Certificate Validation Research Articles

The Sorry State of TLS Security in Enterprise Interception Appliances

Network traffic inspection, including TLS traffic, in enterprise environments is widely practiced. Reasons for doing so are primarily related to improving enterprise security (e.g., phishing and malicious traffic detection) and meeting legal requirements (e.g., preventing unauthorized data leakage and copyright violations). To analyze TLS-encrypted data, network appliances implement a Man-in-the-Middle (MITM) TLS proxy by acting as the intended web server to a requesting client (e.g., a browser) and acting as the client to the actual/outside web server. As such, the TLS proxy must implement both a TLS client and a server and handle a large amount of traffic, preferably in real-time. However, as protocol and implementation layer vulnerabilities in TLS/HTTPS are quite frequent, these proxies must be at least as secure as a modern, up-to-date web browser and a properly configured web server (e.g., an A+ rating in SSLlabs.com). As opposed to client-end TLS proxies (e.g., as in several anti-virus products), the proxies in network appliances may serve hundreds to thousands of clients, and any vulnerability in their TLS implementations can significantly downgrade enterprise security. To analyze TLS security of network appliances, we develop a comprehensive framework, combining and extending tests from existing work on client-end and network-based interception studies. We analyze 13 representative network appliances over a period of more than a year (including versions before and after notifying affected vendors, a total of 17 versions) and uncover several security issues. For instance, we found that four appliances perform no certificate validation at all, three use pre-generated certificates, and eleven accept certificates signed using MD5, exposing their clients to MITM attacks. Our goal is to highlight the risks introduced by widely used TLS proxies in enterprise and government environments, potentially affecting many systems hosting security, privacy, and financially sensitive data.

Analysis of Event Marketing, Registration, and Ticketing Digitalization

Almost all parts in an organization both commercial and non-commercial must have held an event. No exception in the education, especially at the University. The number of events carried out on campus is a phenomenon that makes students who are members of organizations learn to organize it so that it can run well. Organizing events is not easy and requires a lot of energy, time and costs starting from marketing, registering, ticketing, participant validation, and distribution of certificates. The aim of this research is to analyze the ineffectiveness and inefficiencies that occur in running an event. Analysis and observations were made based on the processes that took place in the holding of events held by students at Universitas Atma Jaya Yogyakarta. The process will be simplified by utilizing digital media so that the process of making an event becomes more effective and efficient. This research resulted in a BPR (Business Re-engineering Process) in which the marketing, registration, and ticketing processes that were originally done manually were, converted to digital with a web-based system. It is expected that from this BPR, researchers can develop an application to digitalize marketing, online event registration, ticketing, and event validation using QR Code.
 
 Keywords— event; marketing; promotion; QR code; registration

An efficient voting based decentralized revocation protocol for vehicular ad hoc networks

Vehicular Ad-hoc NETworks (VANETs) enable cooperative behaviors in vehicular environments and are seen as an integral component of Intelligent Transportation Systems (ITSs). The security of VANETs is crucial for their successful deployment and widespread adoption. A critical aspect of preserving the security and privacy of VANETs is the efficient revocation of the ability of misbehaving or malicious vehicles to participate in the network. This is usually achieved by revoking the validity of the digital certificates of the offending nodes and by maintaining and distributing an accurate Certificate Revocation List (CRL). The immediate revocation of misbehaving vehicles is of prime importance for the safety of other vehicles and users. In this paper, we present a decentralized revocation approach based on Shamir’s secret sharing to revoke misbehaving vehicles with very low delays. Besides enhancing VANETs’ security, our proposed protocol limits the size of the revocation list to the number of the revoked vehicles. Consequently, the authentication process is more efficient, and the communication overhead is reduced. We experimentally evaluate our protocol to demonstrate that it provides a reliable solution to the scalability, efficiency and security of VANETs.

