Digital Certificate Management Research Articles

Digital Certificate Management for Medical Devices

As the healthcare environment becomes increasingly digitally connected and cyber threats to healthcare technologies evolve, cybersecurity controls are necessary to ensure the safety and effectiveness of medical devices. Digital certificates are one such security control commonly utilized to secure various technologies and systems including medical devices. However, few academic resources describe the use of digital certificates in the unique context of medical devices. Additionally, digital certificate issues have the potential to impact the safety and effectiveness of medical devices and to negatively hinder the delivery of patient care. This article provides an introduction on the role of digital certificates to secure and manage access to medical devices, including potential issues and digital certificate management considerations.

Blockchain-enhanced efficient and anonymous certificateless signature scheme and its application

Although the Internet of Things (IoT) brings efficiency and convenience to various aspects of people’s lives, security and privacy concerns persist as significant challenges. Certificateless Signatures eliminate digital certificate management and key escrow issues and can be well embedded in resource-constrained IoT devices for secure access control. Recently, Ma et al. designed an efficient and pair-free certificateless signature (CLS) scheme for IoT deployment. Unfortunately, We demonstrate that the scheme proposed by Ma et al. is susceptible to signature forgery attacks by Type-II adversaries. That is, a malicious-and-passive key generation center (KGC) can forge a legitimate signature for any message by modifying the system parameters without the user’s secret value. Therefore, their identity authentication scheme designed based on vehicular ad-hoc networks also cannot guarantee the claimed security. To address the security vulnerabilities, we designed a blockchain-enhanced and anonymous CLS scheme and proved its security under the Elliptic curve discrete logarithm (ECDL) hardness assumption. Compared to similar schemes, our enhanced scheme offers notable advantages in computational efficiency and communication overhead, as well as stronger security. In addition, a mutual authentication scheme that satisfies the cross-domain scenario is proposed to facilitate efficient mutual authentication and negotiated session key generation between smart devices and edge servers in different edge networks. Performance evaluation shows that our protocol achieves an effective trade-off between security and compute performance, with better applicability in IoT scenarios.

Hybrid Digital Certificate Management System with QR Code and IoT Integrated on Hyperledger Fabric Blockchain

In contemporary society, management of physical documents such as educational certificates, identity proofs, vehicle registrations, and marriage certificates is an integral part of daily life. However, in present online world, there is a pressing need for digital transformation and the management of these documents. One significant challenge associated with this transformation is the susceptibility of original documents to replication or duplication. This vulner- ability is particularly concerning in the case of educational certificates, where fraud is prevalent. Fraudulent activities in the education sector can influence the proliferation of counterfeit educational and skill certificates, posing serious risks to society. For instance, individuals holding fraudulent degrees in professions such as engineering, medicine, law, and pharmacy may lack genuine competence, thereby posing substantial societal harm. To address the issue of certificate oversight and deter forgery, various approaches have been employed. Traditional methods typically involve the use of centralized databases or web servers for certificate storage, which introduces vulnerabilities because they represent single points of failure that leads to forgery and information loss. An optimal solution lies in the adoption of a Blockchain system that leverages a decentralized database structure to enhance data storage capacity and security. Blockchain technology has demonstrated disruptive potential and in- novative capabilities across multiple sectors because of its decentralized, transparent, and secure attributes. Its impact spans various domains, including banking, supply chain management, healthcare, education, and finance. Notably, in the education sector, Blockchain technology holds promise in enhancing security, transparency, and efficiency across different educational processes. In this study, we explore existing Blockchain oriented certificate management systems, critically analyze their limitations, and propose a novel hybrid educational certificate management model. The proposed model integrates Hyperledger Fabric, IoT, and 2D Barcode to develop a robust and secure framework for managing educational certificates.

Online Blockchain Based Certificate Generation and Validation System

At present a considerable amount of training courses are being held accompanied by the issuance of certificates. Unfortunately there is no proper means of verifying these digital certificates. To overcome this issue a new system must be implemented wherein customized digital certificates can be produced. In this system users can securely store their certificates in a digital locker while other organizations can validate them. This can be achieved through the use of open-source software and blockchain technology. The prevalence of counterfeit certificates in our society has become a significant and troublesome issue. It has now become a lucrative business driven by the demand for employment opportunities. As a result legitimate graduates with authentic credentials are often overlooked for job opportunities. To combat this problem various researchers have proposed a certificate authentication system that ensures tamper-proof and reliable management of digital certificates. Ultimately this will benefit both the issuers and recipients of these certificates.

Revisiting the Feasibility of Public Key Cryptography in Light of IIoT Communications.

