Certificate Revocation Research Articles

Identification and Avoidance of Malicious Nodes by using Certificate Revocation Method

There are a large number of applications of ad-hoc networks (i) military, (ii) Disaster rescue, (iii) Medical etc. But the security of the data during transfer is a major concern. This paper proposes a technique for identifying and preventing the malicious nodes to be in a path from sender to receiver, known as certificate revocation method. Here certificate authority Scheme (CAS) is responsible for the issue of the certificates for these nodes. The CAS maintains two sets of lists – a warning list and a blocked list. The node is added to a warning list if any of the neighbor nodes raises a suspension about a node. Both the accuser and the accused are added to this list. The node is transferred to blocked list when the corruption in the node is confirmed. A node from the blocked list is never added to the network again. This process is termed as cluster-based certificate revocation scheme (CBCRS). The priority of this technique is not the detection of the corrupted node but the removal of the corrupted node from the network. Experimental results reveal that this protocol is free from vulnerabilities.

Cluster-Based Secure Communication and Certificate Revocation Scheme for VANET

In this paper, Cluster-Based Secure Communication and Certificate Revocation Scheme for VANET is proposed. Initially, the nodes (vehicles) are gathered into various clusters and cluster head (CH) should be selected based on the trusty nodes. The certificate authority (CA) known as the trusted third party is taken into account, however, CA is in charge of revoking and distributing the certificates that belong to the vehicles. The information of the certificate revocation list is provided to the CA. Any cluster member can obtain the details from CH if it identifies valid certificate of the secure transmission of messages that takes place by the application of symmetric cryptography approach, where the encryption and the decryption of certificates may occur. From the simulation result, it is verified that the proposed method shows better performance when compared with the existing works in terms of the delivery ratio, throughput, and latency, etc.

An efficient scheme to support direct revocation in cloud computing using CPABE: The approach with less time constraints

Secure Data sharing is a major issue of concern in cloud computing. CPABE is well known encryption technique for dealing with the problem of data security over network. Most of the files have multilevel access hierarchy especially in health care and military domain. The hierarchy structure and revocation of shared files is not scrutinized in CP-ABE. In this paper, experts proposed the enhanced method of encryption to support the direct revocation, in which sender specifies the revocation list during encryption of cipher text so that the problem of releasing periodic key update information in indirect revocation is vanished. Here the direct revocation mechanism and file access based hierarchy are merged to get enhanced CPABE. The multilevel access structure is integrated and merged with encrypted files with current access structure. Along with revocation, aim is also to improve the overall system performance with respect to encryption time and decryption time. Experimental result shows the enhanced performance of the proposed system as compared to existing system with respect to time and security constraints. Moreover the scheme is secure under the standard security assumption. Finally, based on the research, it gives forthcoming research direction to expand and implement the scheme in any practical application where security is main concern by proper coalition of the proposed technologies.

Decentralized Digital Certificate Revocation System Based on Blockchain

Current digital certification revocation systems are insufficient in the application scenario of multiple certification authorities (CAs), and it leads to a lack of mutual trust, access stability, and timeliness of data synchronization between CAs. We propose a decentralized digital certificate revocation system based on consortium blockchain technology with a secret sharing scheme. It can invalidate the digital certificate in special cases to protect the user's information and property security. Based on the characteristics of the decentralized consensus mechanism, consortium blockchain technology is the core technology of the system. The scheme achieves collaborative management of digital certificate revocation lists (CRLs) by multiple CAs, and introduces secret sharing scheme, further safeguarding the reliability of the maintenance process, and then the online certificate status protocol (OCSP) can be developed based on this system. This system is security, effective, and cannot be tampered. Compared with the traditional revocation scheme, it achieves trusted and reliable CRL system above multiple CAs, which can provide new ideas for the way of digital certificate revocation and expand the application range of blockchain technology.

