甲斐　賢 （ カイ　サトシ ）

Kai, Satoshi

写真a

所属（所属キャンパス）

研究所・センター等 グローバルリサーチインスティテュート （ 三田 ）

職名

特任准教授（有期）
このページの先頭へ▲
 

論文 【 表示 ／ 非表示 】

  • Using FIDO-based Authentication to Improve the Security of Software Supply Chains

    Luke K., Mayes K., Kondo T., Kai S., Tezuka S.

    Journal of Information Processing 33   708 - 722 2025年

    　概要を見る

    Software supply chain security has relied upon layered protective measures, such as fuzzing, code signing, and secure coding, to protect against unintentional vulnerabilities and intentional tampering. Regrettably, attacks, such as Solar Winds and Log4Shell zero-day, demonstrated that current protections are insufficient. As a result, several projects have emerged, aimed at providing rigorous protections, focusing largely on dependency management, code signing, and binary file tracking. A common approach adds developer identity within the code signing ecosystem, establishing a chain of trust between developers and code-signing keys. However, these solutions depend upon external identity providers performing authentication correctly, leaving potential for account hijacking and other identity-based attacks. Mitigation is offered via monitoring and auditing, but relies on other parties to actively monitor for anomalies. In this paper, we propose and evaluate a FIDO-based extension to the Sigstore system, which would embed authentication data into the signing process, providing end-users with added identity assurance, complementing Sigstore’s key-to-identity mapping. By providing attestation information to increase authentication strength, we can potentially issue longer lifetime developer certificates, reducing the overall number, for a more scalable system. We also perform a basic evaluation to demonstrate that our improvements can be implemented feasibly with minimal changes to Sigstore.

  • International Mutual Recognition: A Description of Trust Services in US, UK, EU and JP and the Testbed “Hakoniwa”

    Kai S., Kondo T., Karimi N., Mersinas K., Sel M., Yus R., Tezuka S.

    Proceedings of the International Conference on Security and Cryptography 1   764 - 771 2023年

    ISSN  21847711

    　概要を見る

    With the proliferation of digital transactions, trust is becoming increasingly important, as exemplified by the World Economic Forum’s Data Free Flow with Trust. Digital signatures are utilized to establish trust to prevent spoofing and unauthorized modification of transmitted digital data. However, the extent of trust is limited by jurisdictions, trusted lists and bridge certificate authorities, and does not have international coverage. For this reason, mutual recognition is needed, i.e. trust relationships established across countries. Establishing mutual recognition is complex and time-demanding due to the legislations, systems, and technologies involved. In parallel, electronic signatures consist of complex systems and structures and, thus, focusing on the technical requirements and solutions can enhance mutual recognition processes. The purpose of our approach is to develop a testbed that can verify technical aspects of mutual recognition. This paper describes the concept of the testbed “Hakoniwa” which includes analyzing the requirements, simulating and testing mutual recognition trust services across US, UK, EU and JP.

  • Using secret sharing to improve FIDO attack resistance for multi-device credentials

    Luke K., Kondo T., Kai S., Mayes K., Tezuka S.

    Proceedings 2023 8th International Conference on Information and Network Technologies Icint 2023    49 - 56 2023年

    　概要を見る

    Public key cryptography-based authentication methods such as FIDO/WebAuthn can provide a number of security improvements over passwords. However, the need to register every device the user wishes to use reduces its usability for consumer applications. In 2022, the FIDO Alliance introduced a multi-device credential model, which claims to offer numerous convenience and usability enhancements for end users; however, the fact that the WebAuthn credential can leave the protection of a hardware security module undermines the security guarantees previously provided by the FIDO/WebAuthn framework. This limits FIDO's usefulness for applications which require more rigorous protection. Furthermore, FIDO does not specify key management aspects, instead, end users and relying parties are left responsible for credential management. These trade-offs force a difficult compromise between overall security and convenience. In this paper, we propose a protocol for a split-key FIDO mechanism, in which each user device maintains a portion of the user's credential instead of a fully-usable private key. By proving access to multiple devices, the user can use a cloud provider to reassemble their private key in an HSM-protected environment, then use the cloud provider to authenticate on their behalf. Service providers can preserve many of the benefits of multi-device credentials, while still providing relatively strong private key protections. In addition, our proposal adds a key management overlay to the existing FIDO/WebAuthn framework. Our approach uses a user's existing cloud provider to reduce access to a user's private key, thus reducing the potential for credential theft, even if one of the user's devices is fully compromised.

このページの先頭へ▲
 

担当授業科目 【 表示 ／ 非表示 】

  • データセキュリティ

    2026年度

このページの先頭へ▲