{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,21]],"date-time":"2026-07-21T11:34:17Z","timestamp":1784633657635,"version":"3.55.0"},"reference-count":88,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Key Research and Development Plan of China","award":["2017YFB0802100"],"award-info":[{"award-number":["2017YFB0802100"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61772518"],"award-info":[{"award-number":["61772518"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62002011"],"award-info":[{"award-number":["62002011"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002367","name":"Open Project of State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences","doi-asserted-by":"publisher","award":["2020-ZD-05"],"award-info":[{"award-number":["2020-ZD-05"]}],"id":[{"id":"10.13039\/501100002367","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2021]]},"DOI":"10.1109\/tifs.2020.3035265","type":"journal-article","created":{"date-parts":[[2020,11,2]],"date-time":"2020-11-02T20:58:50Z","timestamp":1604350730000},"page":"1380-1395","source":"Crossref","is-referenced-by-count":8,"title":["Locally-Centralized Certificate Validation and its Application in Desktop Virtualization Systems"],"prefix":"10.1109","volume":"16","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5925-1638","authenticated-orcid":false,"given":"Bingyu","family":"Li","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jingqiang","family":"Lin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qiongxiao","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ze","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jiwu","family":"Jing","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-140509"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23456"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23374"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1007\/11533733_16"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-39884-1_28"},{"key":"ref77","first-page":"250","article-title":"Certified lies: Detecting and defeating government interception attacks against SSL","author":"soghoian","year":"2011","journal-title":"Proc 15th FCV"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3287306"},{"key":"ref74","author":"goodwin","year":"2015","journal-title":"Revoking intermediate certificates Introducing OneCRL"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/2856126"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660376"},{"key":"ref78","first-page":"321","article-title":"Perspectives: Improving SSH-style host authentication with multi-path probing","author":"wendlandt","year":"2008","journal-title":"Proc USENIX Annu Tech Conf"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660355"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/LCN.2016.84"},{"key":"ref32","first-page":"605","article-title":"ZMap: Fast Internet-wide scanning and its security applications","author":"durumeric","year":"2013","journal-title":"Proc 22nd USENIX Security Symp"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-30505-9_2"},{"key":"ref30","year":"2018","journal-title":"CRL Performance Monitoring"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/2068816.2068856"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/2523649.2523665"},{"key":"ref35","article-title":"Certificate revocation table: Leveraging locality of reference in Web requests to improve TLS certificate revocation","author":"dickinson","year":"2018"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/2663716.2663759"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/GLOBECOM38437.2019.9014033"},{"key":"ref62","year":"2006","journal-title":"Group Policy Processing and Precedence"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.17487\/rfc5055"},{"key":"ref28","year":"2017","journal-title":"Removing Disabled WoSign and StartCom Certificates From Firefox 58"},{"key":"ref63","first-page":"1","article-title":"Let’s revoke: Scalable global certificate revocation","author":"smith","year":"2020","journal-title":"Proc Symp Network and Distributed System Security"},{"key":"ref27","year":"2017","journal-title":"Blocking Trust for WoSign CA Free SSL Certificate G2"},{"key":"ref64","year":"2015","journal-title":"CRLSets"},{"key":"ref65","first-page":"47","article-title":"An observatory for the SSLiverse","author":"eckersley","year":"2010","journal-title":"Proceedings of the DEFCON"},{"key":"ref29","first-page":"183","article-title":"An end-to-end measurement of certificate revocation in the Web’s PKI","author":"liu","year":"2015","journal-title":"Proc ACM Conf Internet Meas Conf (IMC)"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/2987443.2987462"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/2674005.2675015"},{"key":"ref68","year":"2010","journal-title":"Who’s Your Verisign-Malware Faking Digital Signatures"},{"key":"ref69","author":"zeltser","year":"2018","journal-title":"How Digital Certificates are Used and Misused"},{"key":"ref2","first-page":"307","article-title":"You won’t be needing these any more: On removing unused certificates from trust stores","author":"perl","year":"2014","journal-title":"Proc Int Conf Financial Cryptograph Data Secur"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.17487\/rfc5280"},{"key":"ref20","year":"2017","journal-title":"Microsoft trusted root certificate program Participants"},{"key":"ref22","year":"2017","journal-title":"Lists of available trusted root certificates in