Certificate Validation Research Articles

Digital Certificate System for Verification & Validation of Educational Certificates using Block chain Technology

Abstract: With the proliferation of mobile devices in recent years, there is a tendency to move almost all real-world activities to the cyber world. Although this makes our daily life easier, it violates many security rules due to the anonymous nature of the Internet. Phishing attacks are the easiest way to get sensitive information from innocent users. Phishers aim to obtain sensitive information such as usernames, passwords, and bank account information. Cybersecurity professionals are looking for reliable and consistent detection methods to detect phishing websites. This project deals with machine learning technology to detect phishing URLs by extracting and analyzing various features of legitimate and phishing URLs. Decision trees, random forests, and support vector machine algorithms are used to identify phishing websites in a two-step process of first visualizing and extracting features of URLs using python libraries and then training them into a model using Gradient Classifier Algorithm to predict real-time phishing websites.

User Satisfaction Analysis of E-Samsat SUMUT Application Using End User Computing Satisfaction (EUCS) Approach

Technological developments have continued to develop until now and the community has even made it a necessity, one of which is the motorized vehicle tax payment processing service, where payments can be made via e-banking or a predetermined Bank ATM. Because of this, users believe that there is little to no difference between traditional Samsat and E-Samsat, the user returns to the Samsat Office to obtain validation of vehicle registration certificates (STNK). User satisfaction is formulating user satisfaction and comparing expectations and reality as follows: if expectations reality then very satisfied, if expectations = reality then satisfied and If expectations reality then not satisfied. The purpose of this study is to find out what factors influence user satisfaction in the North Sumatra E-Samsat application and recommendations to application developers so that user satisfaction does not decrease. This study uses quantitative methodology. Quantitative is a research method in which data collection techniques are carried out through surveys and questionnaire instruments and data analysis is carried out statistically. This study will use the End User Computing Satisfaction method, the EUCS method was chosen because it has 5 variables of content, accuracy, format, ease of use, and timeliness to measure factors that influence user satisfaction from information systems. The results of the discussion from this study using the EUCS method each variable get a score of 4 (satisfied) out of 5 total scores. But it's not perfect yet, so some improvements are needed to further increase user satisfaction.

CDNs’ Dark Side: Security Problems in CDN-to-Origin Connections

Content Delivery Networks (CDNs) play a vital role in today’s Internet ecosystem. To reduce the latency of loading a website’s content, CDNs deploy edge servers in different geographic locations. CDN providers also offer important security features including protection against Denial of Service (DoS) attacks, Web Application Firewalls (WAFs), and recently, issuing and managing certificates for their customers. Many popular websites use CDNs to benefit from both the security and the performance advantages. For HTTPS websites, Transport Layer Security (TLS) security choices may differ in the connections between end-users and a CDN (front-end or user-to-CDN), and between the CDN and the origin server (back-end or CDN-to-Origin). Modern browsers can stop/warn users if weak or insecure TLS/HTTPS options are used in the front-end connections. However, such problems in the back-end connections are not visible to browsers or end-users, and lead to serious security issues (e.g., not validating the certificate can lead to MitM attacks). In this article, we primarily analyze TLS/HTTPS security issues in the back-end communication; such issues include inadequate certificate validation and support for vulnerable TLS configurations. We develop a test framework and investigate the back-end connection of 14 leading CDNs (including Cloudflare, Microsoft Azure, Amazon, and Fastly), where we could create an account. Surprisingly, for all the 14 CDNs, we found that the back-end TLS connections are vulnerable to security issues prevented/warned by modern browsers; examples include failing to validate the origin server’s certificate, and using insecure cipher suites such as RC4, MD5, SHA-1, and even allowing plain HTTP connections to the origin. We also identified 168,795 websites in the Alexa top 1 million that are potentially vulnerable to Man-in-the-Middle (MitM) attacks in their back-end connections regardless of the origin/CDN configurations chosen by the origin owner.

OPTICAL CHARACTER RECOGNITION MENGGUNAKAN UIPATH DAN PENCOCOKAN DATA SERTIFIKAT DENGAN ALGORITMA LEVENSHTEIN DISTANCE

The collection of the certificates was one of the requirements for graduating from Tarumanagara University that the certificate became an important point of attention to improving the competency of Tarumanagara University students. Certificates can be collected from seminars, workshops, courses, and so forth. The Certificate Information Extraction design were created using Uipath Studio application that uses vb.Net programming language and Levenshtein Distance Algorithm. The design aims to assist the study program in validation on student certificates file by obtaining better accuracy using the Levenshtein Distance Algorithm.. The design uses input data as student certificates that’s next to be processed by text preprocessing consisting of text deductions (parsing), case folding, lexical analysis (tokenizing), and text removal (stopword removal). After processing, the Levenshtein Distance Algorithm will be used to calculate the minimum distance between one text and the other with a two-dimensional matrix operation, thus determining the validity of student certificates. The results of this design represent that using the Levenshtein Distance Algorithm, obtaining the best word accuracy result of 83.52% and RPA running time of 94.7 ms.