ACPC: Efficient revocation of pseudonym certificates using activation codes

Vehicular communication (V2X) technologies allow vehicles to exchange information about the road conditions and their own status, and thereby enhance transportation safety and efficiency. For broader deployment, however, such technologies are expected to address security and privacy concerns, preventing abuse by users and by the system’s entities. In particular, the system is expected to enable the revocation of malicious vehicles, e.g., in case they send invalid information to their peers or to the roadside infrastructure; it should also prevent the system from being misused for tracking honest vehicles. Both features are enabled by Vehicular Public Key Infrastructure (VPKI) solutions such as Security Credential Management Systems (SCMS), one of the leading candidates for protecting V2X communication in the United States. Unfortunately, though, SCMS’s original revocation mechanism can lead to large Certification Revocation Lists (CRLs), which in turn impacts the bandwidth usage and processing overhead of the system. In this article, we propose a novel design called Activation Codes for Pseudonym Certificates (ACPC), which can be integrated into SCMS to address this issue. Our proposal is based on activation codes, short bit-strings without which certificates previously issued to a vehicle cannot be used by the latter, which are periodically distributed to non-revoked vehicles using an efficient broadcast mechanism. As a result, the identifiers of the corresponding certificates do no need to remain on the CRL for a long time, reducing the CRLs’ size and streamlining their distribution and verification of any vehicle’s revocation status. Besides describing ACPC in detail, we also compare it to similar-purpose solutions such as Issue First Activate Later (IFAL) and Binary Hash Tree based Certificate Access Management (BCAM). This analysis shows that our proposal not only improves privacy (e.g., in terms of resilience against colluding system authorities), but also leads to processing and bandwidth overheads that are orders of magnitude smaller than those observed in the state of the art.

An Efficient Scheme to Support Direct Revocation in Cloud Computing Using CPABE :the Approach with Less Time Constraints

Secure Data sharing is a major issue of concern in cloud computing. CPABE is well known encryption technique for dealing with the problem of data security over the network. Most of the files have multilevel access hierarchy especially in health care and military domain. The hierarchy structure and revocation of shared files is not scrutinized in CP-ABE. In this paper, experts proposed the enhanced method of encryption to support the direct revocation, in which sender specifies the revocation list during encryption of cipher text so that the problem of releasing periodic key update information in indirect revocation is vanished. Here the direct revocation mechanism and file access based hierarchy are merged to get enhanced CPABE. The multilevel access structure is integrated and merged with encrypted files with the current access structure. Along with revocation, aim is also to improve the overall system performance with respect to encryption time and decryption time. Experimental result shows the enhanced performance of the proposed system as compared to existing system with respect to time and security constraints. Moreover the scheme is secure under the standard security assumption. Finally, based on the research, it gives forthcoming research direction to expand and implement the scheme in any practical application where security is main concern by proper coalition of the proposed technologies.

Efficient digital certificate verification in wireless public key infrastructure using enhanced certificate revocation list

ABSTRACTPublic key cryptography is widely used for secure data transfer in various applications. The Public key infrastructure provides a foundation that supports public key cryptography, and it is required to deliver the public keys to existing systems or users securely. The public key is exchanged digitally in the form of digital certificates having a certain period of validity. Circumstances may arise under which the validity of the certificates should be ceased, and they need to be revoked. The fast growth of e-commerce demands verification and data transfers to be done in minimum time to maintain high efficiency of communication. In this paper, a new method of developing certificate revocation lists is proposed. The formal model of enhanced PKI for mobile commerce security is put forward. The performance of NTRU is compared with the RSA algorithm and the ElGamal algorithm. The paper also sets forth a comparative analysis of the proposed method with other existing techniques. The results show that the proposed technology has the upper hand over the current methods.

A Novel Approach Certificate Revocation in MANET using Fuzzy logic

<span lang="EN-US">Due to the advent developments in the Information and Communication Technology (ICT) based environment, Mobile ad hoc networks (MANETs) have fascinated much concentration because of their mobility and easy deployment. At the same time, their wireless and vibrant features make them susceptible to wide range of types of security attacks when compared to the traditional wired networks. The prime challenge is to assure security in the network components and services. To work out the challenge, novel security measures are put forward for effective and secured communication. In our proposed work, we discuss the need for Security in MANET, focusing on certificate revocation. Providing security is challenging tasks due to its key features. Different authentication techniques, Digital certificate and components of Public Key Infrastructure are also discussed. The certificate revocation is a challenging task in MANETs due to absence of centralized repositories and trusted authorities. The different methods of certificate revocation using cluster based mechanism is analyzed and compared. The principle, advantages and disadvantages of certificate revocation are also compared. And the novel Certificate revocation techniques using fuzzy is discussed with reduced overhead.</span>

A First Look at Certification Authority Authorization (CAA)

