Public Key Infrastructure System Research Articles

Decentralized Zone-Based PKI: A Lightweight Security Framework for IoT Ecosystems

The advent of Internet of Things (IoT) devices has revolutionized our daily routines, fostering interconnectedness and convenience. However, this interconnected network also presents significant security challenges concerning authentication and data integrity. Traditional security measures, such as Public Key Infrastructure (PKI), encounter limitations when applied to resource-constrained IoT devices. This paper proposes a novel decentralized PKI system tailored specifically for IoT environments to address these challenges. Our approach introduces a unique “zone” architecture overseen by zone masters, facilitating efficient certificate management within IoT clusters while reducing the risk of single points of failure. Furthermore, we prioritize the use of lightweight cryptographic techniques, including Elliptic Curve Cryptography (ECC), to optimize performance without compromising security. Through comprehensive evaluation and benchmarking, we demonstrate the effectiveness of our proposed solution in bolstering the security and efficiency of IoT ecosystems. This contribution underlines the critical need for innovative security solutions in IoT deployments and presents a scalable framework to meet the evolving demands of IoT environments.

메타버스 환경에서의 효율적인 사용자 인증을 위한 다중 서명 기법 연구

Currently, online user authentication is perform using joint certificates issued by accredited certification authorities and simple certificates issued by private agency. In such a PKI(Public Key Infrastructure) system, various cryptographic technologies are used, and in particular, digital signatures are used as a core technology. The digital signature scheme is equally used in DID(Decentralized Identity), which is attracting attention to replace the existing centralized system. As such, the digital signature-based user authentication used in current online services is also applied in the metaverse, which is attracting attention as the next-generation online world. Metaverse, a compound word of “meta,” which means virtual and transcendent, and “universe,” means a virtual world that includes the existing online world. Due to various developments of the metaverse, it is expted that new authentication technologies including biometric authentication will be used, but existing authentication technologies are still being used. Therefore, in this study, we study digital signature scheme that can be efficiently used for user authentication in the developing metaverse. In particular, we experimentally analyze the effectiveness of ECDSA, which is currently used as a standard for digital signatures, and Schnorr signatures, which can quickly verify a large amount of signatures.

Cross-domain identity authentication scheme based on blockchain and PKI system

In vehicular ad hoc networks (VANET), the cross-domain identity authentication of users is very important for the development of VANET due to the large cross-domain mobility of vehicle users. The Public Key Infrastructure (PKI) system is often used to solve the identity authentication and security trust problems faced by VANET. However, the PKI system has challenges such as too centralized Authority of Certification Authority (CA), frequent cross-domain access to certificate interactions and high authentication volume, leading to high certificate management costs, complex cross-domain authentication paths, easy privacy leakage, and overburdened networks. To address these problems, this paper proposes a lightweight blockchain-based PKI identity management and authentication architecture that uses smart contracts to reduce the heavy burden caused by CAs directly managing the life cycle of digital certificates. On this basis, a trust chain based on smart contracts is designed to replace the traditional CA trust chain to meet the general cross-domain requirements, to effectively avoid the communication pressure caused by a mass of certificate transmissions. For the cross-domain scenario with higher privacy and security requirements the identity attribute authentication service is provided directly while protecting privacy by using the Merkle tree to anchor identity attribute data on and off the blockchain chain. Finally, the proposed scheme was comprehensively analyzed in terms of cost, time consumption and security.

Smart contract assisted blockchain based public key infrastructure system

ABSTRACTPublic key infrastructure (PKI) is a reliable solution for Internet communication. PKI finds applications in secure email, virtual private network (VPN), e‐commerce, e‐governance, and so on. It provides a secure mechanism to authenticate users and communications. The conventional PKI system is centralized, which exposes the infrastructure to many security issues. The digital certificate generation and validation processes in PKI suffer from high latency and inadequate authentication processes. Moreover, it needs enormous time and effort to mitigate the malfeasance of the certificate authority (CA). The complexity of employing the traditional key and certificate management increases by enforcing the centralized, which can compromise the transaction security. To overcome the aforementioned issues of PKI, three different solutions have been reported in the literature: Log based PKI (LBPKI), Web of Trust (WoT), and blockchain based PKI. The blockchain based PKI achieves more attention as it is the combination of LBPKI and WoT, which serves distributed trust, log of transactions, and constant sized data to verify the identity of users. Motivated by these facts, this article reports a blockchain‐based PKI system which has a lighter smart contract and less storage capacity and is also suitable for lightweight applications. The lighter smart contract in our infrastructure uses a, which validates the limit of one participating node for becoming theof any transaction inside the network. This approach can prevent distributed denial of service (DDoS) attacks. This smart contract also checks the signer node address. The proposed smart contract can prevent seven cyber attacks, such as Denial of Service (DoS), Man in the Middle Attack (MITM), Distributed Denial of Service (DDoS), 51%, Injection attacks, Routing Attack, and Eclipse attack. The Delegated Proof of Stake (DPoS) consensus algorithm used in this model reduces the number of validators for each transaction which makes it suitable for lightweight applications. The timing complexity of key/certificate validation and signature/certificate revocation processes do not depend on the number of transactions. The comparisons of various timing parameters with existing solutions show that the proposed PKI is competitively better.

