Certificate Status Validation Research Articles

PBCert: Privacy-Preserving Blockchain-Based Certificate Status Validation Toward Mass Storage Management

In the recent years, the vulnerabilities of conventional public key infrastructure are exposed by the real-world attacks, such as the certificate authority’s single-point-of-failure or clients’ private information leakage. Aimed at the first issue, one type of approach is that multiple entities are introduced to assist the certificate operations, including registration, update, and revocation. However, it is inefficient in computation. Another type is to make the certificate information publicly visible by bringing in the log servers. Nevertheless, the data synchronization among log servers may lead to network latency. Based on the second approach, the blockchain-based public key infrastructure schemes are proposed. Through these type of schemes, all the certificate operations are stored in the blockchain for public audit. However, the issue of revoked certificates’ status storage is worth paying attention, especially in the setting with massive certificates. In addition, the target web server that a client wants to access is exposed in the process of certificate status validation. In this paper, we propose a privacy-preserving blockchain-based certificate status validation scheme called PBCert to solve these two issues. First, we separate the revoked certificates control and storage plane. Only the minimal control information (namely, certificate hashes and related operation block height) is stored in the blockchain and it uses external data stores for the detailed information about all revoked certificates. Second, we design an obscure response to the clients’ certificate status query for the purpose of privacy preserving. Through the security analysis and experiment evaluation, our scheme is significant in practice.

Markov chain-based evaluation of the certificate status validations in hybrid MANETs

Mobile ad hoc networks (MANETs) are vulnerable to various security attacks conducted by the malicious nodes and attackers. To defend against the attackers, their public key certificates should be revoked by certificate authority. Thus, each MANET node before conducting any secure communications, should check the status of communicating parties’ certificates. Inconsistency of the certificate status information is one of the critical problems which reduce the correctness and effectiveness of the whole certificate validation process. In this paper, we conduct a Markov-chain based analysis and evaluation of the OCSP-based certificate validations in the hybrid MANETs. In particular, we focus on the ADOPT and PS-ADOPT protocols and present four absorbing Markov-chain models, three for online states whose OCSP responder is available to the MANET and the other to support offline cases where MANET may be disconnected from the OCSP responder occasionally. Finally, the results of absorbing Markov models are verified by the extensive simulations of the ADOPT and PS-ADOPT protocols in the OMNeT++ simulator.

Improving OCSP-Based Certificate Validations in Wireless Ad Hoc Networks

Certificate status validation is one of the main operations conducted in all PKI-based security systems to ensure the validity of digital certificates. In this paper, a new certificate validation s...

Towards efficient certificate status validations with E-ADOPT in mobile ad hoc networks

Each public key infrastructure needs an efficient certificate status validation method to exclude the revoked certificates from network. In this paper, we present a novel certificate validation scheme called E-ADOPT or Enhanced-ADOPT which utilizes a new kind of certificate status information. In this solution, we modify the OCSP response messages to carry information about the accusations issued against the certificate and this additional security information helps the client nodes to tune the OCSP results refresh rate more intelligently. As a result, client node can mitigate the certificate status information inconsistency problem with lower overheads and conduct more effective certificate status validations in MANET. Simulation results demonstrate that by appending accusation-related information to the OCSP responses, our solution achieves better results.

Secure publish/subscribe‐based certificate status validations in mobile ad hoc networks

AbstractFreshness of certificate status information is very important in validating public key certificates. However, existing certificate validation schemes suffer from high inconsistency, which makes network vulnerable to various security attacks. In this paper, we propose a new publish/subscribe‐based certificate validation scheme that provides fresh certificate status information in the mobile ad hoc networks. This scheme increases the security of public key infrastructure‐based security systems and improves the scalability of certificate validation systems. Also, according to the simulation results, our solution effectively decreases the processing overheads on responder nodes and reduces the messaging overhead of certificate status validations in mobile ad hoc networks. Copyright © 2014 John Wiley & Sons, Ltd.