Continuous authentication for VANET

Vehicular Ad-hoc Network (VANET) services use a range of information, such as traffic conditions and location information, for safe and convenient driving. Information exchange in VANET happens in Vehicle-to-Infrastructure (V2I) and Vehicle-to-Vehicle (V2V) communication modes. Several V2I and V2V authentication protocol suites are proposed to protect the information from attacks, namely replay, masquerading and man-in-the-middle. This paper identifies critical weaknesses in the protocols proposed for V2I and V2V communication modes and proposes a new protocol suite as a countermeasure. Our protocol suite is composed of driver authentication, V2I and V2V key exchanges, information exchange, offline password change and vehicle complain protocols. Our V2I key exchange protocol facilitates handoff capability to ensure continuous authentication when vehicles move from the coverage of one roadside unit (RSU) to another. The protocol also assures detectability to denial-of-service (DoS). Our V2V key exchange protocol enables vehicles to verify the time-bounded validity of certificates of vehicles and integrity of keys. We use the random oracle model to prove the security of our key exchange protocols and prove various security attributes of the protocols informally. Tamarin tool is used to formally verify the security properties of our driver authentication and key exchange protocols. Performance comparisons show that our driver authentication and key exchange protocols assure lesser computation overhead and more functional attributes than the existing protocols. Simulation performance ensures the fast key dissemination capability of our protocol suite.

PRO DAN KONTRA SERTIFIKASI PERNIKAHAN

ABSTRACT Pre-marriage counseling programs or so-called bride-to-be courses can be organized by the Ministry of Religion, the Office of Religious Affairs or Agencies and Institutions that have been established by the Ministry of Religion. This guidance aims to provide knowledge about Islamic sharia in domestic life in order to reach families who are confident in mawaddah warahmah. This research is motivated by the Decree of the Director General of Islamic Community Guidance Number. 373 of 2017 concerning Technical Guidance for Marriage Guidance for Prospective Brides. In these rules only contain material / technical / managerial without any binding legal substance so that the phenomenon is now the pros and cons of the imposition of pre-marital certificate obligations in the requirements of marriage registration. This research is qualitative research with descriptive normative analysis studies. The approach used in this research is library research and field research, from this research that is as a journal so that it can be a source of reference about the pros and cons polemics of the validity of pre-marital certificates both for writing thesis, theses, papers, and journals as well as enriching teaching materials study at Ahwal Syakhsiyyah study program for students. In addition, the results of this study are expected to be used as a reference and benchmark for law enforcement and the community in assessing policy Keywords : Marriage, Prenuptial Certificate, Islamic Sharia

Verifiable secure computation of linear fractional programming using certificate validation

Outsourcing of scientic computations is attracting increasing attention since it enables the customers with limited computing resource and storage devices to outsource the sophisticated computation workloads into powerful service providers. However, it also comes up with some security and privacy concerns and challenges, such as the input and output privacy of the customers, and cheating behaviors of the cloud. Motivated by these issues, this paper focused on privacy-preserving Linear Fractional Programming (LFP) as a typical and practically relevant case for veriable secure multiparty computation. We will investigate the secure and veriable schema with correctness guarantees, by using normal multiparty techniques to compute the result of a computation and then using veriable techniques only to verify that this result was correct.

Factors for the implementation of electronic certification on small traditional boats and fishing vessels in Indonesia.

On September 2019, Directorate General of Sea Transportation, the government who in charge for the safe operation of ships in Indonesia, has introduced a new model of ship certification form. It is an electronic certificate that is used for traditional boat and fishing vessel of less than 7 gross tonnage. This electronic certificate is for the first time being applied to a ship in Indonesia. This marks a new era for ship certification in Indonesia. The conventional paper format of certification had been applied before it was changed to electronic certification.Indonesia is implementing electronic certificates on traditional vessels and fishing vessels of less than 7 gross tonnage due to several reasons. The first is the need for durable form material due to lifetime validation of certificates. The second due to problems related to misuse of previous type of conventional paper format certificates that caused difficulties in determining the number of this type of vessels in Indonesia.