BPKI: A secure and scalable blockchain-based public key infrastructure system for web services

Frequent attacks on the certificate authority (CA) have exposed the trust problem of the traditional public key infrastructure (PKI) for the web service. For example, malicious certificates issued by compromised CAs are used to impersonate the existing domain, and revoked certificate are still trusted by clients. Blockchain is considered as one of the most potential technologies to enable a more secure and trustworthy PKI. Although a lot of blockchain-based solutions have been proposed to improve or even replace the traditional PKI, there are still some critical issues unsolved. On the one hand, all of existing blockchain-based solutions are still vulnerable to the domain name preemption attack if a malicious or compromised CA registers a certificate for a domain before the rightful domain owner applies for a certificate for the domain. On the other hand, almost all blockchain-based solutions ignore the scalability problem and can hardly satisfy the current requirement (46 tX/s) of only certificate registrations for global web services. In this paper, we propose a secure and scalable blockchain-based PKI solution, which is called BPKI. In BPKI, we introduce new entities called auditors to supervise CA’s certificate registration operations to eliminate the domain name preemption attack. Furthermore, we design a new delegated PBFT (DPBFT) consensus using the verifiable pseudo-random functions (VRFs) and a double blockchain structure to solve the scalability problem. It is theoretically proved that BPKI is secure. The simulation and experiment demonstrate that BPKI is superior to the existing blockchain-based PKI solutions in scalability.

Blindfold: Keeping private keys in PKIs and CDNs out of sight

Public key infrastructure (PKI) is a certificate-based technology that helps in authenticating systems identities. HTTPS/TLS relies mainly on PKI to minimize fraud over the Internet. Nowadays, websites utilize CDNs to improve user experience, performance, and resilience against cyber attacks. However, combining HTTPS/TLS with CDNs has raised new security challenges. In any PKI system, keeping private keys private is of utmost importance. However, it has become the norm for CDN-powered websites to violate that fundamental assumption. Several solutions have been proposed to make HTTPS CDN-friendly. However, protection of private keys from the very instance of generation; and how they can be made secure against exposure by malicious (CDN) administrators and malware remain unexplored. We utilize trusted execution environments to protect private keys by never exposing them to human operators or untrusted software. We design Blindfold to protect private keys in HTTPS/TLS infrastructures, including CAs, website on-premise servers, and CDNs. We implemented a prototype to assess Blindfold’s performance and performed several experiments on both the micro and macro levels. We found that Blindfold slightly outperforms SoftHSM in key generation by 1% while lagging by 0.01% for certificate issuance operations.

A novel decentralized cross‐domain identity authentication protocol based on blockchain

AbstractIn the context of cloud computing, the interaction between clients in different application domains becomes more frequent, which makes cross‐domain identity authentication safely and efficiently become an important research topic. Public key infrastructure (PKI) is a technology to solve cross‐domain authentication. However, there are problems such as difficulty in mutual trust between multiple certificate authority nodes (CA), failure of single point, and low efficiency in the traditional PKI method. Blockchain is a promising technology for decentralized trust management by providing consistent data storage, which gives impetus to the further development of cross‐domain identity authentication. Thus, this article apply blockchain to cross‐domain identity authentication. To solve the defects of the traditional PKI method, the design requirements are analyzed firstly, based on the analysis result, we proposed a double‐layer cross‐domain identity authentication model by constructing a consortium blockchain which is comprised of authentication server nodes (AS) and some internal blockchain, the model can highly improve the scalability of the PKI system without changing the internal architecture. Then a novel authentication protocol was put forward. The protocol can improve the efficiency of online cross‐domain identity authentication transactions by verifying the hash instead of the signature of their certificate. By putting the generation process of the blockchain certificate and the storage process of its hash in the registration operation and reducing the authentication process for AS and CA, the efficiency is further improved. Finally, the protocol was evaluated by security and performance analysis. The results display our protocol can guarantee security and has an excellent performance in cross‐domain identity authentication transactions.