Digital certificates are regarded as the most secure and scalable way of implementing authentication services in the Internet today. They are used by most popular security protocols, including Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). The lifecycle management of digital certificates relies on centralized Certification Authority (CA)-based Public Key Infrastructures (PKIs). However, the implementation of PKIs and certificate lifecycle management procedures in Industrial Internet of Things (IIoT) environments presents some challenges, mainly due to the high resource consumption that they imply and the lack of trust in the centralized CAs. This paper identifies and describes the main challenges to implement certificate-based public key cryptography in IIoT environments and it surveys the alternative approaches proposed so far in the literature to address these challenges. Most proposals rely on the introduction of a Trusted Third Party to aid the IIoT devices in tasks that exceed their capacity. The proposed alternatives are complementary and their application depends on the specific challenge to solve, the application scenario, and the capacities of the involved IIoT devices. This paper revisits all these alternatives in light of industrial communication models, identifying their strengths and weaknesses, and providing an in-depth comparative analysis.

Blockchain-Based Public Key Infrastructure: A Transparent Digital Certification Mechanism for Secure Communication

Public Key Infrastructure (PKI) has been considered to be an enabler of secure communication, while, due to its complex and centralized design, there have been instances in the past for Certification Authority's (CA) misbehaving and publishing rogue certificates for targeted attacks. This research aims to present a blockchain-based mechanism that lays down a concrete foundation for creating a transparent and secure block-chain-based mechanism for the issuance and management of digital certificates that enables prevention against CA misbehaving. A prototype is deployed and tested on the Ethereum test network, and the results are made publicly available for verification and validation. As a result, the proposed Ethereum blockchain-based PKI mechanism enables secure, transparent, and auditable issuance and management of digital certificates together with the solution of Sybil, Spoofing, and Man-in-the-Middle (MITM) attacks.

Lightweight Digital Certificate Management and Efficacious Symmetric Cryptographic Mechanism over Industrial Internet of Things.

The certificate authority, a trusted entity, issues digital certificates which contain identity credentials to help Industrial Internet of Things (IIoT) devices to represent their authenticity in a secure means. The crucial challenge of a digital certificate is to how design a secure certification authority management system that can counteract cyberattacks on the IIoT network. Moreover, current IIoT systems are not capable of implementing complex mathematical operations due to their constrained power capacity and processing capability. This paper proposes an effective, secure symmetric cryptographic mechanism (ESSC) based on the certificate authority management and Elliptic Curve Diffie Hellman (ECDH) to share a digital certificate among IIoT devices. The proposed certificate authority is used to securely exchange the shared secret key and to resolve the problem of spoofing attacks that may be used to impersonate the identity of the certificate authority. Also, ESSC uses the shared secret key to encrypt the sensitive data during transmission through the insecure communication channel. This research studies the adversary model for ESSC on IIoT and analyzes the cybersecurity of ESSC in the random oracle model. The findings that result from the experiments show that ESSC outperforms the baseline in terms of communication, computation, and storage costs. ESSC thus provides an adequate lightweight digital certificate management and cryptographic scheme which can help in the detection and prevention of several cyberattacks that can harm IIoT networks.

How to Survive Identity Management in the Industry 4.0 Era

Industry 4.0 heavily builds on massive deployment of Industrial Internet of Things (IIoT) devices to monitor every aspect of the manufacturing processes. Since the data gathered by these devices impact the output of critical processes, identity management and communications security are critical aspects, which commonly rely on the deployment of X.509 certificates. Nevertheless, the provisioning and management of individual certificates for a high number of IIoT devices involves important challenges. In this paper, we present a solution to improve the management of digital certificates in IIoT environments, which relies on partially delegating the certificate enrolment process to an edge server. However, in order to preserve end-to-end security, private keys are never delegated. Additionally, for the protection of the communications between the edge server and the IIoT devices, an approach based on Identity Based Cryptography is deployed. The proposed solution considers also the issuance of very short-lived certificates, which reduces the risk of using expired or compromised certificates, and avoids the necessity of implementing performance expensive protocols such as Online Certificate Status Protocol (OCSP). The proposed solution has been successfully tested as an efficient identity management solution for IIoT environments in a real industrial environment.

Certificateless designated verifier proxy signature scheme for unmanned aerial vehicle networks

Unmanned aerial vehicle (UAV) technologies have a promising application prospect. It is necessary to use digital signature schemes to protect the integrity and authentication of messages in the UAV networks. According to the characteristics of UAV networks, digital signature schemes should solve the problems of digital certificate management and key escrow, guarantee the real-time performance of UAV executing commands, and ensure that only the designated verifier can verify the signature. Therefore, we proposed a certificateless designated verifier proxy signature (CLDVPS) scheme which meets the requirements. We proved our signature scheme is existentially unforgeable under an adaptive chosen message attack in the random oracle model and compared the efficiency of our signature scheme with other signature schemes. We implemented these signature schemes in jPBC to obtain the computing time and theoretically analyzed signature length of these signature schemes. The analysis results indicate that our CLDVPS scheme is more efficient than most of other related signature schemes on computation costs and also efficient on communication costs.