Certification Validation Libraries

Certification Validation Libraries

Collaborative Validation of Public-Key Certificates for IoT by Distributed Caching

Public-key certificate validation is an important building block for various security protocols for IoT devices, such as secure channel establishment, handshaking, and verifying sensing data authenticity from cloud storage. However, certification validation incurs non-trivial overhead on resource-constrained IoT devices, because it either brings long latency or large cache space. This work proposes to utilize the power of distributed caching and explores the feasibility of using the cache spaces on all IoT devices as a large pool to store validated certificates. We design a Collaborative Certificate Validation (CCV) protocol including a memory-efficient and fast locator for certificate holders, a trust model to evaluate the trustworthiness of devices, and a protocol suite for dynamic update and certificate revocation. Evaluation results show that CCV only uses less than 25% validation time and reduces >90% decryption operations on each device, compared to a recent method. Malicious devices that conduct dishonest validations can be detected by the network using the proposed trust model.

APPROACH FOR VERIFICATION OF DIGITAL CERTIFICATES USING BLOCKCHAIN

The article is devoted to the implementation of its own approach to the verification of digital certificates using Blockchain direction to protect the Windows operating system. The methods of increasing the level of protection of the Windows operating system that can be used for certificate verification are analyzed and proposed. A new direction of Blockchain is proposed for the implementation of verification, due to the introduction of various verifications, which allows for a qualitative assessment of the authenticity of digital certificates. Today, Blockchain technology is perfect for checking, exchanging and protecting digital certificates. The list of the issuer and the recipient, the signature of the document in an open database, which is the same as in the computers on the open network, is stored. Compared to conventional digital certificates, certificates generated using blockchain technology has the following advantages: no need for intermediaries; certificate verification will be performed by an open source program; you can be sure exactly who and to whom the certificate was issued; the confidentiality of the document being signed is preserved. As you can see, this technology is able to create a powerful, secure, trusted and reliable structure that does not require any intermediaries or regular inspections. Due to the variety of inspection methods, the resources that this area provides, you can achieve maximum validation of both individual certificates and entire chain.Blockchain network is a guarantee of reliability and validity of data, but if someone still wants to confirm the validity of the certificate, you must obtain the public key of the person who signed it. Due to the lack of constant confirmation of certificates, this approach simplifies the administration of the network. The practical value of the study is as follows: the authors have proposed their own approach, which allows you to check single certificates and certificate chains thanks to the Blockchain direction, which allows you to establish a secure connection and reliable data transmission. Because the proposed approach allows multiple certificate checks, it can be further integrated into the Windows operating system and can be used to protect a personal computer or used in corporate structures.

Vulnerability Detection on Android Apps–Inspired by Case Study on Vulnerability Related With Web Functions

Nowadays, people's lifestyle is more and more dependent on mobile applications (Apps), such as shopping, financial management and surfing the internet. However, developers mainly focus on the implementation of Apps and the improvement of user experience while ignoring security issues. In this paper, we perform the comprehensive study on vulnerabilities caused by misuse of APIs and form a methodology for this type of vulnerability analysis. We investigate the security of three types of Android Apps including finance, shopping and browser which are closely related to human life. And we analyze four vulnerabilities including Improper certificate validation(CWE-295:ICV), WebView bypass certificate validation vulnerability(CVE-2014-5531:WBCVV), WebView remote code execution vulnerability(CVE-2014-1939:WRCEV) and Alibaba Cloud OSS credential disclosure vulnerability(CNVD-2017-09774:ACOCDV). In order to verify the effectiveness of our analysis method in large-scale Apps on the Internet, we propose a novel scalable tool - VulArcher, which is based on heuristic method and used to discover if the above vulnerabilities exist in Apps. We download a total of 6114 of the above three types of samples in App stores, and we use VulArcher to perform the above vulnerability detection for each App. We perform manual verification by randomly selecting 100 samples of each vulnerability. We find that the accuracy rate for ACOCDV can reach 100%, the accuracy rate for WBCVV can reach 95%, and the accuracy rate for the other two vulnerabilities can reach 87%. And one of vulnerabilities detected by VulArcher has been included in China National Vulnerability Database (CNVD) ID(CNVD-2017-23282). Experiments show that our tool is feasible and effective. For the convenience of researchers in related communities, We make our data and tool available at https://buptnsrclab.github.io/blog/2020/01/03/vularcher-site-launched.

