Certificate Revocation List Distribution Research Articles

IMF-PR: An Improved Morton-Filter-Based Pseudonym-Revocation Scheme in VANETs.

Vehicle ad hoc networks (VANETs) are special wireless networks which help vehicles to obtain continuous and stable communication. Pseudonym revocation, as a vital security mechanism, is able to protect legal vehicles in VANETs. However, existing pseudonym-revocation schemes suffer from the issues of low certificate revocation list (CRL) generation and update efficiency, along with high CRL storage and transmission costs. In order to solve the above issues, this paper proposes an improved Morton-filter-based pseudonym-revocation scheme for VANETs (IMF-PR). IMF-PR establishes a new distributed CRL management mechanism to maintain a low CRL distribution transmission delay. In addition, IMF-PR improves the Morton filter to optimize the CRL management mechanism so as to improve CRL generation and update efficiency and reduce the CRL storage overhead. Moreover, CRLs in IMF-PR store illegal vehicle information based on an improved Morton filter data structure to improve the compress ratio and the query efficiency. Performance analysis and simulation experiments showed that IMF-PR can effectively reduce storage by increasing the compression gain and reducing transmission delay. In addition, IMF-PR can also greatly improve the lookup and update throughput on CRLs.

Scalable & Resilient Vehicle-Centric Certificate Revocation List Distribution in Vehicular Communication Systems

In spite of progress in securing Vehicular Communication (VC) systems, there is no consensus on how to distribute Certificate Revocation Lists (CRLs). The main challenges lie exactly in (i) crafting an efficient and timely distribution of CRLs for numerous anonymous credentials, pseudonyms, (ii) maintaining strong privacy for vehicles prior to revocation events, even with honest-but-curious system entities, (iii) and catering to computation and communication constraints of on-board units with intermittent connectivity to the infrastructure. Relying on peers to distribute the CRLs is a double-edged sword: abusive peers could "pollute" the process, thus degrading the timely CRLs distribution. In this paper, we propose a vehicle-centric solution that addresses all these challenges and thus closes a gap in the literature. Our scheme radically reduces CRL distribution overhead: each vehicle receives CRLs corresponding only to its region of operation and its actual trip duration. Moreover, a "fingerprint" of CRL 'pieces' is attached to a subset of (verifiable) pseudonyms for fast CRL 'piece' validation (while mitigating resource depletion attacks abusing the CRL distribution). Our experimental evaluation shows that our scheme is efficient, scalable, dependable, and practical: with no more than 25 KB/s of traffic load, the latest CRL can be delivered to 95% of the vehicles in a region (15 x 15 KM) within 15s, i.e., more than 40 times faster than the state-of-the-art. Overall, our scheme is a comprehensive solution that complements standards and can catalyze the deployment of secure and privacy-protecting VC systems.

A Privacy-Preserving Authentication and Pseudonym Revocation Scheme for VANETs

With the development of Intelligent Transportation Systems (ITS), Vehicular Ad hoc Networks (VANETs) have become a research hotspot in recent years. However, the vehicle communication system is vulnerable, resulting in threats to the privacy of users. This paper proposes a secure and efficient identity-based anonymous authentication scheme and uses pseudonyms to enhance the privacy protection of vehicle users. By improving the existing vehicle public key infrastructure and introducing Bloom filter to compress the Certificate Revocation List (CRL), the efficient pseudonym revocation scheme is then presented under the premise of ensuring user privacy. This scheme is able to perform batch pseudonym revocation and keep the pseudonym unlinkable. The security analysis shows that the proposed scheme is able to meet the security and privacy requirements in VANETs and CRL distribution.

Misbehavior detection and efficient revocation within VANET

Trustworthy communication in VANET Network is essential to provide functional, efficient and reliable traffic safety applications. The main concern arises on how to maintain only the trustworthy participants and revoke the misbehaving ones. In this paper, we propose a new framework for the certificate revocation process within VANET. This process can be activated by the Misbehavior Detection Systems (MDSs) running within vehicles and the Misbehavior Authority (MA) within the infrastructure, which identifies and excludes misbehaving vehicles to guarantee the long-term functionality of the network. These MDSs rely on the trust evaluation for participating vehicles which is updated continuously based on their behaviors. Therefore, the revocation is done periodically through geographical Certificate Revocation List (CRL) which specifies the certificates of all revoked vehicles within a specific area. This results in a lightweight solution for CRL management and distribution within a modular and secure infrastructure based on Public Key Infrastructure (PKI), group formation and trust evaluation. Simulation scenarios and risk analysis were carried out showing the advantages of the proposed revocation framework.

Efficient certificate revocation management schemes for IoT-based advanced metering infrastructures in smart cities

Advanced Metering Infrastructure (AMI), which refers to the communication network for the collection of power data from smart meters in a Smart Grid, is expected to be used in the service of many Smart City applications such as gas and water data collection or electric vehicle charging. As the communication within the AMI needs to be secure to protect user’s power data, key management becomes a challenge due to its overhead and limited resources on smart meters. While using public-keys eliminate some of the overhead of key management as opposed to symmetric-key management, there are still challenges regarding the management of certificates that store and certify the public-keys. In particular, distribution and storage of certificate revocation list (CRL) is major a challenge due to cost of distribution and storage in AMI networks which is envisioned to utilize wireless mesh networks. Motivated by the need of keeping the CRL distribution and storage cost effective and scalable, in this paper, we present a distributed CRL management scheme by utilizing distributed hash trees (DHTs) that have been heavily employed in peer-to-peer (P2P) networks. The basic idea is to share the burden of storage of CRLs among all the smart meters by exploiting the convenient wireless communication capability of the smart meters among each other. Using DHTs not only reduces the space requirements for CRLs but also makes the CRL updates more convenient. We implemented DHT-based CRL structure both on ns-3 and testbed using IEEE 802.11s mesh standard as a model for AMI and demonstrated its superior performance with respect to traditional methods of CRL management through extensive simulations.

