Most of us use the internet regularly to exchange sensitive data—be it to make online payments or to send confidential emails. But the security measures and technologies we currently depend upon are vulnerable to attack: cybercrime has risen dramatically and users are losing faith in digital data exchange. With their new Cyber Trust project, IT professors from ETH Zurich and the University of Bonn are aiming to develop security systems that are one hundred percent trustworthy.

Although digital technologies make our everyday lives more efficient, they also demand a great deal of faith from users: we place our trust in the card-reader at the supermarket, in the electronic forms of government authorities and in payment systems for online shopping and e-banking. In the physical world, we usually learn from experience whom we can trust and under what circumstances. But it is difficult to rely on these instincts when we use the internet. Indeed, between 2011 and 2016, reports of cybercrime in Switzerland increased from 5 330 to 14 033. Digitisation has also changed the face of crime itself: the methods of cybercriminals are growing ever more sophisticated and their scope greater—hackers can now target a large number of potential victims in one fell swoop.

Deception and fraud

Scammers are continually developing new methods to gain fraudulent access to money or valuable data. A common scheme is to trick users into entering their login data for accounts on authentic-looking websites or into responding to fake emails. In addition to such “phishing” attempts, there are also attacks via malware that, for instance, aim to intercept data moving between a bank and its clients. Indeed, all it takes is a visit to a dubious website for spyware to be installed on a user’s computer; the hackers then try to access the data they need to build an identity.

In certificates we trust

But in what exactly do we place our trust when we receive—and pay—an e-bill from our phone company? The name of the company on the bill? The fact that we have a contract with the company? This makes sense on the surface level, but whether or not we are aware of it, what we are counting on is our phone company using reliable encryption technology. For data to be transferred securely online, they must first be digitally signed and then verified using a system of keys administered by what is known as the public key infrastructure. A public key is allocated to a specific person or internet address via a digital certificate issued by one of the 1 400 certificate authorities located throughout the world; certificate authorities certify the key allocation via their own digital signature. In practice, web browsers such as Safari and Internet Explorer have pre-set lists of such certificates—and they rely on receiving trustworthy authentications from the certificate authorities.

No security guarantees

This system was developed in the early days of the internet and no longer meets today’s online security needs. One fundamental problem is that it takes only one compromised certificate authority to undermine the security of the entire internet—if a computer system is infiltrated and stored data are manipulated, online security is no longer guaranteed. Indeed, hacked certificates are no rarity: big-name firms such as Microsoft, Yahoo, Skype, Mozilla and Google have all been affected, and in 2013, the US National Security Agency used hacked certificates to pose as Google and spy on American citizens. Even if we see a padlock symbol in our browser window when doing banking online, there is still no guarantee that we are actually on the website of our bank.

Benefiting from relationships of trust

The major questions in internet security today revolve around identity and authenticity. In order to address these problems in the transfer of sensitive data, IT professors David Basin, Peter Müller and Adrian Perrig from ETH Zurich and Matthew Smith from the University of Bonn have developed a novel approach: trusted relationships from the physical world should be transferred to the digital world. In other words, digital communications should be secured in advance through physical, trust-based relationships that clearly verify the identity of the person sending confidential information. In future exchanges, users can then be certain that they really are accessing the actual website of their bank or that the recommended software updates are, for instance, truly from Microsoft. Conversely, these secured digital trust-based relationships can also be used to secure physical communication—for example to verify that a letter was actually sent from the purported bank and not a scammer.

Potential scenarios

The IT professors at the Centre for Cyber Trust are currently working on various scenarios that involve transferring established trust-based relationships from the physical world to the digital realm.

Scenario 1: A tax advisor and her client want to be sure of each other’s identity when they exchange confidential emails. At their first meeting, they simulate a “handshake” with their mobile phones to exchange a cryptographic key for their future digital correspondence. All they need for this is an app.

Scenario 2: A bank wishing to protect its clients from phishing attacks sends emails that are signed with a digital certificate. Wherever possible, the clients trust only certificates from Switzerland, meaning that trust is based on geographic information.

Scenario 3: A client wants to check whether the physical mail he receives from his bank is authentic. He visits his branch in person and photographs a code that provides him with a cryptographic key. When he later receives a letter from the bank, he uses the key to read the QR code on the letter and verify its source.

The coming years will tell which of these paths is best suited to establishing one hundred percent security in the exchange of digital data.

Text: Sabine Witt
Photos: Frank Brüderli