Certificate Revocation Research Articles

Energy Efficient Clustering for Certificate Revocation Scheme in Mobile Ad-Hoc Network

Mobile ad hoc networks (MANETs) have a wide range of uses because of their dynamic topologies and simplicity of processing. Inferable from the autonomous and dynamic behavior of mobile nodes, the topology of a MANET frequently changes and is inclined to different attacks. So, we present certificate revocation which is an efficient scheme is for security enhancement in MANET. This certificate revocation scheme is used to revoke the certificate of malicious nodes in the network. However, the accuracy and speed of the certificate revocation are further to be improved. By considering these issues along with the energy efficiency of the network, an energy-efficient clustering scheme is presented for certificate revocation in MANET. For cluster head (CH) selection, an opposition based cat swarm optimization algorithm (OCSOA) is proposed. This selected CH participates in quick certificate revocation and also supports to recover the falsely accused nodes in the network. Simulation results show that the performance of the proposed cluster-based certificate revocation outperforms existing voting and non-voting based certificate revocation in terms of delivery ratio, throughput, energy consumption, and network lifetime.

Decentralized Certificate Management for Network Function Virtualisation (NFV) Implementation in Telecommunication Networks

The certificate management complexity and cost increase when PKI technology is leveraged into Network Function Virtualisation (NFV), a significant enabling technology for 5G networks. The expected security of PKI cannot be met due to the unavailability of the certificate revocation inquiry in the telecommunication operator’s core network. This paper analyses the issues and challenges during the NFV implementation and proposes a blockchain‐based decentralized NFV certificate management mechanism. During instantiation, the Virtual Network Functions (VNF) instance generates certificates according to the certificate profile provided in the VNF package. The certificate management unit is responsible for the certificate enrolment, renewal, and revocation. The certificates submitted to the decentralized certificate management system by the instance will be recorded into the ledger after validation and consensus. The experiment and analysis show the transaction throughput, and the transaction delay is noncritical in practice, which could be fulfilled by the proposed mechanism. The certificate inquiry performance is critical, which can be facilitated by the decentralized deployment of inquiry nodes.

Cluster based Certificate Blocking Scheme using Improved False Accusation Algorithm

The aggregation of mobile nodes without the use of a base station is known as Mobile Ad Hoc Networks (MANETS). In nature, the nodes are moving. These networks are not connected and thus subject to security attacks due to their mobility. There are several mechanisms proposed to prevent mishaps while routing of the packets in such networks methods: The methodology outlined in Mobile Ad Hoc Networks to protect against various types of assaults is based on a recent method known as Cooperative Bait Detection Scheme. Its implementation scenario demonstrates that in the event of Sybil assaults, the packet delivery ratio and performance are low. on the network. Our goal is to propose a cluster-based methodology to improve delays, packet delivery ratio, and other performance assessment criteria. Improved Cooperative Bait Detection recommends a disjointed multipath technique to avoid attacks. Until date, the dropped packet delivery ratio has been the key to preventing collaborative and Sybil assaults. In the Hybrid Cooperative Bait Detection Scheme, nodes are verified in two stages: first, on the basis of packet delivery ratio, and then, in the second stage, the exact cause of performance decline is explored to check node behavior. In order to improve security, certifying procedures must be used to clustered networks. For malevolent entities, the false accusation algorithm provided certificate revocation and blocking approaches. An algorithm is proposed that remembers false accusations for a set period of time in order to increase the number of normal nodes in the network and hence improve the system's performance. Results: With the help of NS2 simulation, the clustering approach was evaluated by considering several Sybil-attack network scenarios. When the proposed work is compared to other ways such as Cooperative Bait Detection Scheme, Improve Comparative Bait Detection Scheme, and Hybrid Comparative Bait Detection Scheme, the results show that Packet Delivery Ratio and performance are improved for Sybil attackers over the internet. In conjunction with Certifying authority, the Cluster Head in the network identifies and prevents false complaints. The results of the comparison using several performance parameters reveal that the new strategy outperforms the existing ones. As the number of normal nodes in the system grows, the system will be able to work at its best, preventing various types of attacks.