Coverage-directed Differential Testing of X.509 Certificate Validation in SSL/TLS Implementations

Secure Sockets Layer (SSL) and Transport Security (TLS) are two secure protocols for creating secure connections over the Internet. X.509 certificate validation is important for security and needs to be performed before an SSL/TLS connection is established. Some advanced testing techniques, such as frankencert , have revealed, through randomly mutating Internet accessible certificates, that there exist unexpected, sometimes critical, validation differences among different SSL/TLS implementations. Despite these efforts, X.509 certificate validation still needs to be thoroughly tested as this work shows. This article tackles this challenge by proposing transcert , a coverage-directed technique to much more effectively test real-world certificate validation code. Our core insight is to (1) leverage easily accessible Internet certificates as seed certificates and (2) use code coverage to direct certificate mutation toward generating a set of diverse certificates. The generated certificates are then used to reveal discrepancies, thus potential flaws, among different certificate validation implementations. We implement transcert and evaluate it against frankencert , NEZHA , and RFCcert (three advanced fuzzing techniques) on five widely used SSL/TLS implementations. The evaluation results clearly show the strengths of transcert : During 10,000 iterations, transcert reveals 71 unique validation differences, 12×, 1.4×, and 7× as many as those revealed by frankencert , NEZHA , and RFCcert , respectively; it also supplements RFCcert in conformance testing of the SSL/TLS implementations against 120 validation rules, 85 of which are exclusively covered by transcert -generated certificates. We identify 17 root causes of validation differences, all of which have been confirmed and 11 have never been reported previously. The transcert -generated X.509 certificates also reveal that the primary goal of certificate chain validation is stated ambiguously in the widely adopted public key infrastructure standard RFC 5280.

Lightweight certificate revocation for low-power IoT with end-to-end security

Public key infrastructure (PKI) provides the basis of authentication and access control in most networked systems. In the Internet of Things (IoT), however, security has predominantly been based on pre-shared keys (PSK), which cannot be revoked and do not provide strong authentication. The prevalence of PSK in the IoT is due primarily to a lack of lightweight protocols for accessing PKI services. Principal among these services are digital certificate enrollment and revocation, the former of which is addressed in recent research and is being pushed for standardization in IETF. However, no protocol yet exists for retrieving certificate status information on constrained devices, and revocation is not possible unless such a service is available.In this work, we start with implementing the Online Certificate Status Protocol (OCSP), the de facto standard for certificate validation on the Web, on state-of-the-art constrained hardware. In doing so, we demonstrate that the resource overhead of this protocol is unacceptable for highly constrained environments. We design, implement and evaluate a lightweight alternative to OCSP, TinyOCSP, which leverages recently standardized IoT protocols, such as CoAP and CBOR. In our experiments, validating eight certificates with TinyOCSP required 41% less energy than validating just one with OCSP on an ARM Cortex-M3 SoC. Moreover, validation transactions encoded with TinyOCSP are at least 73% smaller than the OCSP equivalent.We design a protocol for compressed certificate revocation lists (CCRL) using Bloom filters which together with TinyOCSP can further reduce validation overhead. We derive a set of equations for computing the optimal filter parameters, and confirm these results through empirical evaluation.

Ship Surveys and Certification During Global Health Pandemics; Challenges and Opportunities Presented by COVID-19

This article examines how flag states, port states, and the shipping industry have attempted to fulfill their obligations to carry out mandatory ship surveys and certification in response to challenges arising from the COVID-19 pandemic and provides guidance for future pandemics. Although the International Maritime Organization (IMO) Conventions do not have procedures to deal with the impacts of global pandemics on ship surveys and certification, the IMO has provided guidance via circular letters, taking a pragmatic and practical approach. Several flag states extended the validity of certificates by taking either a case-by-case or a blanket approach within the statutory maximum of three months. With regard to the extension beyond the statutory period of three months, flag states should consider requests using an evidence-based assessment on a case-by-case basis. Classification societies play an important role in the extension of the validity of certificates by providing their technical expertise and recommendations. Port state control serves as a safety net in the event that flag states do not comply with their obligations. In this regard, cooperation between flag states, port states, and classification societies is key to managing survey and certification during a pandemic. Moreover, the COVID-19 pandemic has demonstrated an accelerated need for the development of remote surveys. It has also illustrated a need to develop guidance on remote surveys under exceptional circumstances in order to respond to future pandemics.

