Certificate Management Research Articles

A Framework for Decentralized Identity and Credential Management Leveraging Blockchain Technology

Abstract: As internet technology rapidly advances and the infrastructure continues to evolve, web applications have become an integral part of our daily lives, with electronic identities (e-identities) playing a crucial role. Today, e-identities are vital for verifying personal identity in numerous online activities, and as our dependence on them grows, so does the concern for their security. This increasing importance of e-identity security raises various challenges, highlighting the need for robust solutions. In response to these challenges, this article introduces a novel solution: a blockchain-based decentralized identity and credential management framework. This approach not only enhances security but also offers greater control and flexibility for users. The article delves into the intricacies of the framework, detailing its design and operational mechanism. Additionally, it explores a range of practical applications, demonstrating the framework's versatility and effectiveness through diverse case studies. This comprehensive examination underscores the framework's potential to revolutionize e-identity management and addresses the pressing need for secure and efficient online identity verification in our increasingly digital world.

Aspects of E-Government Interoperation: Case Study Research for Discovery Beyond Interoperability as Layered Capability

How different public agencies and their digital artifacts work together (often labeled as interoperability) is considered to be an important area for a successful evolution of e-government. Key knowledge in this area is the structuring into four different layers of interoperability: legal, organizational, semantic, and technical interoperability. This paper challenges this received view of digital interoperation. It does so through an in-depth qualitative case study on the management of digital medical certificates and an inductive and abductive data analysis. Twelve aspects of digital interoperation have emerged through this study. The aspects have been divided into two categories: intrinsic (aspects that directly relate to the digital transfer of information) and extrinsic (aspects that shape different parts of digital interoperation from the outside). Six intrinsic aspects have been identified (relational, performative, semantic, informational, architectural, and technical). These intrinsic categories also have roles as extrinsic. Besides these, there are six more extrinsic aspects (normative, regulative, economic, cognitive, interactive, and temporal). Based on empirical insights and theorizing, the paper argues for a broadening of interoperability as not only the capability to interoperate. A broader notion comprises a mix of organizational, human, and digital pre-conditions for interoperation.

The Role of Digital Technology in Social Interaction of Manembo-Nembo Village Community, Matuari District, Bitung City

The purpose of this study is to determine the role of digital technology in social interaction in the Manembo-Nembo Village, Matuari District, Bitung City using the technological determinism theory approach, believing that technology has a major influence on various aspects of human interaction, especially social and cultural life, as stated by Marshall McLuhan. Using qualitative methods based on observation and interviews by collecting data from purposive sampling, namely determining competent informants, namely 2 community informants, 2 government informants. The results of the study found that the role of digital technology in social interaction has changed according to current circumstances, such as digitalization, such as in families it is easier and faster to interact via digital media with relatives who are in different places, the quality of relationships is maintained by having direct meetings in family groups (arisan), then digital interaction with the community; the creation of virtual togetherness such as people celebrating happy moments virtually by sharing photos, videos, and stories, and sharing information about sad events experienced and becoming a means of digital marketing that can increase family economic income. Digital interaction with the government; in today's public services digitally, especially in the field of population data management (KTP, Family Card, Certificate management) has been done through applications and can be done anywhere, but if there are people who need help, the local government is ready to serve, in accordance with the policy of the Bitung city government to make the Kelurahan Hebat program (digitalization).

A Systematic Review and Multifaceted Analysis of the Integration of Artificial Intelligence and Blockchain: Shaping the Future of Australian Higher Education

This study explores the applications and implications of blockchain technology in the Australian higher education system, focusing on its integration with artificial intelligence (AI). By addressing critical challenges in credential verification, administrative efficiency, and academic integrity, this integration aims to enhance the global competitiveness of Australian higher education institutions. A comprehensive review of 25 recent research papers quantifies the benefits, challenges, and prospects of blockchain adoption in educational settings. Our findings reveal that 52% of the reviewed papers focus on systematic reviews, 28% focus on application-based studies, and 20% combine both approaches. The keyword analysis identified 287 total words, with “blockchain” and “education” as the most prominent themes. This study highlights blockchain’s potential to improve credential management, academic integrity, administrative efficiency, and funding mechanisms in education. However, challenges such as technical implementation (24%), regulatory compliance (32%), environmental concerns (28%), and data security risks (40%) must be addressed to achieve widespread adoption. This study also discusses critical prerequisites for successful blockchain integration, including infrastructure development, staff training, regulatory harmonisation, and the incorporation of AI for personalised learning. Our research concludes that blockchain, when strategically implemented and combined with AI, has the potential to transform the Australian higher education system, significantly enhancing its integrity, efficiency, and global competitiveness.