A New User Revocable Ciphertext-Policy Attribute-Based Encryption with Ciphertext Update

The revocable ciphertext-policy attribute-based encryption (R-CP-ABE) is an extension of ciphertext-policy attribute-based encryption (CP-ABE), which can realize user direct revocation and maintain a short revocation list. However, the revoked users can still decrypt the previously authorized encrypted data with their old key. The R-CP-ABE scheme should provide a mechanism to protect the encrypted data confidentiality by disqualifying the revoked users from accessing the previously encrypted data. Motivated by practical needs, we propose a new user R-CP-ABE scheme that simultaneously supports user direct revocation, short revocation list, and ciphertext update by incorporating the identity-based and time-based revocable technique. The scheme provides a strongly selective security proof under the modified decisional q -parallel bilinear Diffie–Hellman Exponent problem, where “strongly” means that the adversary can query the secret key of a user whose attribute set satisfies the challenge ciphertext access structure and whose identity is in the revocation list.

A scalable and distributed architecture for secure and privacy-preserving authentication and message dissemination in VANETs

With significant advances in the development of autonomous cars and Internet of Things (IoT) in recent years, Vehicular Ad-hoc NETworks (VANETs) have become a promising technology for Intelligent Transportation Systems (ITS) as well. However, the wireless nature of VANET communication makes it vulnerable to a plethora of attack vectors to otherwise secure vehicles. Authenticated message dissemination plays a key role to avert such security vulnerabilities. Many of the existing Public Key Infrastructure (PKI) based schemes use Certificates for authentication. In such schemes, for authenticating an entity which presents its certificate, Certificate Revocation List (CRL) is used to check if the entity’s certificate has been revoked. But, as the size of the CRL grows, using CRL for authentication can incur computation and storage overhead in VANETs. To overcome this limitation of CRL-based approach for authentication, in this paper, we propose a distributed, scalable, low-overhead, privacy-preserving authentication scheme for VANETs. The proposed scheme uses a Merkle Hash Tree (MHT) for authenticating Road Side Units (RSUs) and Modified Merkle Patricia Trie (MMPT) for authenticating vehicles. We also present an informal analysis as well as formal correctness proof of the proposed scheme.

AKC-Based Revocable ABE Schemes from LWE Assumption

The emergence of quantum computing threatens many classical cryptographic schemes, leading to the innovations in public-key cryptography for postquantum cryptography primitives and protocols that resist to quantum attacks. Lattice-based cryptography is considered to be one of the promising mathematical approaches to achieving security resistant to quantum attacks, which could be built on the learning with errors (LWE) problem and its variants. The fundamental building blocks of protocols for public-key encryption (PKE) and key encapsulation mechanism (KEM) submitted to the National Institute of Standards and Technology (NIST) based on LWE and its variants are called key consensus (KC) and asymmetric key consensus (AKC) by Jin et al. They are powerful tools for constructing PKE schemes. In this work, we further demonstrate the power of KC/AKC by proposing two special types of PKE schemes, namely, revocable attribute-based encryption (RABE). To be specific, on the basis of AKC and PKE/KEM protocols submitted to the NIST based on LWE and its variants, combined with full-rank difference, trapdoor on lattices, sampling algorithms, leftover hash lemma, and binary tree structure, we propose two directly revocable ciphertext-policy attribute-based encryption (DR-ABE) schemes from LWE, which support flexible threshold access policies on multivalued attributes, achieving user-level and attribute-level user revocation, respectively. Specifically, the construction of the ciphertext is derived from AKC, and the revocation list is defined and embedded into the ciphertext by the message sender to revoke a user in the user-level revocable scheme or revoke some attributes of a certain user in the attribute-level revocable scheme. We also discuss how to outsource decryption and reduce the workload for the end user. Our schemes proved to be secure in the standard model, assuming the hardness of the LWE problem. The two schemes imply the versatility of KC/AKC.