A trust management model in internet of vehicles

The Internet of Things (IoT) is one of the most evolving technologies, which has a major impact on our daily life. Almost all new devices will have a feature to be connected and controlled over the Internet. Several applications are utilizing IoT to enhance routine processes and actions efficiently. The Internet of Vehicles (IoV) evolved from IoT, where vehicles communicate with each other or with other objects to have a better transportation environment to reduce the number of accidents and save people’s lives. IoV is considered new fields that need security requirements including confidentiality, integrity, availability, authentication, and trust. Trust management technique is used to validate entities behaviors automatically against well-defined policies. The major categories of trust model in IoV are based on entity, data, or a combination of both. This paper proposes a trust model which is based on a combination of entity and data to define the trust of vehicles and utilize the public key infrastructure to distribute certificates to vehicles. Based on certificate validation, messages will be trusted and accepted. This model has been tested across different simulation scenarios which showed that the proposed model detected malicious vehicles and trusted vehicles did not accept their messages.

Blockchain based Certificate Validation

Certificate management is a tedious task for any university or any other organization. These schemes impose problems in Public Key Infrastructure (PKI). Checking the validity and preserving the security of these documents is of utmost importance. In this work, we have devised a blockchain-based solution for preventing malfunctioning in certificate validation which is an important step for any university. Each certificate is uploaded in its hash format and is stored using blockchain. The hashes are stored in unique transactions in nodes, which are deployed on a private network. Using the SHA-256 hashing algorithm, the certificates are uploaded into the system and can be viewed by anyone with the right credentials. Due to the usage of blockchain technology, the certificates are stored in a decentralized manner, which ensures there is no central point of failure. Any changes in the uploaded document need to be validated by other nodes. This paper also improvises that when certificate uploading is required new nodes are added, instead of modifying the past blocks. This work provides a very user-friendly app where any user with the right credentials can upload documents. In this work, digitized documents are stored using Inter Planetary File System (IPFS) which is distributed method of storage. Our theoretical analysis proves that it is a user-friendly application with the security of blockchain technology in partnership with IPFS. Only the issuer can upload documents and others can only view them. Using our proposed solution, problem of malicious certificates can be tackled with E-certification. The proposed method solves all the issues of storing, validating, and sharing documents. Chaotic Map technique is used in hash generation which is quite simple to implement. The proposed approach Chaotic Key based Certificate validation (CK-Cert) provides a hassle-free solution for certificate managements since it better manages the block size as compared to previously proposed techniques (PBCert and CertChain) as discussed with the help of graphs.

L-ECQV: Lightweight ECQV Implicit Certificates for Authentication in the Internet of Things

The vast expansion of the Internet of Things (IoT) devices and related applications has bridged the gap between the physical and digital world. Unfortunately, security remains a major challenge and the lack of secure links have fueled the increased attacks on IoT devices and networks. Due to its inherent scalability, Public Key Infrastructure (PKI) is the well-known and classic approach to bring public-key certificate based security to IoT. Even though the standard X.509 explicit certificates can be viable solution, they are inefficient and too large for resource constrained IoT networks and therefore, smaller, faster and more efficient Elliptic Curve Qu Vanstone (ECQV) implicit certificates can be employed for establishing authenticated connections in IoT. Moreover, the existing certificate-based authentication proposals in standardized IoT networks have either been deployed at the transport or physical layers. Thus, these proposals fail to provide true end-to-end security to messages at the application layer in the presence of intermediate CoAP proxies. This challenging aspect is addressed in this proposal by focusing on the certificate-based authentication at the application layer to ensure true end-to-end security of messages. Additionally, IoT application layer security protocols like EDHOC lacks mechanism for authenticated distribution of public keys and thus, there is a need for lightweight authentication based cryptographic primitive for establishing secure key agreement in IoT. This paper introduces a design and implementation of a lightweight ECQV implicit certificate and use them for authenticated key exchange in EDHOC at the application layer. We also design a lightweight profile with a novel encoding mechanism for ECQV implicit certificate, called L-ECQV. To prove its viability, L-ECQV has been implemented and evaluated on Contiki operating system. Our evaluation results show that the proposed L-ECQV certificate approach reduces energy consumption by 27%, message overhead of EDHOC handshake by 52%, and shows improvements in certificate validation time. The security analysis demonstrates that proposed L-ECQV certificates for EDHOC protocol is secure against a number of attack vectors present in the IoT network. This novel combination of ECQV certificates with EDHOC key exchange leads to a secure and lightweight authenticated key agreement in IoT networks.