Shaken by severe compromises, the Web’s Public Key Infrastructure has seen the addition of several security mechanisms over recent years. One such mechanism is the Certification Authority Authorization (CAA) DNS record, that gives domain name holders control over which Certification Authorities (CAs) may issue certificates for their domain. First defined in RFC 6844, adoption by the CA/B forum mandates that CAs validate CAA records as of September 8, 2017. The success of CAA hinges on the behavior of three actors: CAs, domain name holders, and DNS operators. We empirically study their behavior, and observe that CAs exhibit patchy adherence in issuance experiments, domain name holders configure CAA records in encouraging but error-prone ways, and only six of the 31 largest DNS operators enable customers to add CAA records. Furthermore, using historic CAA data, we uncover anomalies for already-issued certificates. We disseminated our results in the community. This has already led to specific improvements at several CAs and revocation of mis-issued certificates. Furthermore, in this work, we suggest ways to improve the security impact of CAA. To foster further improvements and to practice reproducible research, we share raw data and analysis tools.

A scheme of hidden-structure attribute-based encryption with multiple authorities

In the most of the CP-ABE schemes with hidden access structure, both all the user attributes and the key generation are managed by only one authority. The key generation efficiency will decrease as the number of user increases, and the data will encounter security issues as the only authority is attacked. We proposed a scheme of hidden-structure attribute-based encryption with multiple authorities, which introduces multiple semi-trusted attribute authorities, avoiding the threat even though one or more authorities are attacked. We also realized user revocation by managing a revocation list. Based on DBDH assumption, we proved that our scheme is of IND-CMA security. The analysis shows that our scheme improves the key generation efficiency.

Long-term integrity and non-repudiation protocol for multiple entities

Smart cities aim at developing new applica-tions and architectures to improve the quality of urban services. However, privacy and security are still two of the technical issues that remain unsolved. The reason is that traditional solutions such as Public Key Infrastructures (PKI) were created to ensure some security services such as non-repudiation and data integrity. PKI enable the use of digital certificates and public key cryptosystems and require the cooperation among multiple entities to verify the certificates validity and to maintain a certificate revocation list. Due to the latest development in quantum computing, PKI-based solutions will not be able to provide continuous data integrity and non-repudiation. In fact, the techniques used by today PKI-based solutions to sign docu-ments are not future-proof. To address these drawbacks, we propose an efficient, lightweight non-repudiation protocol for multiples entities that makes use of Merkle tree and of a Hash function that is future-proof. In contrast to PKI-based solutions, we demonstrate the efficiency of our proposed approach in terms of its low transmission and message overheads, and ability to maintain continuous data integrity and non-repudiation for smart cities’ applications and services.

Intelligent agents based trusted revocation for securing clustering MANETS

Mobile Ad-hoc Network is a non-secure wireless network which has no infrastructure, dynamical topology in which the nodes can move anywhere, may join or leave the network through multi-hop communication. In cluster network, all the nodes can select one Cluster Head for transmission of data to another Cluster Head through gateways which is mainly used for saving energy of each node. Intelligent agents are used for collecting secure data from neighboring nodes and inform to the trusted agent in clustered networks. Security plays major role in wireless medium. Detecting malicious node is also causing a major concern to damage the data packets. To avoid this problem of entering malicious node in networks and non-secured data, agents based trusted revocation in clustering mobile ad-hoc network for improving security with Certificate Authority to improve the network performance like high throughput, less latency time and improved certificate revocation time using ns2 simulators.

Efficient trust management with Bayesian-Evidence theorem to secure public key infrastructure-based mobile ad hoc networks

In mobile ad hoc networks (MANETs), the reliability of nodes, quality of data and access control cannot be achieved successfully for various network functionalities through traditional cryptographic security, which makes MANET vulnerable to illegitimate node behaviour changes. These node misbehaviours, referred as soft security threats, need to be detected and prevented in order to protect against the accumulation of false measurements with selfish and malicious intentions. Trust has been employed as a powerful tool to handle the soft security threats and to provide security among uncertain and dynamic nodes effectively in MANET. Therefore, it is of great importance that efficient trust management mechanisms should be developed in a public key infrastructure (PKI), in order to verify the identities on the ad hoc networks for reliable and secure group communication. However, the independent nature of nodes and the computational complexities make the trust management a challenging one in MANET. In this paper, we present an efficient distributed trust computation and misbehaviour verification method with Bayesian and Evidence theorem, on hexagonally clustered MANET. Besides, a secured PKI system is designed in the paper by applying the proposed trust management scheme in terms of certificate revocation, which is an important functionality of PKI cryptosystem. The uncertainty impacts the node’s anticipation of neighbour’s behaviour and decisions during communication; we include uncertainty in the trust management system. An efficient method to reduce the uncertainty is to exploit the mobility characteristics of MANET that accelerates the trust convergence. The simulation results reveal a better performance against adversaries in creating considerable untrustworthy transactions with a mobility-aware cluster guarantee. Moreover, the proposed trust application shows its betterment in the revocation process in terms of revocation rate and time. Thus, the proposed scheme provides an effective security solution that incorporates the optimistic features of trust mechanisms and hierarchical Voronoi clustering.