Heterogeneous Signcryption Scheme From IBC to PKI With Equality Test for WBANs

The signcryption protocols supporting the equality test are only for a single system rather than a flexible heterogeneous environment of wireless body area networks (WBANs). In this article, this problem is efficiently addressed through a proposed heterogeneous signcryption scheme from identity-based cryptosystem (IBC) to public key infrastructure (PKI) with an equality test (HSCIP-ET) for WBANs. Our scheme allows the sensors planted or worn by a user in the IBC system to signcrypt sensitive data using the public key of the management center in the PKI system, and then uploading it to the cloud server. Subsequently, the equality test can be executed by the cloud server on diverse ciphertexts to determine whether they contain the identical plaintext and return the corresponding result after receiving a request from an application provider. Furthermore, a rigorous analysis and an experimental comparison demonstrate the security and efficiency of the HSCIP-ET approach, respectively.

Decentralized Public Key Infrastructures atop Blockchain

The public key infrastructure (PKi) has been widely adopted to create, manage, distribute, store and revoke digital certificates, which plays an important role in bootstrapping secure communications. A PKi system authenticates entities with the corresponding public keys and it lays the security foundation for public-key cryptosystems in public-key encryption and digital signatures. However, traditional PKi systems suffer from security breaches, such as single-point-offailure and man-in-the-middle attacks due to the existence of a centralized certificate authority. in this article, we review the traditional centralized PKi system as well as the subjected security concerns, and then we propose possible solutions to address these issues with the emerging blockchain technology. Two frameworks are presented where blockchain is utilized as a public bulletin board or trusted majority. We implement the functions to evaluate the off-chain time costs and on-chain gas costs of the proposal, which demonstrate the feasibility and practicality of the proposal.

TAC: A unified trust anchor framework based on consortium blockchain

In the current network, there are still many security issues, such as identity fraud and address spoofing. In traditional Public Key Infrastructure(PKI), most trust models adopt a centralized trust model with a single-point trust anchor. The existing PKI system lacks a unified authentication framework and is low efficiency. Aiming at the problems of how to store public keys efficiently and how to make the network secure and trustworthy, this paper proposes a new trust anchor framework based on consortium blockchain, named Trust Anchor Chain(TAC). This study uses the form of consortium to manage TAC, proposes a hierarchical naming ID, named TAC ID to uniquely identify the user in TAC, and proposes a new data structure, named Struct Radix Trie, to store public key information in TAC to improve efficiency. Section 4, TAC has superiority through the comparison between local experiments and remote experiments. In TAC, users can access each other in the TAC, get the public key, and ensure the correctness of the identity. All users work together to maintain TAC to achieve equal network interconnection, security and credibility.

A Novel Collaborative PKI Framework in Public Cloud

Public Key Infrastructure (PKI) is a repository and management system for digital certificates. It can be the centralized or decentralized PKI system for issuing, managing, storing, verifying and distributing the key pairs, public key and private key, or one of the public key certificates. In public cloud, Data Owners and Data Users can upload or download their encrypted data along with services, resources and infrastructures in the hands of Cloud Service Provider. It creates the big security concerns in terms of data security and data privacy for the user and Cloud Service Provider is the sole responsibility to provide the Access Control Policy to restrict the cloud services centrally. With the emergence of cloud computing, Public Key Infrastructure (PKI) technology enables the secure communications in between systems. X.509 certificates are based on the centralized PKI and suffers so many issues in the public cloud. Gnu Privacy Guard (GnuPG) certificates are based on the decentralized PKI system. Imagine a world with decentralized PKI system in which each Kerberos is also a Central Authority for issuing certificates to the system or users. This proposed collaborative PKI framework describes the use of PKI in public cloud, proposed algorithm for Kerberos SSO token and provides acquisition of Public Key certificates from the client via Kerberized Central Authorities.

Classification as an approach to public key infrastructure requirements analysis

Classification schemes and taxonomy of request have focused only on business or software requirements defined by general non-functional requests. Public key infrastructure (PKI), as a complex system, requires special attention in the process of identification and definition of requests in all parts of the system. Requests efficiently identified and defined are the basis for successful PKI development and implementation. This study proposes a new classification scheme of requirements that enable effective identification of PKI requests in all system development life cycle phases. The proposed classification scheme has been designed in a way that can be used both by organisations just introducing a PKI system in their business operations, as well as organisations developing and implementing the PKI. Although there are more classification schemes and taxonomy of requests, the proposed classification scheme is the optimum solution for identification and definition of PKI system requests, as well as a good basis for testing, verification and validation of the PKI final product.