Locally-Centralized Certificate Validation and its Application in Desktop Virtualization Systems

To validate a certificate, a user needs to install the certificate of the root certification authority (CA) and download the certificate revocation information (CRI). Although operating systems and browsers manage the certificate trust list (CTL) of publicly-trusted root CAs for global users, locally-trusted root CAs still play an important role and it is difficult for a user to manage its CTL properly by itself. Meanwhile, the CRI access is inefficient, sometimes even unavailable, and causes privacy leakage. We revisit these problems by analyzing the TLS sessions within an organization. To the best of our knowledge, we are the first to analyze CTL management and CRI access on the scale of medium-sized organizations. Based on the analysis, a locally-centralized design is proposed to manage the CTLs of all users by IT administrators and access the CRI services for all users, within an organization. We apply this design to desktop virtualization systems to demonstrate its applicability, and build vCertGuard with oVirt and KVM-QEMU. In vCertGuard, the CTLs of all virtual machines (VMs) are managed in the VM monitors (VMMs). In the CTL, the self-signed certificates of publicly-trusted root CAs are properly configured, while each locally-trusted certificate chain is specified one by one. vCertGuard accesses the CRI services for all VMs, and the downloaded CRI is cached and shared among VMs. Because most TLS servers are visited by multiple users of an organization, it reduces the cost of CRI access. Experimental results of the prototype system show that vCertGuard maintains the CTLs with a negligible overhead, and significantly improves the performance of CRI access.

Analysis of the Security of Internet of Multimedia Things

To study the security performance of the Internet of multimedia things on the privacy protection of user identity, behavior trajectory, and preference under the new information technology industry wave, in this study, aiming at the problems of the sharing of Internet of things perception data and the exposure of users’ privacy information, the Anonymous Batch Authentication Scheme (ABAH) for privacy protection is designed. Hash-based Message Authentication Code is used to cancel the list-checking process and analyze its security performance. Compared with the methods of elliptic curve digital signature algorithm, Bayes least-square method, identity-based bulk verification, anonymous batch authentication and key protocol, conditional privacy authentication scheme, and expert message authentication protocol, the transmission delay, packet loss rate, and computation cost are studied without considering the undo list and during the undo check. The results show that with the increase of information size, the transmission delay and packet loss rate also increase, and the transmission delay of ABAH increases by about 15%, while the correlation between speed and transmission delay is small. In the case of the same amount of validation information, ABAH has the highest validation efficiency, and it still has an efficient validation effect in the case of invalid information. The message packet loss rate for ABAH is always 0 when the undo check validation overhead is considered. It can be found that ABAH can avoid the communication overhead and privacy leakage caused by the revocation list, ensure the integrity of batch verification information, meet the security performance of the vehicular ad hoc network under the Internet of Things, and protect the privacy of users from being disclosed.

Revocation in Vehicular Public Key Infrastructures: Balancing privacy and efficiency

Modern vehicular security architectures provision authorized vehicles with multiple short-term pseudonym certificates, so users can avoid tracking by rotating among certificates when signing messages. The large number of certificates in the system, however, makes revocation via Certificate Revocation Lists (CRLs) complex and/or inefficient. Two possible solutions for this issue are: (1) frequently provision non-revoked vehicles with few certificates, as done in the Cooperative Intelligent Transport Systems (C-ITS) standard; or (2) provision many encrypted certificates and periodically broadcast “activation codes” for controlling decryption by non-revoked vehicles, as proposed in Activation Codes for Pseudonym Certificates (ACPC), an extension of the Security Credential Management System (SCMS) standard. In this article, we compare such approaches in terms of computational efficiency and privacy preservation. We show that ACPC has advantages over both C-ITS (e.g., support for distributed caching) and CRLs (e.g., avoiding processing overheads on vehicles). We also discuss how ACPC can benefit from the unicast distribution of activation codes, with different trade-offs between privacy and bandwidth savings: getting as much privacy as C-ITS, but downloading 16-byte codes instead of hundreds of kilobytes, or fixing bandwidth costs (resp. privacy level) for a privacy degradation (resp. bandwidth usage) that grows logarithmically with the number of revocations.