SPATA: Strong Pseudonym-Based AuthenTicAtion in Intelligent Transport System

Intelligent transport system (ITS) is generally deployed to improve road safety, comfort, security, and traffic efficiency. A robust mechanism of authentication and secure communication is required to protect privacy and conditional resolution of pseudonyms to revoke malicious vehicles. In a typical ITS framework, a station can be a vehicle, road side unit, or a server that can participate in communication. During authentication, the real identity of an intelligent transport system station, referred to as a vehicle, should not be revealed in order to preserve its privacy. In this paper, we propose a Strong Pseudonym-based AutenTicAtion (SPATA) framework for preserving the real identity of vehicles. The distributed architecture of SPATA allows vehicles to generate pseudonyms in a very private and secure way. In the absence of a distributed architecture, the privacy cannot be preserved by storing information regarding vehicles in a single location. Therefore, the concept of linkability of certificates based on single authority is eliminated. This is done by keeping the real identity to pseudonym mappings distributed. Furthermore, the size of the certificate revocation list (CRL) is kept small, as only the most recent revoked communication pseudonyms are kept in the CRL. The privacy of the vehicle is preserved during the revocation and resolution phase through the distributed mechanism. Empirical results show that SPATA is a lightweight framework with low computational overhead, average latency, overhead ratio, and stable delivery ratio in both sparse and dense network scenarios.

Demonstrably Secure Signature Scheme Resistant to k-Traitor Collusion Attack

This paper presents the proposal of a new implicit and explicit certificate-based signature scheme (IE-CBS-kCAA scheme) using Sakai–Kasahara’s type keys. The scheme security depends on the computational difficulty of solving the modified collusion attack algorithm with ${k}$ traitors ( ${k}$ -mCAA problem), reducible in particular cases to the known ${k}$ -CAA problem. The originality of the scheme consists not only in the formulation and application of a new difficult computational problem but also in its design to meet the paradigm of public key cryptography based on implicit and explicit certificates. Due to such an approach, the proposed signature scheme can be used in the traditional public key infrastructure with the revocation of explicit certificates and in non-standard infrastructures without the revocation of implicit certificates. In this paper, the security model is formulated and it is shown that the IE-CBS-kCAA signature scheme is existentially unforgeable against adaptively chosen messages in the random oracle model. Moreover, it results from the comparison of the IE-CBS-kCAA scheme with other signature schemes based on implicit and/or explicit certificates that its computational efficiency is at a similar level. Computational tests have also shown that the scheme can be used in practice.

An Efficient Revocation Scheme for Vehicular Ad-Hoc Networks

In Vehicular Ad-Hoc Networks (VANETs), the distribution of certificate revocation information is a security issue to provide safety and efficiency in the transportation system. Most of the current approaches are based on distributing a Certificate Revocation List (CRL) that incurs a large communication overhead, storage space, and checking time. In this work, we propose an efficient revocation scheme based on the use of fog computing and Merkle hash trees replacing the time consuming CRL checking process. More specifically, we divide the roadway into several domains, in which fog nodes manage the vehicles in a localized manner. Then, we utilize Merkle hash trees to provide a highly scalable way to disseminate the revocation information and ensure the integrity of the certificate’s status. The performance analysis is carried out to demonstrate the effectiveness of our scheme in terms of verification delay compared with the conventional mechanisms.