ПЕРСПЕКТИВНІ МЕТОДИ ЗАХИСТУ ОПЕРАЦІЙНОЇ СИСТЕМИ WINDOWS

The article deals with the problem of ensuring information security of the Windows operating system and identifying promising security methods. This article identifies that the basic approach to operating system security is the "hardening of the operating system" process. The study presents statistics on the distribution of popular operating systems, namely Windows, Mac, Linux, Chrome, BSD. The analysis and classification of modern vulnerabilities of the operating system is made and the consequences of their action are given in the examples. These deficiencies can cause a computer system to intentionally violate the confidentiality, integrity and accessibility of information and the system as a whole. Based on the vulnerability analysis, the basic approaches and methods for the organization of protection of the operating system are determined. Standard approaches are discussed, namely the use of built-in security software, Active Directory security, and virtualization to deter attacks. Today, much attention is paid to cryptography and the principles of network, system, organizational and operational security, including risk analysis and disaster recovery, to ensure the security of the operating system. These approaches are basic and are a component of security in today's operating systems, but nowadays, using integrated approaches is more effective. A quick response to the violation of the integrity and accessibility of the operating system in combination with quenching, here are the main directions of development and improvement of the operating system. A rather new approach proposed in the article to protect Windows products is to use the Blockchain direction. It is currently used to validate digital certificates and can be said to have potential in other areas of operating system security. This paper shows examples of Blockchain implementation for certificate validation, taking into account some of the variations of validation. The examples are implemented in Python 3.0. The research of prospective methods and remedies of the operating system conducted in the article suggests that the use of system hardening is one of the effective and comprehensive approaches to providing security information, which will allow timely detection of vulnerabilities and timely response to violations of the basic properties of the operating system.

Aportes instrumentales y sustantivos de Blockchain a la educación

Blockchain breaks into the educational scenario offering alternatives for improvement over certain administrative processes, such as recognition of user identity, non-mediated validation of academic certificates, or the use of smart contracts, among other novelties. Futuristic chronicles predict a transformation of the architecture of the educational system as a whole and an unprecedented synergy between teachers, institutions and formal and non-formal areas of education. Although the advances are in their infancy and there isn’t much academic research on the subject yet, it is clear that Blockchain has great potential with regards to its administrative application. Some educational initiatives based on the model of multilateral technological platforms result to be interesting as well as challenging. It is necessary to warn, however, about the little contribution that the application of Blockchain technology entails in the pedagogical dimension, and about the uncertainty that hangs over the revolutionary claims of the most extreme prospects, which predict more transformative power than what the technology itself seems to offer.

API Misuse Detection in C Programs: Practice on SSL APIs

Libraries offer reusable functionality through Application Programming Interfaces (APIs) with usage constraints such as call conditions or orders. Constraint violations, i.e. API misuses, commonly lead to bugs and security issues. Although researchers have developed various API misuse detectors in the past few decades, recent studies show that API misuse is prevalent in real-world projects, especially for secure socket layer (SSL) certificate validation, which is completely broken in many security-critical applications and libraries. In this paper, we introduce SSLDoc to effectively detect API misuse bugs, specifically for SSL API libraries. The key insight behind SSLDoc is a constraint-directed static analysis technique powered by a domain-specific language (DSL) for specifying API usage constraints. Through studying real-world API misuse bugs, we propose ISpec DSL, which covers majority types of API usage constraints and enables simple but precise specification. Furthermore, we design and implement SSLDoc to automatically parse ISpec into checking targets and employ a static analysis engine to identify potential API misuses and prune false positives with rich semantics. We have instantiated SSLDoc for OpenSSL APIs and applied it to large-scale open-source programs. SSLDoc found 45 previously unknown security-sensitive bugs in OpenSSL implementation and applications in Ubuntu. Up to now, 35 have been confirmed by the corresponding development communities and 27 have been fixed in master branch.