Up-to-date key retrieval for information centric networking

Information Centric Networking (ICN) leverages in-network caching to provide efficient data distribution and better performance by replicating contents in multiple nodes to bring content nearer the users. Since contents are stored and replicated into node caches, the content validity must be assured end-to-end. Each content object carries a digital signature to provide a proof of its integrity, authenticity, and provenance. However, the use of digital signatures requires a key management infrastructure to manage the key life cycle. To perform a proper signature verification, a node needs to know whether the signing key is valid or it has been revoked. This paper discusses how to retrieve up-to-date signing keys in the ICN scenario. In the usual public key infrastructure, the Certificate Revocation Lists (CRL) or the Online Certificate Status Protocol (OCSP) enable applications to obtain the revocation status of a certificate. However, the push-based distribution of Certificate Revocation Lists and the request/response paradigm of Online Certificate Status Protocol should be fit in the mechanism of named-data. We consider three possible approaches to distribute up-to-date keys in a similar way to the current CRL and OCSP. Then, we suggest a fourth protocol leveraging a set of distributed notaries, which naturally fits the ICN scenario. Finally, we evaluate the number and size of exchanged messages of each solution, and then we compare the methods considering the perceived latency by the end nodes and the throughput on the network links.

A Regional Certificate Revocation List Distribution Method based on the Local Vehicle Location Registration for Vehicular Communications

A certificate revocation list(CRL) should be distributed quickly to all the vehicles in the network to protect them from malicious users and malfunctioning equipments as well as to increase the overall security and safety of vehicular networks. However, a major challenge is how to distribute CRLs efficiently. In this paper, we propose a novel Regional CRL distribution method based on the vehicle location registration locally to manage vehicle mobility. The method makes Regional CRLs based on the vehicles` location and distributes them, which can reduce CRL size and distribution time efficiently. According to the simulation results, the proposed method`s signaling performance of vehicle`s registration is enhanced from 22% to 37% compared to the existing Regional CRL distribution method. It`s CRL distribution time is also decreased from 37% to 67% compared to the existing Full CRL distribution method.

Certificate Revocation Scheme using MOT Protocol over T-DMB Infrastructure

A Certificate Revocation List(CRL) should be distributed quickly to all the vehicles for vehicular communications to protect them from malicious users and malfunctioning equipment as well as to increase the overall security and safety of vehicular networks. Thus, a major challenge in vehicular networks is how to efficiently distribute CRLs. This paper proposes a Multimedia Object Transfer(MOT) protocol based on CRL distribution scheme over T-DMB infrastructure. To complete the proposed scheme, a handoff method, CRL encoding rules based on the MOT protocol, and relative comparison are presented. The scheme can broaden breadth of network coverage and can get real-time delivery with enhanced transmission reliability. Even if road side units are sparsely deployed or, even not deployed, vehicles can obtain recent CRLs from T-DMB infrastructure effectively.

Measuring the performance of movement‐assisted certificate revocation list distribution in VANET

AbstractVehicular Ad hoc Network (VANET) emerges as a promising technology and has chances of very likely to be deployed in the coming years. The security of vehicular networks will be an important way to facilitate road safety. In this paper, we are concerned with the problem of effective and efficient distribution of the certificate revocation units (RSUs) in vehicular networks. We propose a novel distributed approach by introducing mobile nodes that have public safety. An optimal route for mobile nodes is designed to cover blind areas under both delay and cost constraints. The performances of the movement‐assisted approach are measured and evaluated by extensive experiments in large scale networks for Certificate Revocation List (CRL) distribution in VANET. The results show that the proposed movement‐assisted approach obviously improves the performance. Copyright © 2009 John Wiley & Sons, Ltd.

Efficient Certificate Revocation List Organization and Distribution

In this paper, we propose a lightweight mechanism for revoking security certificates that is appropriate for the limited bandwidth and hardware cost constraints of a VANET. A Certificate Authority (CA) issues certificates to trusted nodes, i.e., vehicles. If the CA looses trust in a vehicle (e.g., due to evidence of malfunction or malicious behavior), the CA must promptly revoke the certificates of the distrusted vehicle. To distribute revocation information quickly even during incremental deployment, we propose that CAs use Certificate Revocation Lists (CRLs). The CRL should be composed in a secure manner, and it should be exchanged in a way such that the CRL is both quickly and widely distributed. We previously proposed a mechanism for the quick distribution of CRL updates that also covers a wide area by using vehicle-to-vehicle (V2V) communication . In this paper, we additionally investigate the performance of V2V communication in partial deployment scenarios, that is, where only a certain percentage of vehicles are equipped with VANET radios. We provide simulation results that show our V2V exchange mechanism is quicker than distributing CRLs or CRL updates through road-side units (RSUs) alone. However, this revocation process, which involves both the CA and vehicles, must conform to the aforementioned bandwidth and hardware restrictions. In this paper, we present mechanisms that achieve the goals of reduced CRL size, a computationally efficient mechanism for determining if a certificate is on the CRL, and a lightweight mechanism for exchanging CRL updates. Additionally, we expand on our previous work to provide privacy to revoked vehicles prior to their revocation.