Enhancing the Vehicular Public Key Infrastructure to Develop Privacy-Preserving Authentication Scheme for Vanet by Using PCM and MSS Scheme

This article proposes a security-based authentication as well as efficient certificate management approach for VANET to detect fraudulent nodes with better precision, less latency and overhead. The primary purpose of the developed system is to establish effectual and heftiness of VANET security that lead to the stability of overall network. VANETs are composed of vehicles and Road Side Units (RSUs) assisting with network management and the vehicles connect with one another and RSUs to furnish roadside information and safety solutions. Security is an essential factor in VANETs because the confidentiality of humans (passengers) is paramount; hence, Vehicular Public Key Infrastructure (VPKI) is utilised to offer authentication and safety services in VANETs. The developed structure provides an encrypted VANET transmission infrastructure by utilising the concepts of Merkle Signature Scheme (MSS) and Pseudo-code Certificate Management (PCM) to minimise overhead for communication and latency while ensuring entity authenticity. Messages are authenticated by sender, encoded with a vehicular public key distributed by a PCM-MSS and decrypted by the destination, resulting in every transmission including a certification from a reliable authority. During that verification, the transmitter and receiver of message’s authentication and validation is accomplished. Simulation findings show that the proposed approach improves the reliability of identifying hostile nodes and PDR while reducing authentication delays and overhead.

Digital Certificate Management for Medical Devices

As the healthcare environment becomes increasingly digitally connected and cyber threats to healthcare technologies evolve, cybersecurity controls are necessary to ensure the safety and effectiveness of medical devices. Digital certificates are one such security control commonly utilized to secure various technologies and systems including medical devices. However, few academic resources describe the use of digital certificates in the unique context of medical devices. Additionally, digital certificate issues have the potential to impact the safety and effectiveness of medical devices and to negatively hinder the delivery of patient care. This article provides an introduction on the role of digital certificates to secure and manage access to medical devices, including potential issues and digital certificate management considerations.

CLLS: Efficient certificateless lattice-based signature in VANETs

The rapid development of Vehicular Ad-hoc Network (VANETs) has improved road safety and traffic management, and brought great convenience to intelligent transportation system (ITS). However, the transmission of data over open channels caused many security issues. Certificateless cryptography solves the certificate management and key escrow problems, which makes it the primary method for message authentication in VANETs. However, with the emergence of quantum computing, traditional cryptography faces a significant challenge. Lattice-based cryptography are regarded as effective post-quantum ciphers. Nevertheless, nearly all existing lattice-based certificateless signature schemes rely on Gaussian sampling or trapdoor techniques, resulting in computational inefficiencies and large key and signature sizes that are impractical for VANETs. To address these issues, we proposed the first efficient algebraic lattice-based certificateless signature scheme in VANETs based on the Dilithium signature algorithm. The security of our certificateless lattice-based signature(CLLS) scheme is based on the MSIS and MLWE hardness assumption, which makes the scheme resistant to quantum attacks and easy to implement. Our scheme did not use Gaussian sampling or trapdoor techniques, which improve the computational and storage efficiency. As a result, the public key of our scheme is 1X smaller than the previous scheme and the size of signature is 2X smaller than the previous efficient algebraic lattice scheme. In addition, compared to the most efficient existing CLLS scheme, the signing and verification computation cost of our scheme are reduced by 20% and 55% respectively and our proposed CLLS scheme has low power consumption. Furthermore, the security of our scheme achieves strong unforgeability against chosen-message attacks(SUF-CMA) in the random oracle model(ROM), which surpasses that of existing lattice-based certificateless signature schemes.

Escrow-free and efficient dynamic anonymous privacy-preserving batch verifiable authentication scheme for VANETs

To enhance road safety, Vehicular Ad-hoc Networks (VANETs) facilitate the exchange of safety-critical messages between smart vehicles and road traffic authorities. However, VANET’s wireless channels are prone to several attacks, such as replay or modification. Therefore, to protect the links, robust authentication and message integrity mechanisms are required. Previously, several robust authentication schemes have been devised. However, those designs often struggle with complex certificate management, the key escrow problem, and the necessity for secure channels to establish user keys. Additionally, prior methods rely on pseudonyms to ensure user privacy. To implement it, several pseudonyms are stored in the vehicle’s device, which burdens the device. To overcome these limitations, this study introduces an efficient and escrow-free dynamic anonymous authentication scheme tailored for VANETs. By utilizing the paradigm of certificate-based cryptography and fuzzy identity generation, the proposed design eliminates the limitations. Through rigorous security analysis, the proposed design’s effectiveness against various threats is demonstrated. Furthermore, a detailed performance analysis, including computational and communication cost comparisons, showcases the scheme’s feasibility for VANET deployment. An NS-3 simulation further confirms the suitability of the proposed scheme for real-world VANET communication scenarios.

