论文标题
仙人掌：通过客户端T恤集成避免验证码
CACTI: Captcha Avoidance via Client-side TEE Integration
论文作者
论文摘要
随着虐待活动的数量和多样性的增长，防止通过机器人滥用Web服务是一个越来越重要的问题。验证码是挫败机器人活动的最常见方法。但是，他们通常对机器人无效，对人类感到沮丧。此外，最近的一些验证码技术降低了用户隐私。同时，客户端受信任的执行环境（TEE）变得越来越普遍（尤其是ARM Trustzone和Intel SGX），从而使客户端硬件的一小部分（信任锚或TCB）建立了信任。这提示了一个问题：TEE可以帮助减少（或完全消除）求解验证验的用户负担吗？ 在本文中，我们通过客户端T恤集成设计了仙人掌：避免验证码。仙人掌使用客户端的TEE，允许合法的客户生成不可原谅的速率，以证明他们执行了特定操作的频率。这些防费用可以将其发送到网络服务器，以代替解决验证码。仙人掌提供强大的客户隐私保证，因为该信息仅发送到访问的网站并使用组签名方案进行认证。我们的评估表明，产生和验证仙人掌率的总体延迟小于0.25秒，而仙人掌的带宽开销比当前的码头系统低98％以上。
Preventing abuse of web services by bots is an increasingly important problem, as abusive activities grow in both volume and variety. CAPTCHAs are the most common way for thwarting bot activities. However, they are often ineffective against bots and frustrating for humans. In addition, some recent CAPTCHA techniques diminish user privacy. Meanwhile, client-side Trusted Execution Environments (TEEs) are becoming increasingly widespread (notably, ARM TrustZone and Intel SGX), allowing establishment of trust in a small part (trust anchor or TCB) of client-side hardware. This prompts the question: can a TEE help reduce (or remove entirely) user burden of solving CAPTCHAs? In this paper, we design CACTI: CAPTCHA Avoidance via Client-side TEE Integration. Using client-side TEEs, CACTI allows legitimate clients to generate unforgeable rate-proofs demonstrating how frequently they have performed specific actions. These rate-proofs can be sent to web servers in lieu of solving CAPTCHAs. CACTI provides strong client privacy guarantees, since the information is only sent to the visited website and authenticated using a group signature scheme. Our evaluations show that overall latency of generating and verifying a CACTI rate-proof is less than 0.25 sec, while CACTI's bandwidth overhead is over 98% lower than that of current CAPTCHA systems.
