Certificate Authority Research Articles

LogPicker: Strengthening Certificate Transparency Against Covert Adversaries

Abstract HTTPS is a cornerstone of privacy in the modern Web. The public key infrastructure underlying HTTPS, however, is a frequent target of attacks. In several cases, forged certificates have been issued by compromised Certificate Authorities (CA) and used to spy on users at large scale. While the concept of Certificate Transparency (CT) provides a means for detecting such forgeries, it builds on a distributed system of CT logs whose correctness is still insufficiently protected. By compromising a certificate authority and the corresponding log, a covert adversary can still issue rogue certificates unnoticed. We introduce LogPicker, a novel protocol for strengthening the public key infrastructure of HTTPS. LogPicker enables a pool of CT logs to collaborate, where a randomly selected log includes the certificate while the rest witness and testify the certificate issuance process. As a result, CT logs become capable of auditing the log in charge independently without the need for a trusted third party. This auditing forces an attacker to control each participating witness, which significantly raises the bar for issuing rogue certificates. LogPicker is efficient and designed to be deployed incrementally, allowing a smooth transition towards a more secure Web.

Formalizing the Blockchain-Based BlockVoke Protocol for Fast Certificate Revocation Using Colored Petri Nets

Protocol flaws such as the well-known Heartbleed bug, security and privacy issues or incomplete specifications, in general, pose risks to the direct users of a protocol and further stakeholders. Formal methods, such as Colored Petri Nets (CPNs), facilitate the design, development, analysis and verification of new protocols; the detection of flaws; and the mitigation of identified security risks. BlockVoke is a blockchain-based scheme that decentralizes certificate revocations, allows certificate owners and certificate authorities to revoke certificates and rapidly distributes revocation information. CPNs in particular are well-suited to formalize blockchain-based protocols—thus, in this work, we formalize the BlockVoke protocol using CPNs, resulting in a verifiable CPN model and a formal specification of the protocol. We utilize an agent-oriented modeling (AOM) methodology to create goal models and corresponding behavior interface models of BlockVoke. Subsequently, protocols semantics are defined, and the CPN models are derived and implemented using CPN Tools. Moreover, a full state-space analysis of the resulting CPN model is performed to derive relevant model properties of the protocol. The result is a complete and correct formal BlockVoke specification used to guide future implementations and security assessments.

Supply Chain Management, Certificate Management at the Transportation Layer Security in Charge of Security

In the public key infrastructure, the certification authority is fully trusted, and the security of the public key infrastructure depends on the trust of the certification authority; however, recent attacks and corruption on the certification authority indicate that the certificate is forged when the certification authority fails . New solutions, blockchain-based public key infrastructure products and registry can repair vulnerabilities in public key infrastructure, especially weaker security systems. Proposals for infrastructure-based public key infrastructure. Public keys are still the target of global attacks. According to the registration of the target victim, it is signed as a temporary public key infrastructure based on the blockchain. High growth rates require permission to use the wallet. To solve this problem, this document introduces an integrated and responsible system for managing security certificates at the transport layer that represents the next generation of public key infrastructure.I merged two new architectures, introduced a new process, and created a registration and CA server. The domain owner has been notified. In supply chain management, the domain certificate signed by the CA is stored on the registration server, and the certificate server and the CA registration server are forwarded to the group that owns the domain. Compared with existing supply chain public key infrastructure products. The above-mentioned blockchain-based public key infrastructure scheme and registry are used for security and governance analysis.