Practical two-party SM2 signing using multiplicative-to-additive functionality

Threshold signatures are important tools for addressing issues related to key management, certificate management, and cryptocurrencies. Among them, two-party SM2 signatures have received considerable interest recently. In this paper, we propose a fast and secure online/offline two-party SM2. By employing the re-sharing technique, we have successfully made the online phase of the signing process non-interactive while achieving nearly optimal computational efficiency. Additionally, in the offline phase, there is just a single call to the multiplicative-to-additive functionality based on Paillier encryption. Our protocol is existentially unforgeable under adaptive chosen message attacks in the random oracle model in the presence of a static adversary. Experimental results demonstrate that our proposed scheme outperforms previous similar schemes by approximately a factor of 2 in online computation and a factor of 3 in online communication. Our scheme can be applied in scenarios such as Certificate Authority (CA) and the signing of blockchain transactions to provide them with a more secure and flexible implementation method, enhancing the security and reliability of the systems.

Blockchain-enhanced efficient and anonymous certificateless signature scheme and its application

Although the Internet of Things (IoT) brings efficiency and convenience to various aspects of people’s lives, security and privacy concerns persist as significant challenges. Certificateless Signatures eliminate digital certificate management and key escrow issues and can be well embedded in resource-constrained IoT devices for secure access control. Recently, Ma et al. designed an efficient and pair-free certificateless signature (CLS) scheme for IoT deployment. Unfortunately, We demonstrate that the scheme proposed by Ma et al. is susceptible to signature forgery attacks by Type-II adversaries. That is, a malicious-and-passive key generation center (KGC) can forge a legitimate signature for any message by modifying the system parameters without the user’s secret value. Therefore, their identity authentication scheme designed based on vehicular ad-hoc networks also cannot guarantee the claimed security. To address the security vulnerabilities, we designed a blockchain-enhanced and anonymous CLS scheme and proved its security under the Elliptic curve discrete logarithm (ECDL) hardness assumption. Compared to similar schemes, our enhanced scheme offers notable advantages in computational efficiency and communication overhead, as well as stronger security. In addition, a mutual authentication scheme that satisfies the cross-domain scenario is proposed to facilitate efficient mutual authentication and negotiated session key generation between smart devices and edge servers in different edge networks. Performance evaluation shows that our protocol achieves an effective trade-off between security and compute performance, with better applicability in IoT scenarios.

A certificateless designated verifier sanitizable signature in e-health intelligent mobile communication system

With the widespread use of mobile communication and smart devices in the medical field, mobile healthcare has gained significant attention due to its ability to overcome geographical limitations and provide more efficient and high-quality medical services. In mobile healthcare, various instruments and wearable device data are collected, encrypted, and uploaded to the cloud, accessible to medical professionals, researchers, and insurance companies, among others. However, ensuring the security and privacy of healthcare data in the context of mobile networks has been a highly challenging issue. Certificateless signature schemes allow patients to conceal their respective privacy information for different sharing needs. Nevertheless, existing mobile healthcare data protection solutions suffer from costly certificate management and the inability to restrict signature verifiers. This paper proposes a certificateless designated verifier sanitizable signature for mobile healthcare scenarios, aiming to enhance the security and privacy of mobile healthcare data. This scheme enables the sanitization of sensitive data without the need for certificate management and allows for the specification of signature verifiers. This ensures the confidentiality of medical data, protects patient privacy, and prevents unauthorized access to healthcare data. Through security analysis and experimental comparisons, it is demonstrated that the proposed scheme is both efficient and effectively ensures data security and user privacy. Therefore, it is well-suited for privacy protection in mobile healthcare data.

Certificate-based multi-copy cloud storage auditing supporting data dynamics

With the advent of cloud computing, users are increasingly choosing to store their data on cloud. As a result, data integrity and availability have emerged as key concerns for data owners. Users expect to store multiple copies of their data to cloud and ensure the integrity of these data copies. Currently, numerous multi-copy cloud storage auditing schemes have been proposed. However, most of them depend on public key infrastructure, identity-based cryptography, or certificateless cryptography. These schemes encounter challenges such as complicated certificate management, key escrow, or the necessity for a secure channel for distributing keys, respectively. Furthermore, most of them are not resilient to copy-summation attack. To address the above problems, we propose a certificate-based multi-copy cloud storage auditing scheme supporting data dynamics. We design a novel dynamic structure named Leaves Merkle hash tree (LMHT) to achieve multi-copy dynamic updates. Different from traditional Merkle hash trees, LMHT has significant advantages in data deletion. In addition, the proposed scheme can resist copy-summation attack, in which cloud cannot pass the verification if it only stores summation of all copies without storing data blocks’ all copies. Security analysis and performance evaluation demonstrate that the proposed scheme is secure and efficient.