Design and Implementation of a Compressed Certificate Status Protocol

Trust in Secure Sockets Layer–based communications is traditionally provided by Certificate (or Certification) Authorities (CAs) in the form of signed certificates. Checking the validity of a certificate involves three steps: (i) checking its expiration date, (ii) verifying its signature, and (iii) ensuring that it is not revoked. Currently, such certificate revocation checks (i.e., step (iii) above) are done either via Certificate Revocation Lists (CRLs), or Online Certificate Status Protocol (OCSP) servers. Unfortunately, despite the existence of these revocation checks, sophisticated cyber-attackers can still trick web browsers to trust a revoked certificate, believing that it is still valid. Although frequently updated , nonced , and timestamped certificates can reduce the frequency and impact of such cyber-attacks, they add a huge burden to the CAs and OCSP servers. Indeed, CAs and/or OCSP servers need to timestamp and sign on a regular basis all the responses, for every certificate they have issued, resulting in a very high overhead. To mitigate this and provide a solution to the described cyber-attacks, we present CCSP : a new approach to provide timely information regarding the status of certificates, which capitalizes on a newly introduced notion called Signed Collections . In this article, we present in detail the notion of Signed Collections and the complete design, implementation, and evaluation of our approach. Performance evaluation shows that CCSP (i) reduces space requirements by more than an order of magnitude, (ii) lowers the number of signatures required by six orders of magnitude compared to OCSP-based methods, and (iii) adds only a few milliseconds of overhead in the overall user latency.

Intelligent Trust-Based Public-Key Management for IoT by Linking Edge Devices in a Fog Architecture

Due to memory and processing limitations, Internet-of-Things (IoT) devices require external fog servers to perform some of their tasks. However, this offloading of tasks comes at the cost of more interactions whose security cannot be guaranteed without the authentication and key management scheme. Traditional prescriptions, such as those used for securing the Web, require referring to central agents, such as certificate authorities (CA) or online certificate status protocol (OCSP) responders, that sit in the cloud. This poses many challenges, including additional communication costs and repetitive delays which work against the low latency and energy efficiency goals of edge networking. In this article, we propose a novel semidecentralized public-key management scheme for smart IoT systems in which devices intelligently decide whether to look for the keying material locally at the edge or refer to the cloud for this purpose. The result is a security architecture that links IoT devices, fog servers, and cloud, but with minimal dependency on the latter. In the proposed solution, devices work collaboratively to deliver revocation lists and digital certificates of fog servers to each other. The decision to go for edge nodes or cloud CA/OCSP responders is made intelligently by each node upon learning its neighborhood and network statistics. The core idea is based on the Web of trust, but unlike that, whenever a material is not found locally, cloud servers are queried. Experiments show that through this intelligent approach, the cost of key management operations, e.g., delay, can be reduced by up to 50%.

Communication-efficient certificate revocation management for Advanced Metering Infrastructure and IoT Integration

Advanced Metering Infrastructure forms a communication network for the collection of power data from smart meters in Smart Grid. As the communication between smart meters could be secured utilizing public-key cryptography, however, public-key cryptography still has certain challenges in terms of certificate revocation and management particularly related distribution and storage overhead of revoked certificates. To address this challenge, in this paper, we propose a novel revocation management approach by utilizing cryptographic accumulators which reduces the space requirements for revocation information significantly and thus enables efficient distribution of such information to all smart meters. We implemented the proposed approach on both ns-3 network simulator and a testbed. We demonstrated its superior performance with respect to traditional methods for revocation management.