A privacy protection scheme for telemedicine diagnosis based on double blockchain

With the development of the electronic healthcare industry, telemedicine diagnosis (TMD) has become a more flexible and convenient way. In the general remote diagnosis scheme, the collected medical data is stored in the cloud which may be leaked or tempered with. Since blockchain has the characteristics of centralized storage, some schemes employ blockchains to overcome the security problem of cloud storage, but most of them lack a supervision mechanism. The identity information provided by the doctor to the user must be accurate. However, the digital certificate issued by the certificate authority (CA) may have the problem of information update latency. To solve the above questions, we propose DBTMD, a TMD privacy protection scheme based on double blockchain. We have constructed two types of blockchains, Userchain and Medicalchain, and designed five transactions. Users, doctors, and hospitals can implement secure data interaction, and hospitals can supervise doctors effectively. We have developed an identity authentication chain to ensure the real-time accuracy of the doctor’s identity information. Security analysis and experimental analysis show that our scheme greatly reduces the communication costs of keys’ transaction compared with existing schemes.

Secure and energy-efficient smart building architecture with emerging technology IoT

With the advent of the Internet-of-Things (IoT), it is considered to be one of the latest innovations that offer interesting opportunities for different vertical industries. One of the most relevant IoT technology areas is smart construction. IoT operates in several sectors on a daily basis; implementation includes smart building, smart grids, smart cities, smart houses, physical defense, e-health, asset, and transportation management, but it is not restricted to this. Support from smart IoT buildings is an IoT-level, connected, and cost-effective system. Commercial space has major requirements in terms of comfort, accessibility, security, and energy management. Such requirements can be served organically by IoT-based systems. As the supply of energy has been exhausted and energy demand has risen, there has been a growing focus on energy usage and the maintenance of buildings. With the use of evolving IoT technology, we present a secure and energy-efficient smart building architecture. Every device is known by its unique address, and one of the key web transfer protocols is the Constrained Application Protocol (CoAP). It is an application layer protocol that does not use protected channels for data transfer. Automatic key management, confidentiality, authentication, and data integrity are all features of the Datagram Transport Layer Protection (DTLS). To achieve energy efficiency, we propose a smart construction architecture that, through IoT, manages the performance of all technological systems. The results of the simulation show that the energy consumption is lowered by about 30.86% with the use of the CoAP in the smart building, which is less than the Message Queuing Telemetry Transport case (MQTT). This paper also aims to observe how to integrate the DTLS protocol with the Secure Hash Algorithm (SHA-256) using optimizations from the Certificate Authority (CA) to improve security.

A New Distributed, Decentralized Privacy-Preserving ID Registration System

Blockchain, a distributed ledger technology, is used in various fields, including many types of critical infrastructure, such as smart grids. Recently, studies have dealt with privacy preservation in smart grids. One such study presented a privacy-preserving aggregation system that provides integrity and anonymity using blockchain technology in a smart grid. In earlier work, a Bloom filter was used for rapid authentication on the blockchain, and a key management center was used for user key management. However, due to its high dependence on the key management center, it was not able to provide a completely distributed environment, and there was a linkability problem. In addition, there was a limitation in that key revocation and update functions through the Bloom filter could not be provided. In this article, we propose a decentralized privacy-preserving ID scheme that provides a fully distributed environment to address the limitations of existing research. The proposed scheme provides unlinkability to protect the anonymity of users using a blind signature. It also provides update or revocation functionalities of the pseudonym by the counting Bloom filter or the revoked-pseudonym Bloom filter. In addition, fully distributed operation is guaranteed through the certification authority responsible for user key management. Our scheme is applicable not only to blockchain-based decentralized privacy-preserving systems such as billing systems in a smart grid or smart cities, but also to any critical infrastructure, such as banks, hospitals, and systems including e-bulletins, e-surveys, e-voting, and so on.