Post-quantum identity-based traitor tracing

In the distribution of digital content, users may collude and utilize their secret keys to create pirate decoders which enable illegally users to receive the same service. As a useful countermeasure, the notion of identity-based traitor tracing (IBTT) scheme was introduced for the data owner to trace down pirates and simplify certificate management process. As far as we know, various IBTT schemes have been proposed in the literature and all of them are designed on classical hardness assumptions, which are believed to become broken in the coming post-quantum era. To address this issue, we propose the first post-quantum IBTT scheme in this work. The new IBTT scheme is proved to be secure in the quantum security model, assuming the quantum-resistant hardness of the underlying learning with errors problem. Notably, compared with other IBTT schemes, our construction has the minimal size increasing to make the underlying encryption scheme traitor tracing.

Secure pairing-free certificateless aggregate signcryption scheme for IoT

The widespread application of wireless sensor technology in the Internet of Things (IoT) industry significantly enhances productivity. However, the large scale deployment of IoT and the inherent vulnerabilities of wireless communication methods to attacks present significant new challenges. Consequently, there is a need to address the efficiency and security of information transfer in IoT. To effectively solve these issues, this paper presents a secure and efficient pairing-free certificateless aggregated signcryption (CL-ASC) scheme for IoT based on the elliptic curve cryptosystem. Our scheme avoids the complex certificate management issues associated with Public Key Cryptography (PKC) and the key escrow problem found in identity-based cryptography, while maintaining the storage and communication efficiency benefits of aggregated signcryption. The use of secure signcryption and aggregation techniques effectively resists a variety of potential attacks. Both formal and informal security analyses demonstrate that our scheme meets the expected security requirements. Specifically, our scheme shows significant improvements in computational and communication overheads. Compared to other state-of-the-art protocols, our scheme achieves signcryption computation cost of 0.691 ms, unsigncryption computation cost of 3.917 ms for 5 messages, and a total cost of 4.608 ms for 5 messages. Additionally, it provides a signcryption communication overhead of 128 bytes and aggregated communication overhead of 580 bytes for 5 messages.

A Non-Transferable Trade Scheme of Green Power Based on Blockchain

Power consumers can obtain authoritative green environmental value certification through green electricity trading, which plays an important role in improving the production competitiveness of enterprises, especially for international product trade affairs. However, the credibility of green electricity transactions faces serious challenges in the enterprise green authentication affairs, especially the user’s identity authentication, the traceability of green electricity transactions, and the standardization of green electricity transactions. Aiming to solve the certification and traceability problem of tradable green certificates, this paper proposes an integrated green certificate trading protocol, which solves its double-trading problem and helps to improve the credibility of renewable energy use. The main contribution is providing a solution based on the consortium blockchain technology to solve the main challenges mentioned above. The main solved scheme designs a series of protocols, which includes a purchase protocol, payment protocol, and non-transferable protocol. The whole process ensures the credibility, traceability, and non-transferability of green certificate trading. Multiple verification measures are adopted to address security and privacy challenges in green certificate management. Through security analysis, the protocol effectively defends against attacks such as double payments, transaction rollback, and transaction replays while ensuring users’ privacy.

Hybrid Digital Certificate Management System with QR Code and IoT Integrated on Hyperledger Fabric Blockchain

In contemporary society, management of physical documents such as educational certificates, identity proofs, vehicle registrations, and marriage certificates is an integral part of daily life. However, in present online world, there is a pressing need for digital transformation and the management of these documents. One significant challenge associated with this transformation is the susceptibility of original documents to replication or duplication. This vulner- ability is particularly concerning in the case of educational certificates, where fraud is prevalent. Fraudulent activities in the education sector can influence the proliferation of counterfeit educational and skill certificates, posing serious risks to society. For instance, individuals holding fraudulent degrees in professions such as engineering, medicine, law, and pharmacy may lack genuine competence, thereby posing substantial societal harm. To address the issue of certificate oversight and deter forgery, various approaches have been employed. Traditional methods typically involve the use of centralized databases or web servers for certificate storage, which introduces vulnerabilities because they represent single points of failure that leads to forgery and information loss. An optimal solution lies in the adoption of a Blockchain system that leverages a decentralized database structure to enhance data storage capacity and security. Blockchain technology has demonstrated disruptive potential and in- novative capabilities across multiple sectors because of its decentralized, transparent, and secure attributes. Its impact spans various domains, including banking, supply chain management, healthcare, education, and finance. Notably, in the education sector, Blockchain technology holds promise in enhancing security, transparency, and efficiency across different educational processes. In this study, we explore existing Blockchain oriented certificate management systems, critically analyze their limitations, and propose a novel hybrid educational certificate management model. The proposed model integrates Hyperledger Fabric, IoT, and 2D Barcode to develop a robust and secure framework for managing educational certificates.