A CONVERGENCE IN A RELIGION COMMODIFICATION AND AN EXPRESSION OF PIETY IN HALAL CERTIFICATION

The relationship among globalization, modernity, the escalation of religiosity in Southeast Asia, and capitalism cause halal trend consumption raising. The phenomenon of halal certification in Indonesia is interpreted by scholars in myriads of thoughts. Some scholars describe it as a form of religion commodification with more profit oriented, rather than referring to Islamic values or the philosophy of the halal concept. The Islamic symbols are used as trading commodities or marketing goods. The other scholars interpret the issue as an effort to manifest the religious teaching and an expression of piety. Halal certification is a diffusivity phenomenon of sacred (concept of halal, piety) with profane thing (trade and commodification). The existence of halal certification in Indonesia is urgent owing to the inability to control the escalation of products distribution in the domestic market as a result of the food technology, technological engineering, biotechnology and biological chemical processes developments. Moreover, the condition of Muslim in Indonesia and one of the expression of piety is by consuming halal products. Anthropological studies indicate that the character of religious people is always destined to seek and ensure that what is consumed does not hinder their intimacy with God because purity and impurity is important for religious people regarding to the supernatural presence. In fact, there is a contiguity between commodification and an expression of piety in halal certification. It could be interpreted simultaneously to find the convergence. The importance of supervising the halal certification validation agency and the creation of legal verdict must be proceed.

Surat Keterangan Hak Waris Dalam Ketentuan Hukum Waris Nasional

This research was discussing the regulation about Inheritance Rights certificate, About Inheritance Specification form are not made out in the legal form, so the certificate of inheritance right including by the privat document (subscribed deeds). The Legal form about Inheritance Right certificate just regulated in article 111 (1) c he Regulated by minister of Agrarian number 3/1997 about implementation of the provisions of government number 24/1997 on land Registration (PMNA 03/1997), which is about the officials authorized to issue Descrcription Inheritance Right certificate based on group population and the implementing the regulations in society for a legal evidence in the transfer of rights due to inheritance. The research was conducted using the normative research is library research on secondary data in the fields of law, based on the systematic regulations in Indonesia. In the processing, analysis and conctructionof qualitative data, which are mono-disciplianary, research typologies problem identification and problem solution by prescriptive-explanatory achieve solution to solve problems concerning inheritance issued the official was authorized, also from the point of application to a problem focused, also from the point of application to a problem focused research to provide legal certainty, the inheritance right certificate made by each other. And the efforts should be made to ensure legal certainty regarding the accuracy of the validity of the inheritance certificate is to formulate a legal product regarding the form and content of the inheritance certificate which is to accommodate the needs of the heirs so that the effectiveness of the proof is not confusing and on target.

Proofs and Certificates for Max-SAT

Current Max-SAT solvers are able to efficiently compute the optimal value of an input instance but they do not provide any certificate of its validity. In this paper, we present a tool, called MS-Builder, which generates certificates for the Max-SAT problem in the particular form of a sequence of equivalence-preserving transformations. To generate a certificate, MS-Builder iteratively calls a SAT oracle to get a SAT resolution refutation which is handled and adapted into a sound refutation for Max-SAT. In particular, we prove that the size of the computed Max-SAT refutation is linear with respect to the size of the initial refutation if it is semi-read-once, tree-like regular, tree-like or semi-tree-like. Additionally, we propose an extendable tool, called MS-Checker, able to verify the validity of any Max-SAT certificate using Max-SAT inference rules. Both tools are evaluated on the unweighted and weighted benchmark instances of the 2020 Max-SAT Evaluation.