Towards Scalable Certificate Status Validation in Mobile Ad Hoc Networks

Certificate validation is an important operation in the PKI-based security systems and its overheads have direct impact on the performance of PKI system. ADOPT is an effective certificate validation protocol that tries to tune the OCSP protocol to multihop wireless networks by using caching techniques. In this paper, the authors present a protocol called BP-ADOPT to decrease the overheads of the ADOPT-based certificate validations in mobile ad hoc networks. This solution also increases the security of ADOPT protocol by making it more resilient against the DoS attacks and improves its scalability and throughput. Finally, the authors present an analysis of our solution and ADOPT protocol in mobile ad hoc networks.

ℋ-OCSP: A protocol to reduce the processing burden in online certificate status validation

Public-key cryptography is widely used as the underlying mechanism for securing many protocols and applications in the Internet. A Public Key Infrastructure (PKI) is required to securely deliver public-keys to widely-distributed users or systems. The public key is usually made public by means of a digital document called certificate. Certificates are valid during a certain period of time; however, there are circumstances under which the validity of a certificate must be terminated sooner than assigned and thus, the certificate needs to be revoked. The Online Certificate Status Protocol (OCSP) is one of the most used protocols for retrieving certificate status information from the PKI. However, the OCSP protocol requires online signatures, which is a costly operation. In this article, we present an improvement over OCSP based on hash chains that reduces the processing burden in the server which in turn provides an additional protection against attacks based on flooding of queries.

서명자의 신원정보 해쉬값을 이용한 실시간 인증서 상태 검증 메커니즘의 설계

인증서 상태 검증 메커니즘은 공개키 기반 구조 인증 시스템의 중요한 요소이다. 현재 가장 보편적인 메커니즘은 인증서 폐지 목록을 이용하는 기법과 실시간 인증서 상태 프로토콜을 이용하는 기법이 있다. 하지만 인증서 폐지 목록을 이용하는 기법은 인증서 배포의 주기적 특성으로 인해 인증서 상태의 대한 실시간성을 보장 할 수 없으며, 실시간 인증서 상태 프로토콜을 이용하는 기법은 검증자가 검증을 요청할 때마다 중앙에 위치한 서버를 이용함으로서 서버 집중화가 발생한다. 또한 매 거래시 대량의 정보를 전송해야 하기 때문에 네트워크 과부화로 인한 인증서 상태 검증에 소요되는 시간이 오래 걸리는 문제점이 있다. 본 논문에서는 사용자의 신원정보 해쉬값을 이용하여 검증을 요청하고 인증기관과 서비스제공자가 보유하고 있는 사용자 신원정보를 통해 검증을 수행함으로써 실시간 인증서 상태 프로토콜과 같은 실시간을 보장하고 통신부하를 감소시킨다. 이에 대한 결과로 인증서 상태 검증 수행 시간을 향상 시키는 서명자 신원정보 해쉬값을 이용한 실시간 인증서 상태 검증 메커니즘을 제안한다. 또한, 실험을 통하여 기존 인증서 상태 목록 기법과 온라인 인증서 상태 프로토콜 기법에 비해 인증서 상태 검증 속도가 항상됨을 확인하였다. The certificate status validation mechanism is a critical component of a public key infrastructure based on certificate system. The most generally mechanisms used these days are the use of the certificate revocation list and the real-time certificate status protocol. But the certificate revocation list can not give the real-time certificate status because the certificate is being delivered periodically, and the real-time certificate status protocol method will generate a concentrated load to the server because the protocol in the central server will be accessed whenever a certification is necessary. It will also take a long time to validate the certificate because each trade has to send mass information through the network. This paper will present that real-time validation is guaranteed as the real-time certificate status protocol method and the traffic congestion in the network Is reduced in a way that the certification would be requested using the user information hash value and would be validated using the user information kept in the certification authorities and the service providers. Based on the this study, we suggest a real-time certificate status validation mechanism which can reduce the certificate status validation time using the signed user information hash value. And we confirm speed of certificate status verification faster than existing CRL(Certificate Revocation List) and OCSP(Online Certificate Status Protocol) method by test.