Multi-Tenant IaaS Cloud Security Evaluation Model

Tenants that rent computer resources to run sophisticated systems might benefit from increased resource flexibility provided by the infrastructure cloud (IaaS) service model. The user will thus be launched into virtual computers after completing the authentication procedure, where they will start the upload process to the cloud.Secure data access is offered by suggested system's implementation of virtual machines and key management.Session management and failed authentication are other key components of suggested solution. All facets of managing active sessions and handling user authentication fall under the purview of authentication and session management. The act of updating an account, changing a password, remembering a password, and other similar operations are examples of credential management functions that can compromise even the most robust authentication schemes.

A Secure Certificate-Based Data Integrity Auditing Protocol with Cloud Service Providers

With the surge in cloud storage popularity, more individuals are choosing to store large amounts of data on remote cloud service providers (CSPs) to save local storage resources. However, users’ primary worries revolve around maintaining data integrity and authenticity. Consequently, several cloud auditing methods have emerged to address these concerns. Many of these approaches rely on traditional public-key cryptography systems or are grounded in identity-based cryptography systems or certificateless cryptography systems. However, they are vulnerable to the increased costs linked with certificate management, key escrow, or the significant expenses of establishing a secure channel, respectively. To counter these limitations, Li et al. introduced a certificate-based cloud auditing protocol (LZ22), notable for its minimal tag generation overhead. Nonetheless, this protocol exhibits certain security vulnerabilities. In this paper, we devise a counterfeiting technique that allows the CSP to produce a counterfeit data block with an identical tag to the original one. Our counterfeiting method boasts a 100% success rate ∀ data block and operates with exceptional efficiency. The counterfeiting process for a single block of 10 kB, 50 kB, and 100 kB takes a maximum of 0.08 s, 0.51 s, and 1.04 s, respectively. By substituting the exponential component of homomorphic verifiable tags (HVTs) with non-public random elements, we formulate a secure certificate-based cloud auditing protocol. In comparison to the LZ22 protocol, the average tag generation overhead of our proposed protocol is reduced by 6.80%, 13.78%, and 8.66% for data sizes of 10 kB, 50 kB, and 100 kB, respectively. However, the auditing overhead of our proposed protocol shows an increase. The average overhead rises by 3.05%, 0.17%, and 0.45% over the LZ22 protocol’s overhead for data sizes of 10 kB, 50 kB, and 100 kB, correspondingly.

Secure personal-health-records searching in edge-based Internet of Medical Things through plaintext checkable encryption

The security of Personal Health Records (PHRs) within the Internet of Medical Things (IoMT) infrastructure is a pressing issue in the healthcare sector. Edge-based IoMT devices like smart wearables and implantables often acquire PHRs. Cloud computing plays a vital role in handling computing and storage tasks for edge-based IoMT devices. However, concerns about trust with cloud servers require the use of encryption, which may complicate the retrieval of encrypted PHRs from the cloud. This paper presents certificateless public key encryption with plaintext-checkable encryption (CL-PKE-PCE). CL-PKE-PCE enables searching for encrypted data using plaintext keywords while eliminating key escrow and certificate management issues. The CL-PKE-PCE scheme facilitates the verification of ciphertexts against plaintexts without the need for decryption, thereby maintaining data privacy. Furthermore, the security of the proposed CL-PKE-PCE scheme has been substantiated under the bilinear Diffie–Hellman assumption. Compared to similar work, it efficiently lowers calculation costs for encryption, decryption, and search algorithms by 63.66%, 51.17%, and 61.62%, respectively. The findings demonstrate that the CL-PKE-PCE is simultaneously secure and efficient, affirming its suitability for edge-based IoMT scenarios.

A robust certificate management system to prevent evil twin attacks in IEEE 802.11 networks

A robust certificate management system to prevent evil twin attacks in IEEE 802.11 networks