Defense against SSDF Attack and PUE Attack in CR-Internet of Vehicles (IoVs) for Millimeter Wave Massive MIMO Beamforming Systems

The Internet of Vehicles (IoV) is witnessed to play the leading role in the future of Intelligent Transportation Systems (ITS). Though many works have focused on IoV improvement, there is still a lack of performance due to insufficient spectrum availability, lower data rates, and the involvement of attackers. This paper considers all three issues by developing a novel mmWave-assisted Cognitive Radio based IoV (CR-IoV) model. The integration of CR in IoV resolves the issue of spectrum management, while mmWave technology ensures symmetry in acquiring higher data rates for Secondary Users (SUs). With the proposed mmWave-assisted CR-IoV model, symmetric improvements in network performance were achieved in three main areas: security, beamforming, and routing. Optimum detection mechanisms isolate malicious Secondary Users (SUs) in the overall network. First, Spectrum Sensing Data Falsification (SSDF) attack is detected by a Hybrid Kernel-based Support Vector Machine (HK-SVM), which is the lightweight Machine Learning (ML) technique. Then, the Primary User Emulation (PUE) attack is detected by a hybrid approach, namely the Fang Algorithm-based Time Difference of Arrival (FA-TDoA) method. Further, security is assured by validating the legitimacy of each SU through a Lightweight ID-based Certificate Validation mechanism. To accomplish this, we employed the Four Q-curve asymmetric cryptographic algorithm. Overall, the proposed dual-step security provisioning approach assures that the network is free from attackers. Next, beamforming is performed for legitimate SUs by a 3D-Beamforming algorithm that relies on Array Factor (AF) and Beampattern Function. Finally, routing is enabled by formulating Forwarding Zone (FZ) based on the forwarding angle. In the forwarding zone, optimal forwarders are selected by the Multi-Objective Whale Optimization (MOWO) algorithm. Here, a new potential score is formulated for fitness evaluation. Finally, the proposed mmWave-assisted CR-IoV model is validated through extensive simulations in the ns-3.26 simulation tool. The evaluation shows better performance in terms of throughput, packet delivery ratio, delay, bit error rate, and detection accuracy.

A Secure Two-Tier Domain Verification and Certificate Validation Integrating Intermediate Certificate Authorities and Secure Certificate Box

Digital certificates play a key role in the public key infrastructure (PKI). They are mainly used to secure communication between a browser and a webserver to keep the transmitted data safe from interception. Digital certificates are issued by certificate authorities (CAs). Numerous CAs serve as root CAs around the world. Moreover, root CAs can delegate intermediate CAs (ICAs). Any CA can issue a certificate for any entity on the internet world. However, it will be difficult for an end user to identify which authorities are trustworthy and genuine. In addition, adversaries can quickly induce fraudulent certificates due to a lack of rigorous background checks for domain possession at the time of certificate issuance. Our work is primarily oriented towards incorporating the domain validation and certificate validity check from the client side as an additional security fortification. This is in addition to a novel associative approach for domain validation using ICAs. This paper presents a novel two-tier system for domain validation of servers. The system operates at two levels. At the first level, an associative validation of the domains by making use of multiple ICAs is employed. A set of CAs validates domain ownership before issuing the certificate to prevent false issuance of the certificate. In addition to this, during the initiation of the client–server connection, the client itself validates the certificate to make sure that the certificate received securely from any webserver is a genuine one.

Improving efficiency and security of IIoT communications using in-network validation of server certificate

The use of advanced communications and smart mechanisms in industry is growing rapidly, making cybersecurity a critical aspect. Currently, most industrial communication protocols rely on the Transport Layer Security (TLS) protocol to build their secure version, providing confidentiality, integrity and authentication. In the case of UDP-based communications, frequently used in Industrial Internet of Things (IIoT) scenarios, the counterpart of TLS is Datagram Transport Layer Security (DTLS), which includes some mechanisms to deal with the high unreliability of the transport layer. However, the (D)TLS handshake is a heavy process, specially for resource-deprived IIoT devices and frequently, security is sacrificed in favour of performance. More specifically, the validation of digital certificates is an expensive process from the time and resource consumption point of view. For this reason, digital certificates are not always properly validated by IIoT devices, including the verification of their revocation status; and when it is done, it introduces an important delay in the communications. In this context, this paper presents the design and implementation of an in-network server certificate validation system that offloads this task from the constrained IIoT devices to a resource-richer network element, leveraging data plane programming (DPP). This approach enhances security as it guarantees that a comprehensive server certificate verification is always performed. Additionally, it increases performance as resource-expensive tasks are moved from IIoT devices to a resource-richer network element. Results show that the proposed solution reduces DTLS handshake times by 50–60 %. Furthermore, CPU use in IIoT devices is also reduced, resulting in an energy saving of about 40 % in such devices.