PKI Deployment Challenges and Recommendations for ICS Networks

Different types of Control Systems used for Industrial production are broadly called Industrial Control Systems (ICS) (n.d.). These include Supervisory Control and Data Acquisition (SCADA) Systems and Distributed Control Systems (DCS). ICS typically perform the “Command and Control” operations required for smooth functioning of machines in industrial production. They are widely used in Critical infrastructures such as power generation and distribution systems, Oil and Gas plants, Chemical factories and various other manufacturing facilities. Traditionally, ICS used proprietary protocols and operated in isolation. Perimeter security was considered enough as the only means to compromise these systems was via physical access to the systems. However, increased standardization, open architecture adoption and connectivity to enterprise networks as well as internet opened up these systems for a wide range of audience and enabled remote attacks. In this new operation landscape, it is imperative that newer means of securing the networks are adopted continuously. One of the security considerations for the ICS networks is the communication paths used by these networks. Public Key Infrastructure (PKI) (n.d.) plays a key role in securing the communication of ICS networks. Using Digital Certificates, PKI provides a mechanism to verify the identity of all the entities on a network and also ensures that the information is shared securely between communicating entities. PKI is a proven mechanism for secure communication and is widely used in many organizations. However, PKI as a solution to ICS security is challenging due to factors such as resource constrained environments, bandwidth considerations and hard real-time communication requirements. This paper intends to focus on key challenges in Digital Certificate management and correct deployment of PKI in ICS networks and will also present recommendations to overcome these challenges without compromising the basic functionalities of ICS.

Digital certificate management: Optimal pricing and CRL releasing strategies

The fast growth of e-commerce and online activities places increasing needs for authentication and secure communication to enable information exchange and online transactions. The public key infrastructure (PKI) provides a promising foundation for meeting such demand, in which certificate authorities (CAs) provide digital certificates. In practice, it is critical to understand consumer purchasing and revocation behaviors so that CAs can better manage the digital certificates and its CRL releasing process. To address this problem, we analytically model a CA’s pricing and revocation releasing strategies taking into consideration the users' rational decisions. The model provides solutions two main research questions: (1) How should the CA price the digital certificates? The the price of the digital certificate should be determined by the expected losses of the user’s IT system, and the number of certificate revocations per period is expected to decrease over time during the lifecycle of the certificate. This result is supported by the empirical data from VeriSign. (2) How should the CA we further propose a dynamic CRL releasing policy that suggests that the optimal releasing intervals within the lifecycle of a certificate should increase over time.

A secure web-based approach for accessing transitional health information for people with traumatic brain injury

A web-based transitional health record was created to provide regional healthcare professionals with ubiquitous access to information on people with brain injuries as they move through the healthcare system. Participants included public, private, and community healthcare organizations/providers in Eastern Ontario (Canada). One hundred and nineteen service providers and 39 brain injury survivors registered over 6 months. Fifty-eight percent received English and 42% received bilingual services (English–French). Public health providers contacted the regional service coordinator more than private providers (52% urban centres, 26% rural service providers, and 22% both areas). Thirty-five percent of contacts were for technical difficulties, 32% registration inquiries, 21% forms and processes, 6% resources, and 6% education. Seventeen technical enquiries required action by technical support personnel: 41% digital certificates, 29% web forms, and 12% log-in. This web-based approach to clinical information sharing provided access to relevant data as clients moved through or re-entered the health system. Improvements include automated digital certificate management, institutional health records system integration, and more referral tracking tools. More sensitive test data could be accessed on-line with increasing consumer/clinician confidence. In addition to a strong technical infrastructure, human resource issues are a major information security component and require continuing attention to ensure a viable on-line information environment.

Trusted Agent-Mediated E-Commerce Transaction Services via Digital Certificate Management

Agent-mediated e-commerce (AMEC) transaction services will be a paradigm shift from the existing client–server e-commerce model. In order to fulfill the leverage of AMEC intermediary services with secure and trusted service capabilities, we propose an agent-oriented public key infrastructure (PKI) operating with a variety of digital certificates. Under this agent-oriented PKI, several trusted AMEC transaction service models will be demonstrated using human and agent certificates showing, delegation, and verification protocols. We establish human/agent authentication, authorization, delegation, access control, and trusted relationships before these trusted AMEC intermediary services can be realized. This paper shows that a trusted AMEC system can be implemented in the FIPA compliant multi-agent system.