An Efficient and Secure Anonymous Authentication Scheme for VANETs Based on the Framework of Group Signatures

Vehicular ad hoc networks (VANETs) have stimulated interests in both academic and industry settings. Once deployed, they would bring a new driving experience to drivers. However, in an open-access environment, privacy is one of the greatest challenges, as drivers want to keep their personal information protected. Therefore, many authentication protocols have been proposed as solutions to the privacy issue. In most of the existing protocols, to prevent the revoked entity from generating a valid authentication information, the verifiers must frequently download the revocation list from one or more remote authorities to keep the list up-to-date, which greatly increases the workload of the remote authority. In this paper, to cope with such challenging concerns, based on the idea of group signatures, we propose a novel authentication protocol scheme by using the complete sub-tree method to achieve membership revocation, which ensures forward security. In our scheme, the verifiers can verify the authentication information by getting the latest epoch $t$ without having to obtain the latest revocation list. In the aspect of security, the proposed protocol is featured with forward security, CCA2-anonymity, unforgeability, non-frameability, and traceability. In addition, our scheme adopts a decentralized group model, so that the whole domain of VANETs is divided into sub-regions and any vehicle has to update its non-revoked token periodically from the regional group manager who manages the region where the vehicle stays.

Conditional Privacy-Preserving Authentication Using Registration List in Vehicular Ad Hoc Networks

Vehicular ad hoc networks (VANETs) have increased in popularity in recent years and play an extremely important role in the intelligent transportation field. However, the demands of larger communication networks and the integrated message verification process for ensuring security incur more communication and computation overheads, and directly affect the efficiency of existing VANET schemes. To address this issue, this paper proposes a novel and practical conditional privacy-preserving authentication scheme, which uses the registration list instead of the revocation list to reduce the communication overhead. Specifically, our scheme can prevent malicious vehicles from disrupting the security features of VANETs. Moreover, we do not use the bilinear pairing operation, which is the most complicated operation in modern cryptography, thus significantly reducing the computation overhead and communication overhead. Security and performance analyses demonstrate that our proposed scheme is more secure and efficient than current schemes, and that the proposed scheme is more suitable for VANET deployments.

Secure and reliable communication scheme for MANET using ECMS cluster head-based certificate revocation

Mobile ad hoc networks (MANETs) have received increasing attention due to their ease of deployment and mobility. However, MANETs are more suspicious to various malicious activates and unauthorized access. In order to overcome this issue, we have proposed a cluster based certificate revocation method to isolate the malicious node and prevent the unauthorized access. The proposed algorithm effectively used to solve security issues in MANET. The proposed framework is demonstrated as following blocks, namely, cluster construction, cluster head selection, certificate authority, node classification, certificate revocation and evaluation of false accusations. Especially, we have proposed ECMS algorithm for identifying the best cluster head in each cluster. The ECMS algorithm is stands for energy (E), connectivity (C), mobility (M) and signal to noise ratio (S). The sensor nodes present in the network are classified into three types, namely, normal node, warned node, and revoked node. In certificate revocation procedure, every node present in the network is monitored with the help of one-hop neighbours. These neighbours are also used to collect the malicious information about the sensor nodes. If any node is wrongly identified as a malicious node then its legitimate nodes send the vindication packets (VPs) to the appropriate gateways to correct the mistake. The performance of the proposed cluster based certificate revocation method is evaluated on the basis of various parameters it includes successful certification ratio (SSR), settling time (ST), average certification delay (ACD), packet delivery ratio, normalized overhead (NRO), end-to-end delay and throughput. The simulation results of the proposed algorithm are compared with the trust based algorithm, non-voting based algorithm and voting based algorithm. The experimental results proved the good performance of the proposed cluster based certificate revocation method.

Traceable-then-revocable ciphertext-policy attribute-based encryption scheme

A traceable ciphertext-policy attribute-based encryption (T-CPABE) scheme can trace a malicious user, who may leak her/his decryption privilege to a third party for some benefits. However, even if the malicious user is traced, the existing schemes cannot revoke her/him from the cryptosystems. Thus, it is necessary to embed a revocation mechanism into a T-CPABE scheme in practice. In this paper, we propose a ciphertext-policy attribute-based encryption scheme with white-box traceability and direct user revocation. In the proposed scheme, the ciphertext is related to an access structure and a revocation list R. The secret key is associated with an attribute set and a user’s identity assigned a leaf node in a binary tree. The value of a leaf node is used to trace a malicious user. Once a malicious user is caught, her/his identity is added in the revocation list R. Only the ciphertext components associated with the revocation list R are updated according to the new revocation list R′, and the updated ciphertext can provide forward security. Therefore, a user can decrypt a ciphertext if and only if she/he is not in the revocation list and her/his attribute set satisfies the access policy, simultaneously. Furthermore, our scheme is proved to be secure under selective access policy and chosen-plaintext attacks based on the decisional q-bilinear Diffie–Hellman exponent hardness assumption in the standard model.