macOS"},{"key":"ref21","year":"2018","journal-title":"Mozilla Included CA Certificate List"},{"key":"ref24","article-title":"Further improving digital certificate security","author":"langley","year":"2013"},{"key":"ref23","article-title":"Sustaining digital certificate security","author":"sleevi","year":"2015"},{"key":"ref26","year":"2017","journal-title":"Microsoft to Remove WoSign and StartCom Certificates in Windows 10"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/2590296.2590341"},{"key":"ref50","first-page":"1","article-title":"Taming hosted hypervisors with (mostly) deprivileged execution","author":"wu","year":"2013","journal-title":"Proc 22nd NDSS"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23455"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2016.91"},{"key":"ref58","first-page":"609","article-title":"TrustBase: An architecture to repair and strengthen certificate-based authentication","author":"o\u2019neill","year":"2017","journal-title":"Proc 26th USENIX Security Symp"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516655"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660338"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/1400097.1400108"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/1866835.1866843"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/CLOUD.2016.0085"},{"key":"ref52","article-title":"Security recommendations for hypervisor deployment","author":"chandramouli","year":"2014"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.17"},{"key":"ref40","first-page":"119","article-title":"Preventing and detecting Xen hypervisor subversions","author":"rutkowska","year":"2008","journal-title":"BlackHat Briefings USA"},{"key":"ref11","first-page":"1","article-title":"The case for prefetching and prevalidating TLS server certificates","author":"stark","year":"2012","journal-title":"Proc 19th NDSS"},{"key":"ref12","first-page":"1","article-title":"Towards short-lived certificates","author":"topalovic","year":"2012","journal-title":"Proc 6th Workshop W2SP"},{"key":"ref13","author":"langley","year":"2014","journal-title":"No Don’t Enable Revocation Checking"},{"key":"ref14","author":"langley","year":"2014","journal-title":"Revocation Still Doesn’t Work"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2016.7860493"},{"key":"ref16","year":"2018","journal-title":"A More Powerful and Flexible Open Source Virtualization Solution"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382204"},{"key":"ref17","year":"2018","journal-title":"KVM Kernel-based Virtual Machine"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382205"},{"key":"ref18","year":"2018","journal-title":"The Fast! processor emulator"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23205"},{"key":"ref19","year":"2018","journal-title":"The Security Platform Which Finds and Analyzes Every Device Connected to the Internet"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.38"},{"key":"ref80","first-page":"246","article-title":"Elaphurus: Ensemble defense against fraudulent certificates in TLS","author":"li","year":"2019","journal-title":"Proc Int Conf Inf Security Cryptol"},{"key":"ref4","author":"wilson","year":"2015","journal-title":"Distrusting-new-cnnic-certificates"},{"key":"ref3","year":"2011","journal-title":"Security incident report"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/2504730.2504755"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/2987443.2987454"},{"key":"ref8","first-page":"257","article-title":"Alice in warningland: A large-scale field study of browser security warning effectiveness","author":"akhawe","year":"2013","journal-title":"Proc 22nd USENIX Security Symp"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.15"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/2168836.2168850"},{"key":"ref86","first-page":"1339","article-title":"I have no idea what I’m doing—On the usability of deploying HTTPS","author":"krombholz","year":"2017","journal-title":"Proc 26th USENIX Security Symp"},{"key":"ref7","first-page":"399","article-title":"Crying wolf: An empirical study of SSL warning effectiveness","author":"sunshine","year":"2009","journal-title":"Proc 18th USENIX Secur Symp"},{"key":"ref87","first-page":"1","article-title":"The inconvenient truth about Web certificates","author":"vratonjic","year":"2011","journal-title":"Proc of Workshop on Economics of Inf Security"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.17487\/rfc6066"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23055"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.4304\/jcp.9.10.2303-2314"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2046754"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-31540-4_23"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/2168836.2168851"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866313"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-15512-3_9"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/SERE-C.2013.20"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.30"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10206\/9151439\/09246549.pdf?arnumber=9246549","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,5,10]],"date-time":"2022-05-10T14:52:34Z","timestamp":1652194354000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9246549\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"references-count":88,"URL":"https:\/\/doi.org\/10.1109\/tifs.2020.3035265","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021]]}}}