Associative Blockchain for Decentralized PKI Transparency

The conventional public key infrastructure (PKI) model, which powers most of the Internet, suffers from an excess of trust into certificate authorities (CAs), compounded by a lack of transparency which makes it vulnerable to hard-to-detect targeted stealth impersonation attacks. Existing approaches to make certificate issuance more transparent, including ones based on blockchains, are still somewhat centralized. We present decentralized PKI transparency (DPKIT): a decentralized client-based approach to enforcing transparency in certificate issuance and revocation while eliminating single points of failure. DPKIT efficiently leverages an existing blockchain to realize an append-only, distributed associative array, which allows anyone (or their browser) to audit and update the history of all publicly issued certificates and revocations for any domain. Our technical contributions include definitions for append-only associative ledgers, a security model for certificate transparency, and a formal analysis of our DPKIT construction with respect to the same. Intended as a client-side browser extension, DPKIT will be effective at fraud detection and prosecution, even under fledgling user adoption, and with better coverage and privacy than federated observatories, such as Google’s or the Electronic Frontier Foundation’s.

Revisited—The Subliminal Channel in Blockchain and Its Application to IoT Security

Although digital signature has been a fundamental technology for cryptosystems, it still draws considerable attention from both academia and industry due to the recent raising interest in blockchains. This article revisits the subliminal channel existing digital signature and reviews its abuse risk of the constructor’s private key. From a different perspective on the subliminal channel, we find the new concept named the chamber of secrets in blockchains. The found concept, whereby the secret is hidden and later recovered by the constructor from the common transactions in a blockchain, highlights a new way to encourage implementing various applications to benefit efficiency and security. Thus, the proposed scheme benefits from the following advantages: (1) avoiding the high maintenance cost of certificate chain of certificate authority, or public key infrastructure, and (2) seamlessly integrating with blockchains using the property of chamber of secrets. In order to easily understand the superiority of this new concept, a remote authentication scenario is taken as a paradigm of IoT to demonstrate that the further advantages are achieved: (1) avoiding high demand for storage space in IoT devices, and (2) avoiding maintaining a sensitive table in IoT server.

The effect of the inspection information sharing policy on quality‐oriented food production in online commerce

Food products are normally classified as credence goods, and their quality cannot be fully ascertained by consumers even after being consumed. Online commerce exacerbates information asymmetry, which breeds a market filled with low‐price and poor‐quality food products. This study aims to examine whether certificate authority's inspection information sharing policy (IIS policy) can improve food quality in online commerce. The results suggest that producers tend to provide high‐quality food products, whereas both the online platform and food producers can earn more profits by adjusting selling price and commission fees under the IIS policy. Meanwhile, consumers also benefit from IIS policy.

Blockchain‐enabled balise data security for train control system

The train control system is the railway system's brain, ensuring the train protection and the railway network's operating performance. This control system relies on the balise data received via near-field wireless communication to localize the train and update real-time operating conditions and constraints. The attackers can capture these data through their balise antenna and corrupt them through replay or false data injection attacks. This corrupted data can compromise train safety and jeopardize the entire train fleet operations. To overcome these attacks and to ensure the trustworthiness of balise and data integrity, this study proposes the permissioned blockchain-enabled two novel architectures for data transactions. Besides, each balise is equipped with a novel built-in blockchain cryptography algorithm to create its secret and public keys to provide the key integrity without needing third-party Certification Authority of conventional Public-Key Infrastructure based security systems. Each balise can create the unique signature using a ‘nonce’ signal sent by the train control system in the static architecture or using a self-generated ‘k-once’ secret key per train control system in dynamic architecture. Finally, the case studies are carried out to confirm the security sufficiency of the proposed architectures.

Experimental authentication of quantum key distribution with post-quantum cryptography

Quantum key distribution (QKD) can provide information theoretically secure key exchange even in the era of quantum computers. However, QKD requires the classical channel to be authenticated, the current method for which is pre-sharing symmetric keys. For a QKD network of n users, this method requires {C}_{n}^{2}=n(n-1)/2 pairs of symmetric keys to realize pairwise interconnection. In contrast, with the help of a mature public key infrastructure (PKI) and post-quantum cryptography (PQC) with quantum-resistant security, each user only needs to apply for one digital certificate from a certificate authority (CA) to achieve efficient and secure authentication for QKD. We need to assume only the short-term security of the PQC algorithm to achieve long-term security of the distributed keys. Here, we experimentally verified the feasibility, efficiency, and stability of the PQC algorithm in QKD authentication, and demonstrated the advantages when new users join the QKD network. Using the PQC public-key infrastructure, the nodes need to mutually trust only the CA to authenticate each other. QKD combined with PQC authentication will greatly promote and extend the application prospects of quantum-safe communication.