3PAA: A Private PUF Protocol for Anonymous Authentication

Anonymous authentication (AA) schemes are used by an application provider to grant services to its n users for pre-defined k times after they have authenticated themselves anonymously. These privacy-preserving cryptographic schemes are essentially based on the secret key that is embedded in a trusted platform module (TPM). In this work, we propose a private physically unclonable function (PUF) based scheme that overcomes the shortcomings of prior attempts to incorporate PUF for AA schemes. Traditional PUF based authentication protocols have their limitations as they only work based on challenge-response pairs (CRPs) exposed to the verifier, thus violating the principle of anonymity. Here, we ensure that even if the PUF instance is private to the user, it can be used for authentication to the application provider. Besides, no raw CRPs need to be stored in a secure database, thus making it more difficult for an adversary to launch model-building attacks on the deployed PUFs. We reduce the execution time from O(n) to O(1) and storage overhead from O(nk) to O(n) compared to state-of-the-art AA protocols and also dispense the necessity of maintaining a revocation list for the compromised keys. In addition, we provide security proofs of the protocol under Elliptic Curve Diffie-Hellman assumption and decisional uniqueness assumption of a PUF. A prototype of the protocol has been implemented on a Z-Turn board integrated with dual-core ARM CortexA9 processor and Artix-7 FPGA. The resource footprint and performance characterization results show that the proposed scheme is suitable for implementation on resource-constrained platforms.

Ratio Decidendie Judges On The Cancellation Of Certificate Of Land Right That Does Not Remove The Ownership In Kendari State Court (Case Study On Decision No. 62 / Pdt.G / 2012 / PN.Kdi)

This study aims to determine how the Ratio Decidendie judges and legal consequences of the implementation of verdict on cancellation of certificate of ownership that does not remove the right to land ownership in the State Court of Kendari. This study uses the type of normative juridical research using law approach, conceptual approach and the approach the case with premier legal materials, secondary and tertiary material.Based on the studies concluded that the judges verdict in case number 62 / Pdt.G / 2012 / Pn.Kdi confirming ownership of the Plaintiff. Certificate Revocation Proprietary No. 37 / Anduonuhu Village and property rights certificate No. 38 / Anduonuhu Village through Decision Kendari State Administrative Court No. 29 / G / 2010 / PTUN-Kdi flawed due to its publication of juridical / procedural defect. While consideration by the State Court case number 62 / Pdt.G / 2012 / Pn.Kdi explain pedestal of land rights in the form of Decree of the Governor of the Province of South East Celebes Number. 11 / HM / 1979 dated January 16, 1979 not been declared void. So that the Plaintiff's legal rights remain attached. Plaintiffs can reapply for the certificate issued by the applicable legislation.Keywords: Ratio Decidendie; Certificate Revocation Property Rights; Land Rights.

Certificate Revocation Scheme based on the Blockchain for Vehicular Communications

Certificate Revocation Scheme based on the Blockchain for Vehicular Communications

Secure and Efficient Privacy-Preserving Authentication Scheme for 5G Software Defined Vehicular Networks

Vehicular networks provide various applications for vehicles to improve road safety and traffic efficiency as well as infotainment. Security and privacy are of great importance for the deployment of vehicular networks. However, how to efficiently secure vehicular networks with privacy-preserving remains a big challenge. Many solutions have been proposed in the past decade, but most of them either rely too much on the ideal tamper-proofed devices or not being efficient enough for scenarios with high vehicle density. Meanwhile, in recent years, great progresses have been made in both the Long-Term Evolution (LTE) and the fifth-generation (5G) wireless network based vehicular networks. The 5G enabled vehicular networks are envisioned to support higher data transmission rate and a larger number of connected devices than the 802.11p and LTE based networks. Noting the great potential of 5G technology, in this paper we explore a new architecture of 5G software defined vehicular network and propose a secure and efficient privacy preserving authentication scheme for vehicular networks. The proposed scheme uses elliptic-curve public-key cryptography and a registration list to achieve efficient message authentication and to avoid the usage of ever-growing certificate revocation list. The security analysis shows that the proposed scheme has strong security guarantees without using the ideal tamper-proofed devices. Simulation results exhibit that the proposed scheme has ultra low computational overhead and packet loss ratio.

