A Decentralised Public Key Infrastructure for X-Road

Bakhtina, Mariia; Leung, K. C.; Matulevičius, Raimundas; Awad, Ahmed; Švenda, Petr

doi:10.1145/3600160.3605092

Cited by 1 publication

(2 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Through the literature review, we gathered a set of non-functional characteristics that affect ODI's security. In [5], we describe the literature procedure and provide a mapping of system characteristics with reviewed in Sect. 2.2 mechanisms.…”

Section: Targeted System Characteristicsmentioning

confidence: 99%

See 1 more Smart Citation

The Power of Many: Securing Organisational Identity Through Distributed Key Management

Bakhtina,

Kvapil,

Švenda

et al. 2024

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Organisational Digital Identity (ODI) often relies on the credentials and keys being controlled by a single person-representative. Moreover, some Information Systems (IS) outsource the key management to a third-party controller. Both the centralisation and outsourcing of the keys threaten data integrity within the IS, allegedly provided by a trusted organisation. Also, outsourcing the control prevents an organisation from cryptographically enforcing custom policies, e.g. time-based, regarding the data originating from it. To address this, we propose a Distributed Key Management System (DKMS) that eliminates the risks associated with centralised control over an organisation’s identity and allows organisation-enforceable policies. The DKMS employs threshold signatures to directly involve multiple organisation’s representatives (e.g. employees, IS components, and external custodians) in data signing on its behalf. The threshold signature creation and, therefore, the custom signing policy inclusion, is fully backwards compatible with commonly used signing schemes, such as RSA or ECDSA. The feasibility of the proposed system is shown in an example data exchange system, X-Road. The implementation confirms the ability of the design to achieve distributed control over the ODI during the operational key phase. Excluding a network delay, the implementation introduces less than 200 ms overhead compared to the built-in signing solution.

show abstract

Section: Targeted System Characteristicsmentioning

confidence: 99%

“…Figure 1 depicts artefacts used for key management that are discussed in this section. Here, we overview the cryptographic and business mechanisms found through the literature review, details of which can be found in [5]. The paper focuses on asymmetric cryptographic schemes that provide digital signatures.…”

Section: Review Of Key Management Mechanismsmentioning

confidence: 99%