Digital Certificate Authority with Blockchain Cybersecurity in Education

In the 21st century the development of internet technology has experienced explosive developments with complex threats in Higher Education. Cyber ​​security is a priority issue for all countries by using data and communication technology in various aspects of life. In order to advance and improve the digital economy in the implementation of a comfortable and reliable electronic system with methods of increasing competitiveness, cyber innovation also builds understanding and sensitivity to national security and resilience. Cybersecurity is constantly changing and learning providers often do not have the authority or facilities and capacity in various activities that connect students, in ensuring their knowledge and expertise. In carrying out the provision and validation of qualifications that are tried exclusively at the centralized management of learning institutions or employing institutions, these days have more ownership of learning experiences with results without risking safety, security and accessibility. This validation provision is not prolonged because learning is far more international than before and education continues to frequently use online platforms. Education providers offer degree internships that represent a new method of expertise and provide a route of advancement in increasing employability prospects. Blockchain is a digital and decentralized ledger, encompassing a set of interlocking technologies. Blockchain is designed to transform the centralized as well as validation model to a decentralized ledger from a secure database. These databases are shared, replicated, and synchronized for validation at universities, legal or regulatory agencies and industrial bodies across the internet.

Blockchain-Based Security Framework for a Critical Industry 4.0 Cyber-Physical System

There has been an intense concern for security alternatives because of the recent rise of cyber attacks, mainly targeting critical systems such as industry, medical, or energy ecosystem. Though the latest industry infrastructures largely depend on AI-driven maintenance, the prediction based on corrupted data undoubtedly results in loss of life and capital. Admittedly, an inadequate data-protection mechanism can readily challenge the security and reliability of the network. The shortcomings of the conventional cloud or trusted certificate-driven techniques have motivated us to exhibit a unique Blockchain-based framework for a secure and efficient industry 4.0 system. The demonstrated framework obviates the long-established certificate authority after enhancing the consortium Blockchain that reduces the data processing delay, and increases cost-effective throughput. Nonetheless, the distributed industry 4.0 security model entails cooperative trust than depending on a single party, which in essence indulges the costs and threat of the single point of failure. Therefore, multi-signature technique of the proposed framework accomplishes the multi-party authentication, which confirms its applicability for the real-time and collaborative cyber-physical system.

Implementation of Blockchain Consensus Algorithm on Embedded Architecture

The adoption of Internet of Things (IoT) technology across many applications, such as autonomous systems, communication, and healthcare, is driving the market’s growth at a positive rate. The emergence of advanced data analytics techniques such as blockchain for connected IoT devices has the potential to reduce the cost and increase in cloud platform adoption. Blockchain is a key technology for real-time IoT applications providing trust in distributed robotic systems running on embedded hardware without the need for certification authorities. There are many challenges in blockchain IoT applications such as the power consumption and the execution time. These specific constraints have to be carefully considered besides other constraints such as number of nodes and data security. In this paper, a novel approach is discussed based on hybrid HW/SW architecture and designed for Proof of Work (PoW) consensus which is the most used consensus mechanism in blockchain. The proposed architecture is validated using the Ethereum blockchain with the Keccak 256 and the field-programmable gate array (FPGA) ZedBoard development kit. This implementation shows improvement in execution time of 338% and minimizing power consumption of 255% compared to the use of Nvidia Maxwell GPUs.

Lightweight Digital Certificate Management and Efficacious Symmetric Cryptographic Mechanism over Industrial Internet of Things.