Differential Testing of Certificate Validation in SSL/TLS Implementations

Certificate validation in Secure Sockets Layer or Transport Layer Security protocol (SSL/TLS) is critical to Internet security. Thus, it is significant to check whether certificate validation in SSL/TLS implementations is correctly implemented. With this motivation, we propose a novel differential testing approach that is based on the standard Request for Comments (RFC). First, rules of certificates are extracted automatically from RFCs. Second, low-level test cases are generated through dynamic symbolic execution. Third, high-level test cases, i.e., certificates, are assembled automatically. Finally, with the assembled certificates being test cases, certificate validations in SSL/TLS implementations are tested to reveal latent vulnerabilities or bugs. Our approach named RFCcert has the following advantages: (1) certificates of RFCcert are discrepancy-targeted, since they are assembled according to standards instead of genetics; (2) with the obtained certificates, RFCcert not only reveals the invalidity of traditional differential testing but also is able to conduct testing that traditional differential testing cannot do; and (3) the supporting tool of RFCcert has been implemented and extensive experiments show that the approach is effective in finding bugs of SSL/TLS implementations. In addition, by providing seed certificates for mutation approaches with RFCcert, the ability of mutation approaches in finding distinct discrepancies is significantly enhanced.

Legal Consequences Of Truth Ppat Deed Content, Price Transactions And Date Of Tax Deed After The Enactment Validation In The Boyolali District

The purpose of this study was to identify and analyze: 1) The verification and validation of the contents of the deed tax on PPAT, the price of the transaction and date of the deed PPAT in Boyolali. 2) Obstacles and solutions in the implementation process of verification and validation of tax. 3) The legal consequences of the truth of the PPAT deed, the price of the transaction and date of certificate validation of PPAT following the introduction of the tax in Boyolali.The approach method in this research is juridical empirical research that emphasizes the behavior of individuals or communities in connection with the law. The data used are primary and secondary data obtained through interviews and literature, methods of analysis with descriptive and qualitative analilis.Results of the research results can be concluded: 1) The verification and validation performed Income Tax Office (KPP) Boyolali while BPHTB conducted by the Department of Revenue Management and Asset Finance (DPPKAD) Boyolali. Validation includes the documents and the truth value of the transaction. Clear relation, the transaction value greatly affects the nominal income tax paid to the state. In making the PPAT AJB have to wait for the process validation and manufacturing of Sale and Purchase Agreements can not be specified price and date of the transaction. 2) Barriers due to the use of the transaction value as the basis for calculating BPHTB This has often led to problems in the field, because it is not uncommon transactions submitted by the taxpayer is not considered suitable by the taxman, so it is not uncommon to tax officials in the process of verification / validation, requesting that the transaction value changed and adapted according to the assessment of tax officials. 3) In making the PPAT deed lists the consequences of the transaction price and the date of the deed made and signed. This problem occurs on the inclusion of the transaction price and the date made after the validation is complete, and the parties have been facing the PPAT in early before the validation is performed. Inclusion of the transaction price and date of the deed at the time the parties may face different from the transaction price and the stairs after the validation process. PPAT in this case makes statements that do not fit can be subjected to verbal warning, written, suspension, dismissal with respect and disrespect.Keywords: Transfer of rights; PPAT; Taxes.

REVIEW ARTICLE: THE IMPORTANCE OF HALAL VALIDATION OF INGREDIENTS AS CRITICAL PARAMETER DURING HALAL AUDITS

As one of the biggest numbers of Muslim population in the world, Indonesia considering as one of potential market for food and beverages. Latest 3 years data showed products especially Food & Beverages produced by small & micro industries increased tremendously compared to medium & large enterprises. Among of Asean countries, the growth of consumer goods market in 5 years (2012 – 2017) increased significant (10 %) particularly packaged food and soft drinks. Therefore more challenges related with validity of raw material/ingredients Halal certification (its authenticity), validity of GMP and HACCP certification to guarantee “thoyyiban” during food processing and validity of halal supply chain from farm to table (documents authenticity). Interesting facts that due to scarcity of getting halal ingredients, producers tends to sifting to chemical process in orders to make halal audit easy. Unfortunately they ignore the sifting may create another health concern. Others concern are incompletely requirement such as Halal Certificate of ingredients, Certificate of Analysis, Material Safety Data Sheet and Food Processing Chart. Those documents often issued by traders instead of its manufactures (supposed to be). To improve and fasten the innovation, we propose some cooperation and network among ASEAN Halal institutions. Keywords: halal validation, ingredients, critical parameter, halal audit