A Privacy-Preserving and Transparent Identity Management Scheme for Vehicular Social Networking

Vehicular social networking is expected to become a reality soon, where secure and privacy-preserving identity management is a prerequisite. Various organizations and studies have recommended using Vehicular Public-key Infrastructure (VPKI) to securely and privately manage vehicles' identities. However, the existing VPKI schemes still do not deal with identity management in vehicular social networking. In this work, we propose a Privacy-Preserving Identity Management (PPTIM) scheme for vehicular social networking to securely and privately manage vehicles' social identities. PPTIM builds on the transparency log (distributed ledger) proposals for web PKI, but it addresses challenges specific to vehicular social networking. All pseudo-social identities, pseudonym certificates issued against pseudo-social identities, revocation process, and revocation status validation are conducted on a transparency log. With an efficient data structure named the Accumulation Tree (AT), we extend the conventional transparency log to offer trustworthy pseudonym certificate validation without relying on the Certificate Revocation Lists (CRLs). In addition, PPTIM strengthens the security of vehicular social networking by protecting vehicles to a greater extent from being duped by malicious pseudonym certificates through logging and constant monitoring. Finally, performance and security analysis show the cost-effectiveness and security of PPTIM.

Development and expert-evaluation of FORENSICA-android application for estimating post-mortem interval

Death registration is very important and has civil and legal impact on the deceased person and their family. Validity of a death certificate is influenced by the time accuracy of death estimation. Calculation of the post-mortem interval has a central role in the estimation of the time of death, especially for death cases in the community, without prior medical observation. This study aimed to develop a smartphone application for counting the estimated time of death based on android features, to help doctors establish a more accurate time of death and provide a learning facility for doctors and medical student. This action research consisted of 4 cycles: 1) Planning, 2) Action, 3) Observation, and 4) Reflection. The final result of this study is an android application named Forensica 3rd version. This application was developed in Bahasa Indonesia. This application has a menu for recording the patient identity, instructions for post-mortem changes examination, record examination results, time of death calculation and its interpretation. This 3rd version of the application is the latest version after undergoing two revisions. The Forensica application provides an easy way for doctors and medical students to establish the time of death estimation and it is user-friendly.

Legal Development of the Validity of Electronic Mortgage Certificates in the Land Registration System in Indonesia

<em>Electronic encumbrance Right is one of the breakthroughs made by the Minister of Agrarian Affairs to improve services in the land sector and support the Government in realizing a digital bureaucracy in Indonesia. This paper aims to deeply examine the validity and execution of such electronic Encumbrance Right Certificates.The main findings show that the electronic Encumbrance Right Certificate cannot be separated from the provisions of the Electronic Information and Transactions law, which lays out the conditions that must be met for the validity of electronic certificates and their status as evidence in court. The problem of authentication differs from the acknowledgement of electronic data. If the data or electronic documents are accepted or legally recognized, the authentication process for the data will automatically follow. The authentication process is a matter of technology while acknowledging electronic documents involves formal recognition in laws and regulations. Electronic evidence consisting of Electronic Information or Electronic Documents or the printouts produced by the Electronic System is legal evidence. On the other hand, if the Electronic Information is not generated through the Electronic System, the evidence cannot automatically be assessed as valid. Such electronic information can be used as electronic evidence if the authenticity, accuracy, and integrity have been verified through an information technology forensic audit</em>

Highly private blockchain-based management system for digital COVID-19 certificates

As a result of the declaration of the COVID-19 pandemic, several proposals of blockchain-based solutions for digital COVID-19 certificates have been presented. Considering that health data have high privacy requirements, a health data management system must fulfil several strict privacy and security requirements. On the one hand, confidentiality of the medical data must be assured, being the data owner (the patient) the actor that maintain control over the privacy of their certificates. On the other hand, the entities involved in the generation and validation of certificates must be supervised by a regulatory authority. This set of requirements are generally not achieved together in previous proposals. Moreover, it is required that a digital COVID-19 certificate management protocol provides an easy verification process and also strongly avoid the risk of forgery. In this paper we present the design and implementation of a protocol to manage digital COVID-19 certificates where individual users decide how to share their private data in a hierarchical system. In order to achieve this, we put together two different technologies: the use of a proxy re-encryption (PRE) service in conjunction with a blockchain-based protocol. Additionally, our protocol introduces an authority to control and regulate the centers that can generate digital COVID-19 certificates and offers two kinds of validation of certificates for registered and non-registered verification entities. Therefore, the paper achieves all the requirements, that is, data sovereignty, high privacy, forgery avoidance, regulation of entities, security and easy verification.