sci 11 (2017). and websites. [12] R. Baskerville, Information systems security design methods: implications for information sysAcknowledgments tems development, ACM Computing Surveys (CSUR) 25 (1993) 375–414.
The work was conducted as a part of PHDF-19-519 and [13] E. B. Fernandez, A methodology for secure softthe grant financed by Caucasus University. ware design., Software Engineering Research and Practice (2004) 130–136. [14] M. Iavich, A. Gagnidze, G. Iashvili, S. Gnatyuk, References V. Vialkova, Lattice based merkle., IVUS (2019) 13–16.