The certificate authority, a trusted entity, issues digital certificates which contain identity credentials to help Industrial Internet of Things (IIoT) devices to represent their authenticity in a secure means. The crucial challenge of a digital certificate is to how design a secure certification authority management system that can counteract cyberattacks on the IIoT network. Moreover, current IIoT systems are not capable of implementing complex mathematical operations due to their constrained power capacity and processing capability. This paper proposes an effective, secure symmetric cryptographic mechanism (ESSC) based on the certificate authority management and Elliptic Curve Diffie Hellman (ECDH) to share a digital certificate among IIoT devices. The proposed certificate authority is used to securely exchange the shared secret key and to resolve the problem of spoofing attacks that may be used to impersonate the identity of the certificate authority. Also, ESSC uses the shared secret key to encrypt the sensitive data during transmission through the insecure communication channel. This research studies the adversary model for ESSC on IIoT and analyzes the cybersecurity of ESSC in the random oracle model. The findings that result from the experiments show that ESSC outperforms the baseline in terms of communication, computation, and storage costs. ESSC thus provides an adequate lightweight digital certificate management and cryptographic scheme which can help in the detection and prevention of several cyberattacks that can harm IIoT networks.

An authenticated access control framework for digital right management system

With the growing development in digital content distribution, researchers focus on the construction of an access right enabled digital content distribution framework for the legal user. Digital rights management (DRM) is the system which tries to ensure authorized content distribution. Current, DRM systems either provide authentication or constrain access right, but access control with legal authentication in the digital content distribution has remained a challenging issue for public-key cryptography (PKC) or identity-based public-key cryptography (ID-PKC). PKC associates certificate management, which includes revocation, storage, distribution and verification of certificates. As a result, certificate authority becomes the bottleneck in a large network. On the other hand, ID-PKC has the drawback of key escrow. For secure and authorized content distribution, evacuation from these problems is needed. In this paper, we present an authenticated access control protocol, which maintains user’s right with authorized content distribution for the digital right management system. Its security has been proved in the random oracle model. An analysis of performance shows enhancement in efficiency, which indicates that the proposed scheme presents a secure and authorized access control mechanisms for resource-constrained devices.

Identifying the Phishing Websites Using the Patterns of TLS Certificates

With the recent rise of HTTPS adoption on the Web, attackers have begun “HTTPSifying” phishing websites. HTTPSifying a phishing website has the advantage of making the website appear legitimate and evading conventional detection methods that leverage URLs or web contents in the network. Further, adopting HTTPS could also contribute to generating intrinsic footprints and provide defenders with a great opportunity to monitor and detect websites, including phishing sites, as they would need to obtain a public-key certificate issued for the preparation of the websites. The potential benefits of certificate-based detection include (1) the comprehensive monitoring of all HTTPSified websites by using certificates immediately after their issuance, even if the attacker utilizes dynamic DNS (DDNS) or hosting services; this could be overlooked with the conventional domain-registration-based approaches; and (2) to detect phishing websites before they are published on the Internet. Accordingly, we address the following research question: How can we make use of the footprints of TLS certificates to defend against phishing attacks? For this, we collected a large set of TLS certificates corresponding to phishing websites from Certificate Transparency (CT) logs and extensively analyzed these TLS certificates. We demonstrated that a template of common names, which are equivalent to the fully qualified domain names, obtained through the clustering analysis of the certificates can be used for the following promising applications: (1) The discovery of previously unknown phishing websites and (2) understanding the infrastructure used to generate the phishing websites. Furthermore, we developed a real-time monitoring system using the analysis techniques. We demonstrate its usefulness for the practical security operation. We use our findings on the abuse of free certificate authorities (CAs) for operating HTTPSified phishing websites to discuss possible solutions against such abuse and provide a recommendation to the CAs.