CertLedger: A new PKI model with Certificate Transparency based on blockchain

In conventional PKI, CAs are assumed to be fully trusted. However, in practice, CAs’ absolute responsibility for providing trustworthiness caused major security and privacy issues. To prevent such issues, Google introduced the concept of Certificate Transparency (CT) in 2013. Later, several new PKI models are proposed to reduce the level of trust to the CAs. However, all of these proposals are still vulnerable to split-world attacks if the adversary is capable of showing different views of the log to the targeted victims. In this paper, we propose a new PKI architecture with certificate transparency based on blockchain, what we called CertLedger, to eliminate the split-world attacks and to provide certificate/revocation transparency. All TLS certificates’ validation, storage, and entire revocation process is conducted in CertLedger as well as Trusted CA certificate management. During a TLS connection, TLS clients get an efficient proof of existence of the certificate directly from its domain owners. Hence, privacy is now perfectly preserved by eliminating the traceability issue via OCSP servers. It also provides a unique, efficient, and trustworthy certificate validation process eliminating the conventional inadequate and incompatible certificate validation processes implemented by different software vendors. TLS clients in CertLedger also do not require to make certificate validation and store the trusted CA certificates anymore. We analyze the security and performance of CertLedger and provide a comparison with the previous proposals. Finally, we implement its protoype on Ethereum to demonstrate experimental results. The results show that the performance of the TLS handshake and certificate validation through CertLedger is significantly improved compared to the current TLS protocol.

ESKI-IBE: Efficient and secure key issuing identity-based encryption with cloud privacy centers

Digital certificate validation associated with traditional public key cryptosystems make it impractical in real-world environments due to their storage cost. The identity-based cryptosystems have been proven advantageous as they do not require any digital certificate validation and hence their storage. Due to the key escrow, user slandering and secure key issuing problems, IBE adoption is limited to the small networks only. The existing solutions either lose the identity-based feature or require high computation cost. In this paper, we propose a mechanism to generate the user’s private key in which we mitigate the trust on single PKG by replacing it with single semi-trusted key generation center (KGC), which authenticates the user and provide the partial private key and multiple cloud privacy centers (CPCs), which protect the user’s private key with their secret keys. In order to reduce the computation cost to generate the user’s private key, the maximum computations are offloaded to the CPCs, and only constant (very less) number of operations are run on the KGC. We use the ECC-based blind technique to secure the communication over a public channel. Using the proposed escrow-free private key generation mechanism, we design an identity based encryption scheme, which is semantically secured against IND-ID-CCA attack assuming BDH problem.

Birth Certificate Validity and the Impact on Primary Cesarean Section Quality Measure in New York State.

In New York (NY), birth certificate data are routinely used for assessing quality of care and health outcomes such as primary cesarean section (PCS) rates. However rare events are often underreported. This study compared birth certificates to medical records, and examined the impact of underreporting on risk adjustment variables for PCS. We conducted an internal validation study using a random sample of 702 NY births in 2009. Sensitivity and positive predictive value (PPV) of rare events reported on birth certificates were determined using abstracted and matched medical records as the gold standard. To assess the impact, we calculated PCS odds ratios for variables in the risk-adjustment model before and after correcting for measurement error. The sensitivity and PPV of birth certificate data elements including those in the PCS risk model varied from 0 to 100. After correction for measurement error, PCS odds ratios increased for most variables. For example, the PCS odds ratio for those with no prior live births was 3.03 (95% CI 2.94, 3.13), but after correction of measurement error increased to 3.46 (95% CI 3.22, 3.67). A composite negative event variable including abruptio placenta, eclampsia, or infection was the only variable that decreased after correction and was no longer significant (uncorrected OR 3.06, 95% CI 2.86, 3.29; corrected OR 1.42, 95% CI 0.79, 2.59). Underreporting on birth certificates remains concerning and impacts the risk adjustment for quality measures. Without improved data validity, health plans' quality metrics do not fully account for patient case-mix.