Public Key Infrastructure Authentication Research Articles

Cross-domain identity authentication scheme based on blockchain and PKI system

In vehicular ad hoc networks (VANET), the cross-domain identity authentication of users is very important for the development of VANET due to the large cross-domain mobility of vehicle users. The Public Key Infrastructure (PKI) system is often used to solve the identity authentication and security trust problems faced by VANET. However, the PKI system has challenges such as too centralized Authority of Certification Authority (CA), frequent cross-domain access to certificate interactions and high authentication volume, leading to high certificate management costs, complex cross-domain authentication paths, easy privacy leakage, and overburdened networks. To address these problems, this paper proposes a lightweight blockchain-based PKI identity management and authentication architecture that uses smart contracts to reduce the heavy burden caused by CAs directly managing the life cycle of digital certificates. On this basis, a trust chain based on smart contracts is designed to replace the traditional CA trust chain to meet the general cross-domain requirements, to effectively avoid the communication pressure caused by a mass of certificate transmissions. For the cross-domain scenario with higher privacy and security requirements the identity attribute authentication service is provided directly while protecting privacy by using the Merkle tree to anchor identity attribute data on and off the blockchain chain. Finally, the proposed scheme was comprehensively analyzed in terms of cost, time consumption and security.

A Lightweight Mutual Authentication Scheme for Power Edge Computing System

Because of heavy cost, using of the traditional Public Key Infrastructure (PKI) authentication schemes is limited for the energy-constrained intelligent devices such as the power edge computing system, in which lightweight secure authentication schemes are urgent needed. In this paper, we propose a lightweight mutual authentication scheme supported by the edge computing, which is a novel cross-layer secure authentication program with asymmetric resources. The novel scheme combines lightweight symmetric cipher and physical-layer Channel State Information (CSI) to provide two-way authentication between terminals and edge devices. Experimental results show that the proposed scheme can significantly reduce the access authentication latency compared with the traditional PKI authentication scheme.

Enhanced PKI authentication with trusted product at claimant

In this paper, a data structure to enhance PKI (Public Key Infrastructure) authentication is proposed generalizing the concept of ISO/IEC 24761. Current technologies do not provide sufficient information on products which are used in the authentication process at the Claimant to the Verifier. As a result, the Verifier cannot sufficiently distinguish the authentication result executed with a trusted product from that without a trusted product. The difference is made clear if evidence data of the execution of authentication process at the Claimant are generated by the trusted product and used for verification by the Verifier. Data structure for such data is proposed in this paper as client Authentication Context (cAC) instance. Relation to other works and extension of the proposal where biometrics is used are also described for further improvement of PKI authentication. For this proposal to realize, standardization activities are to be considered as the next steps.

The Proposed Public Key Infrastructure Authentication Framework (PKIAF) for Malaysian Government Agencies

The Proposed Public Key Infrastructure Authentication Framework (PKIAF) for Malaysian Government Agencies

Implementation of an RFID Key Management System for DASH7

The wireless sensor networking standard DASH7 operates in low-power communication with a better transmission quality in active RFID networks. The DASH7 security standard supports public key cryptography. At present, the DASH7 standard uses the message authentication code in the network layer for authentication and integrity. However, its security standard is still in an incubation stage with respect to the implementation of a crypto exchange over a DASH7 network. Effective key management is an important factor for privacy and security. If organizations are not careful about where and how keys are stored, they leave the encrypted data vulnerable to theft. In this regard, we present a key management system designed for efficient key management through public key infrastructure authentication as well as a non-repudiation feature for the DASH7 standard. We analyze the performance of the proposed system on a basis of various performance criteria such as latency and throughput.

Network Computing Infrastructure to Share Tools and Data in Global Nuclear Energy Partnership

CCSE/JAEA (Center for Computational Science and e-Systems/Japan Atomic Energy Agency) integrated a prototype system of a network computing infrastructure for sharing tools and data to support the U.S. and Japan collaboration in GNEP (Global Nuclear Energy Partnership). We focused on three technical issues to apply our information process infrastructure, which are accessibility, security, and usability. In designing the prototype system, we integrated and improved both network and Web technologies. For the accessibility issue, we adopted SSL-VPN (Security Socket Layer-Virtual Private Network) technology for the access beyond firewalls. For the security issue, we developed an authentication gateway based on the PKI (Public Key Infrastructure) authentication mechanism to strengthen the security. Also, we set fine access control policy to shared tools and data and used shared key based encryption method to protect tools and data against leakage to third parties. For the usability issue, we chose Web browsers as user interface and developed Web application to provide functions to support sharing tools and data. By using WebDAV (Web-based Distributed Authoring and Versioning) function, users can manipulate shared tools and data through the Windows-like folder environment. We implemented the prototype system in Grid infrastructure for atomic energy research: AEGIS (Atomic Energy Grid Infrastructure) developed by CCSE/JAEA. The prototype system was applied for the trial use in the first period of GNEP.

Formal Modelling of PKI Based Authentication

One of the main aims of certificate based Public Key Infrastructure (PKI) is to provide authentication in distributed systems. Through its functions, PKI authentication can be viewed as a re-usable component that can be integrated with other systems to offer strong authentication, scalability, and mobility, particularly for large organizations. PKI has been used to describe authentication in various types of applications ranging from e-commerce and web services applications to large scale systems such as Grid computing. This paper presents a formal approach for modeling certificate based PKI authentication. The approach makes use of two complementary models: one is state-based, described in Z, and the other is event-based, expressed in the Process Algebra of Hoare's Communicating Sequential Processes (CSP). The former will be used to capture the state of PKI key components used in the authentication process, the relationships between them, and model ''back-end'' operations on these components. Whereas the latter, CSP, will be used to model behavior, and in particular, ''front-end'' interactions and communications. Only when this authentication mechanism is properly formulated, reasoning about its correctness, vulnerabilities and usability can be scrutinized and possibly aided by automation.