Privacy Preserving Data Transmission in Malicious Vehicular Adhoc Networks

Vehicle Adhoc Network is deployed on the road, where vehicles constitute mobile nodes in which active security and intelligent transportation are important applications of VANET. VANETs are a key part of the intelligent transportation systems (ITS) framework. Sometimes, VANETs are referred as Intelligent Transportation Networks. However, authentication and privacy of users are still two vital issues in VANETs. In the traditional mode, the transactional data storage provides no distributed and decentralized security, so that the third party initiates the dishonest behaviors possibly. VANET has temporary participants , communication between vehicles are short-lived messages. Possible situation might happens , adversary may play as an legitimate user and able to perform malicious activity .To address these challenges this paper proposes timestamp based message between users to perform secure data transmission and give the negligible probability of the attacker. With the help of Certificate Authority (CA) and the RoadSide Units (RSUs), our proposal attains the confidentiality and trace the identity of the unauthenticated vehicle in the anonymous announcements as well. Finally, through the theoretical analysis and simulations, our scheme is able to implement a secure VANET framework with accountability and privacy preservation

Multi-party blind quantum computation protocol with mutual authentication in network

Blind quantum computation (BQC) can ensure a client with limited quantum capability safely delegates computing tasks to a remote quantum server. In order to resist attacks from ignoring identity authentication in BQC protocols, it is necessary to guarantee the legality of both clients and servers in a multi-party BQC network. So we propose a multi-party BQC protocol involving three phases to distribute shared keys and authenticate identities. Firstly, by using the advantages of measurement device independent quantum key distribution (MDI-QKD), the registered client and the assigned server could share the initial key safely in registration phase. Secondly, with the help of semi-honest certificate authority (CA), mutual identity authentication phase realizes the two-way authentication from both sides through the shared key simultaneously. Thirdly, in the blind quantum computing phase, a registered client can complete his computing task by just measuring the qubits from the assigned server rather than preparing the qubits. Moreover, combined with first-in-first-out (FIFO) principle, clients’ authentication and blind quantum computing can be processed in parallel. The protocol can also be applied in other multi-party BQC protocols with the universality of resource states. Compared with other BQC protocols, the reliability of the protocol with identity authentication is guaranteed, and the efficiency will be significantly reflected in real experiments.

Dynamic Urban Modelling for Urban Growth Varieties and Transport : Building A Complex Dynamic Model

The need for urban simulation is to improve understanding of urban development and to predict urban changes. The dynamics of urban systems seek to represent the evolutionary patterns of a city over time and space, and it is possible to reduce uncertainty and increase understanding of the urban system as it is a very complex system. An integrated and proactive approach has been developed to plan for growth and transportation for the city of Al-Diwaniyah. Which is based on the CA (Cellular Automata) and shows that the pathway of simulation results reveals the difference in the expansion of urban areas in all directions of the city. This study extended to future stages to (2049) through a dynamic model. It is complicated by using the certification authority (CA cell model) and the results show that the complex interaction between growth and transmission has been well handled by the model. The model has shown during the simulation period of reality and the future (2019-2049) with cellular modelling CA and the future scenario for prediction indicates that commercial and entertainment in Al-Diwaniyah city increased in (2049) and therefore cellular modelling was found to be the most suitable for use in simulating urban growth in areas with evidence of simulation of reality and its comparison with the averages of uses in the city’s basic plan, which determined a percentage of 2035 that was exceeded by reality in 2029. The simulation results show that Al-Diwaniyah will face enormous challenges in the field of transport and urban development in (2049) within the framework of the current trends scenario. The accelerated growth of the population that excelled the estimates of the basic plan by a large percentage, especially among the model, reached 2034 with a city area of 10805 hectares. While in the basic plan it was explained by 2035 the city reaches 10643 hectares, and from the observation of the stages of changing uses according to the basic plan for the city of Al-Diwaniyah. In fact, the reality excelled the proportions from 2009 until Now 2019, especially the city of Al-Diwaniyah, which is directed towards commercial activity and religious and recreational tourism investments. The study ended with the most important recommendations and proposals to improve the city’s reality and drew the researchers’ attention to the importance of the subject of the study.