APEX

APEX is a protocol for delegating access to data which is end-to-end encrypted.

See our research paper for details, with additional proofs in the long version.

Demonstration

Our APEX demo consists of two web applications:

To try out the applications yourself, simply click the links above.

Additionally, we have produced an Android app to showcase APEX cross-device flows. This is not currently available to try online, however you may wish to see the source code.

Directions

We have provided some suggested steps you may wish to try to test the full functionality of the demo.

Link accounts

In the Cloud Drive app:

  1. Create a new account by clicking Sign up.
  2. You will be taken to the login page. Enter your new credentials and click Login.

In the Cloud Notes app:

  1. Create a new account by clicking Sign up.
  2. You will be taken to the login page. Enter your new credentials and click Login.
  3. Click the Link to MyDrive button.
  4. Copy the one-time-code (OTC) that is shown. Click Continue.
  5. Click the Open Provider Agent button. (You may need to allow pop-ups.)
  6. Click Authorize to grant access to cloud-notes.anon.science.
  7. You will be prompted for the OTC. Paste it in the text field and press Continue.

This demonstrates how authorisation is delegated using OAuth 2.0 and APEX and how consumer–provider agent authentication works using the OTP

Create an unencrypted note

In the Cloud Notes app:

  1. Click the Create new note button.
  2. Enter a name for the note. Click OK.
  3. The note will appear in the left sidebar. Click it to view.
  4. Enter some text in the area on the right. Click the icon in the toolbar to save.
  5. Refresh the page and click the note again to confirm that the contents were saved.

This demonstrates a note being created with plain OAuth 2.0

Create an encrypted note

In the Cloud Notes app:

  1. Click the Create new APEX note button.
  2. Enter a name for the note. Click OK.
    A pop-up window should appear displaying first the consumer agent and then the provider agent. These are scripts which run in browser and encrypt the note on behalf of the user.
    (You may need to allow pop-ups.)
  3. The note will appear in the left sidebar. Click it to view.
    The consumer agent and then the provider agent should appear again to decrypt the note received from Cloud Drive.
  4. Enter some text in the area on the right. Click the icon in the toolbar to save.
    Once again the consumer agent and provider agent appear.
  5. Refresh the page and click the note again to confirm that the contents were saved.

This demonstrates a note being created with OAuth 2.0 extended with APEX

Source code

The source code of our demo implementation is available on GitHub. This can be found in the following two repos:

Performance Metrics

You can see the raw data and code we used to calculate the performance figures given in Section 4 of the paper in this CodePen:  APEX Performance Experiment

advanced steps

You may also obtain your own performance metrics from Cloud Notes by opening Developer Tools in your browser, clicking the Console tab and typing exportTimings()   to get the durations of all retrieval operations performed since page load, or exportSaveTimings()   to get the same for save operations.