Efficient trust management with Bayesian-Evidence theorem to secure public key infrastructure-based mobile ad hoc networks

In mobile ad hoc networks (MANETs), the reliability of nodes, quality of data and access control cannot be achieved successfully for various network functionalities through traditional cryptographic security, which makes MANET vulnerable to illegitimate node behaviour changes. These node misbehaviours, referred as soft security threats, need to be detected and prevented in order to protect against the accumulation of false measurements with selfish and malicious intentions. Trust has been employed as a powerful tool to handle the soft security threats and to provide security among uncertain and dynamic nodes effectively in MANET. Therefore, it is of great importance that efficient trust management mechanisms should be developed in a public key infrastructure (PKI), in order to verify the identities on the ad hoc networks for reliable and secure group communication. However, the independent nature of nodes and the computational complexities make the trust management a challenging one in MANET. In this paper, we present an efficient distributed trust computation and misbehaviour verification method with Bayesian and Evidence theorem, on hexagonally clustered MANET. Besides, a secured PKI system is designed in the paper by applying the proposed trust management scheme in terms of certificate revocation, which is an important functionality of PKI cryptosystem. The uncertainty impacts the node’s anticipation of neighbour’s behaviour and decisions during communication; we include uncertainty in the trust management system. An efficient method to reduce the uncertainty is to exploit the mobility characteristics of MANET that accelerates the trust convergence. The simulation results reveal a better performance against adversaries in creating considerable untrustworthy transactions with a mobility-aware cluster guarantee. Moreover, the proposed trust application shows its betterment in the revocation process in terms of revocation rate and time. Thus, the proposed scheme provides an effective security solution that incorporates the optimistic features of trust mechanisms and hierarchical Voronoi clustering.

PKI SYSTEMS, DIRECTIVES, STANDARDS AND NATIONAL LEGISLATION

This paper describes Public Key Infrastructure (PKI). It is a platform for the realization of secure methods of information exchange based on public key cryptography. The introduction of these systems implies knowledge of the directives and standards prescribed by the organization for the introduction and improvement of standards. Similarly, the introduction of PKI system must meet the legal requirements prescribed by national legislation. This paper presents a list of organizations and standards related to PKI systems, and analysis of domestic legislation which is necessary to know prior to the realization of any specific methodology or implementation. The aim of this paper is an introduction to the problems of PKI systems and view at the basic regulations (directives, standards and legislation), whose knowledge is a prerequisite for the concrete implementation of these systems.

Certificate Revocation List Distribution Based on Road Map Distance Protocol (RMDP) in Vanet

Vehicular ad-hoc networking can provide efficient traffic information, emergency warning, alert messages and infotainment dissemination. It takes a vital role in safety fields such as defense system, traffic system, etc. Even though, some advanced Public Key Infrastructure and digital signature method was used for security, intrusion detection is an inevitable challenge in networks. Prevention and detection of malicious vehicle from jeopardizing the safety of the other vehicle is focused in this paper by using region-based FBB (Flooding-Bilinear-Bloom Filter) authentication protocol. Authentication is performed in any PKI (Public Key Infrastructure) system by checking if the certificate of the sender is included in the CRL (Certificate Revocation List) and verifying the authenticity and checking the sign of the sender. Bilinear pairing method is used to create an anonymous Id for each vehicle. The CRL checking process has been done using Bloom Filter method which avoids false negative. CRL can be passed between vehicles by bi-directional flooding method which avoids network congestion. This paper focuses mainly the CRL dissemination using the bi-directional flooding method. It replaces the time-consuming CRL Checking process. It reduces message loss ratio by using fast revocation checking and CRL updating method as well as it needs very less memory space compared to other methods.

Enhanced biometric encryption algorithm for private key protection in BioPKI system

Protection of private key is the most critical part in public key infrastructure (PKI) system since it depends on the confidentiality of private key. Thread of password detection has been known as the vulnerability in this PKI system. Recently, studies have been conducted on BioPKI system that uses the biometric information of users in order to replace the password type of private key protection in PKI system. However, BioPKI system also has vulnerability in that biometric information used for protection of private key cannot be reused once it is stolen or lost. So, we propose the method to protect the private key using FIDSEQi which binds sequence to biometric information. The proposed method enhances reusability of biometric information and presents higher attack complexity than the method of authentication by cross matching single biometric information.