Design an active verification mechanism for certificates revocation in OCSP for internet authentication

No doubt that data security online is crucial. Therefore, great attention has been paid to that aspect by companies and organizations given its economic and social implications. Thus, online certificate status protocol (OCSP) is considered one of the most prominent protocol functioning in this field, which offers a prompt support for certificates online. In this research, a model designed based on field programable gate array (FPGA) using Merkel’s tree has been proposed to overcome the delay that might have occurred in sorting and authentication of certificates. Having adopted this model and with the assistance of Hash function algorithm, more than 50% of certificates have been processed in comparison with standard protocol. Moreover, certificates have been provided with substantial storage space with high throughput. Basically, Hash function algorithm has been designed to arrange and specify a site of verified or denied certificates within time of validity to protect servers from intrusion and clients from using applications with harmful contents.

Enhanced certificate revocation scheme with justification facility in mobile ad-hoc networks

MANETs cover immersed interests owing to their effortlessness in deployment and mobility. Dynamic environments make them defenceless to a variety of protection attacks while compared to static networks. The foremost confront is to assure safe transmission services in which certificate revocation is significant to protect unwanted activities in the network. This paper proposes an Enhanced Certificate Revocation Scheme with Justification Facility (ECRSJF) for certificate revocation to separate attackers from additional participation in network performance. In addition, to enhance the dependability of the methodology, we recuperate cautioned nodes to include in the certificate revocation procedure. To improve the correctness, we suggest a threshold-related method to evaluate and justify cautioned nodes as legal nodes. The overall performance of the ECRSJF scheme is evaluated by simulation. The performance results reveal that the certificate revocation scheme is successful and competent to protected communication in MANETs. The simulation results prove that our projected scheme provides the packet delivery ratio and revocation rate as 91% and 95% respectively. These results are better compared to those of the other existing schemes even in the presence of large number of attacker nodes.

Accountable credential management system for vehicular communication

Social Internet of Vehicles (SIoV) is becoming a reality where private and secure communication is a prerequisite. Various standardization organizations and studies have reached a consensus to use Vehicular Public-key Infrastructure (V-PKI) in order to secure SIoV systems. However, significant security- and trust-related problems remain unsolved. This study presents an Accountable Credential Management System (ACMS) for vehicular communication to solve these problems. ACMS builds on transparency log (Distributed ledger technology) schemes for web PKI but addresses the challenges specific to vehicular communication. ACMS transparently handles certificate-related use cases, namely, certificate provision, registration, validation, and revocation. It also enhances the security of vehicular communication through constant monitoring; hence, assuring that no pseudonym certificate is accepted by vehicles before being logged and witnessed. With an efficient data structure known as the Accumulation Tree (AT), we extend the conventional transparency log to provide a cost-effective and trustworthy authentication process without relying on certificate revocation lists. Time cost and performance analyses show that the proposed approach is feasible and scalable than existing V-PKI schemes. Moreover, using Tamarin Prover, it is verified that our proposed technique provides defense against an active adversary.

Efficient Message Authentication with Revocation Transparency Using Blockchain for Vehicular Networks

We propose an efficient revocable message authentication scheme to address the security and privacy problems of vehicular networks. The core of our scheme is a pairing-free online/offline certificateless signature with efficient revocation. To further enhance efficiency, our scheme allows roadside unit to assist nearby vehicles to verify signatures through the use of cuckoo filter. To handle revocation, the key generation center will periodically update time keys of the non-revoked users. To reduce the workload of the key generation center, we apply a node selection algorithm known as KUNodes. We also propose to utilize blockchain technology to store the revocation list. Hence, the transparency of user revocation is enhanced, as the vehicles can check the state of revocation list from the immutable blockchain.