Efficient Signcryption for Heterogeneous Systems

Privacy and authentication are the two main security goals in secure communications. To solve the secure communications problem between two heterogeneous systems, we propose two efficient signcryption schemes that can simultaneously achieve confidentiality, integrity, authentication, and nonrepudiation in a logical single step. The first scheme allows a sender in a public key infrastructure (PKI) to send a message to a receiver in an identity-based cryptosystem (IBC) and the second scheme allows a sender in the IBC system to send a message to a receiver in the PKI system. We prove that the first scheme has indistinguishability against adaptive chosen ciphertext attacks (IND-CCA2) under the q-bilinear Diffie-Hellman inversion problem (q-BDHIP) and existential unforgeability against adaptive chosen messages attacks (EUF-CMA) under the Diffie-Hellman inversion problem in the random oracle model. We also prove that the second scheme has the IND-CCA2 property under the BDHIP and EUF-CMA property under the q-strong Diffie- Hellman problem (q-SDHP) in the random oracle model.

EMAP: Expedite Message Authentication Protocol for Vehicular Ad Hoc Networks

Vehicular ad hoc networks (VANETs) adopt the Public Key Infrastructure (PKI) and Certificate Revocation Lists (CRLs) for their security. In any PKI system, the authentication of a received message is performed by checking if the certificate of the sender is included in the current CRL, and verifying the authenticity of the certificate and signature of the sender. In this paper, we propose an Expedite Message Authentication Protocol (EMAP) for VANETs, which replaces the time-consuming CRL checking process by an efficient revocation checking process. The revocation check process in EMAP uses a keyed Hash Message Authentication Code ({HMAC}), where the key used in calculating the {HMAC} is shared only between nonrevoked On-Board Units (OBUs). In addition, EMAP uses a novel probabilistic key distribution, which enables nonrevoked OBUs to securely share and update a secret key. EMAP can significantly decrease the message loss ratio due to the message verification delay compared with the conventional authentication methods employing CRL. By conducting security analysis and performance evaluation, EMAP is demonstrated to be secure and efficient.

Practical distributed secret key generation for delay tolerant networks

SUMMARYDelay tolerant networks (DTNs) are resource‐constrained dynamic networks where a continuous end‐to‐end connectivity is not always available. In such a challenging network, a fixed infrastructure may not be connected when a DTN is partitioned or the message delay in the network is large. Thus, the traditional public key infrastructure system and identity‐based encryption (IBE) system are not suitable for DTNs because they rely on centralized infrastructures and require multiple round‐trip interactions. To address this issue, we propose a distributed secret key generation system with self‐certified identity (SCI‐DKG) that does not require any private key generator and threshold cryptosystem. Initially, each node generates a private key and distributes an initial message including a self‐certified identity and secret sharings to members in a DTN. Receivers independently authenticate the identity and extracts some encryption parameters corresponding to the identity from this initial message. We prove that SCI‐DKG is chosen ciphertext secure in the standard model, and it can resist potential network attacks. Simulation results show that SCI‐DKG has smaller delay and higher successful ratio of secret key generation compared with IBE and hierarchical IBE systems implemented in a DTN. Copyright © 2012 John Wiley & Sons, Ltd.

The Security in the Vehicular Ad Hoc Network (VANET) Using Expedite Message Authentication Protocol (EMAP)

A vehicular ad hoc network (VANET) uses cars as mobile nodes in a MANET to create a mobile network. In the vehicular ad hoc networks the security is an important concern. For security, Vehicular ad hoc networks (VANETs) adopt the Public Key Infrastructure (PKI) and Certificate Revocation Lists (CRLs). In the Public Key Infrastructure system, the authentication of a received message is performed by checking if the certificate of the sender is included in the current Certificate Revocation Lists (CRLs) and verifying the authenticity of the certificate and signature of the sender. But it takes more time for CRL checking process. So, in order to overcome this problem we use an efficient revocation check process in EMAP uses a keyed Hash Message Authentication Code (HMAC), where the key used in calculating the HMAC is shared only between non-revoked On-Board Units (OBUs). In addition, EMAP uses a novel probabilistic key distribution, which enables non-revoked OBUs to securely share and update a secret key. By using this method we significantly reduces the message loss ratio. But in this method generating and verifying such signatures can cause high computational overhead. So, to conquer this trouble we introduce an innovative technique called ASIA as an Accelerated Secure In-network Aggregation strategy that can accelerate message verifications and significantly reduce computational overhead while retaining satisfactory security. ASIA can largely accelerate message verifications and drastically reduce computational and communication overhead compared to existing schemes.