Certificate Revocation List Distribution System for the KAD Network

Caubet, Juan; Gañán, Carlos; Esparza, Óscar; Muñoz, José L.; Mata‐Díaz, Jorge; Alins, Juanjo

doi:10.1093/comjnl/bxt037

Cited by 4 publications

(3 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Efficient Revocation. In addtion to updating the VRL at every DS key renewal phase, the vehicle network could utilize various revocation list update algorithms [14], [17] to keep an updated VRL. Additionally, a vehicle can use probabilistic algorithms with statistical distribution models [35] to speedup revocation and improve confidence on security.…”

Section: Limitations and Future Workmentioning

confidence: 99%

Towards a TEE-based V2V Protocol for Connected and Autonomous Vehicles

Jangid¹,

Lin²

2022

Proceedings Fourth International Workshop on Automotive and Autonomous Vehicle Security

View full text Add to dashboard Cite

any misbehavior in the CAV communication should be prohibited and investigated. Therefore, the data management of the CAV network should include dynamic revocation and accountability of (malicious or compromised) vehicles.To address these challenges, many prior efforts (e.g., [3], [12], [28]) advocate the use of certificate-based authentication to meet the demands of CAV infrastructure security such as authentication as well as scalability and efficiency, inspired by the practice from Internet-based network [19], [21]. Unfortunately, such a certificate-based authentication requires frequent asymmetric key encryption and decryption and communication with centralized public-key infrastructures, thereby hindering their practicality, particularly when considering the fact that multiple on-road vehicles can form an ad-hoc network at arbitrary moment and there is a need to instantly authenticate a vehicle and trust its communication.In this paper, we propose a new Vehicle-to-Vehicle (V2V) protocol by leveraging the Trusted Execution Environment (TEE) of in-vehicle processors. In particular, we notice many of the security and efficiency demands can be met without involving certificates and frequent asymmetric key encryption and decryption if we can leverage TEE and use a TEE protected temporal (e.g., daily) symmetric key-based communication protocol. Specifically, in such a protocol, many security demands such as confidentiality, authenticity and replay protection can be achieved naturally by using securely provisioned Daily Symmetric (DK) keys protected by TEE. The changing symmetric keys are further stored in the TEE protected sealed storage to prevent a malicious OS or other privileged software from stealing or modifying the sensitive information. Such a TEE based authentication removes the pairwise key exchange overhead when using certificate-based authentication, allowing instantly broadcast of encrypted data.To strike the balance between privacy and utility, we also choose to associate a temporary random vehicle identifier (TID) with all the vehicle activities to protect driver's (or user's) privacy. In particular, the TID is derived from a Vehiclespecific Root Key (VRK) stored in a sealed storage as well as the servers of trusted authorities such as Bureau of Motor Vehicles (BMV). All CAV network activities, containing TID, are logged by road side units (e.g., the edge servers, and smart traffic lights). Only when there is an accident or security breach, the VRK will be revealed to forensics investigators. Based on the VRK, the forensics investigators can further locate the vehicle owners and hold them accountable if they commit any crimes. Strict access control will be enforced for the database server to ensure only those who have the permission is allowed to review the VRK information. Additionally,

show abstract

Section: Limitations and Future Workmentioning

confidence: 99%

Towards a TEE-based V2V Protocol for Connected and Autonomous Vehicles

Jangid¹,

Lin²

2022

Proceedings Fourth International Workshop on Automotive and Autonomous Vehicle Security

View full text Add to dashboard Cite

show abstract

“…Huang et al ., in , propose to introduce hierarchy in the distributed structure to reduce the number of requests to the CA. In , we propose a new distributed revocation system, which divides the CRLs into segments and distributes them using the overlay itself. Authors of propose a new revocation system based on the Chord network where nodes store the revocation information but without using CRLs.…”

Section: Robust Identity Assignment Protocol For P2p Overlaysmentioning

confidence: 99%

RIAPPA: a Robust Identity Assignment Protocol for P2P overlays

Caubet

Esparza

Muñoz

et al. 2014

Security Comm Networks

View full text Add to dashboard Cite

Peer-to-peer (P2P) overlay networks have been proposed to solve routing problems of big distributed infrastructures, even for Internet scale. But the research community has been questioning the security of these networks for years. Most prior work in security services was focused on trust and reputation systems, anonymity, and secure routing. However, the proper management of identities in overlays is an important prerequisite to provide most of these security services. In this paper, we propose a protocol to control the access to a P2P overlay and to assign identities in a secure way; all this preserving the anonymity of users. This protocol involves two trusted third parties (TTPs), thanks to which it is possible to preserve the users' anonymity within the network without losing traceability. Users are authenticated by a TTP using real-world digital certificates, they select their network identifier jointly with the other TTP, and finally, the two TTPs issue the internal certificate to them. The protocol also provides revocability and protection against Sybil attacks, Eclipse attacks, whitewashers, and so on. A detailed protocol description is presented, and a performance and security analysis of the protocol is also provided.

show abstract

“…In this Chapter, we present a new distributed revocation system [38] that tries to optimize both the availability of the revocation data and its freshness. improve the CRL updating policy maintaining all the security properties of a traditional revocation system; CRL segments are updated independently and provided when a CA considers necessary.…”

Section: Discussionmentioning

confidence: 99%

Secure identity management in structured peer-to-peer (P2P) networks

Caubet Fernández

View full text Add to dashboard Cite

Structured Peer-to-Peer (P2P) networks were proposed to solve routing problems of big distributed infrastructures. But the research community has been questioning their security for years. Most prior work in security services was focused on secure routing, reputation systems, anonymity, etc. However, the proper management of identities is an important prerequisite to provide most of these security services. The existence of anonymous nodes and the lack of a centralized authority capable of monitoring (and/or punishing) nodes make these systems more vulnerable against selfish or malicious behaviors. Moreover, these improper usages cannot be faced only with data confidentiality, nodes authentication, non-repudiation, etc. In particular, structured P2P networks should follow the following secure routing primitives: (1) secure maintenance of routing tables, (2) secure routing of messages, and (3) secure identity assignment to nodes. But the first two problems depend in some way on the third one. If nodes’ identifiers can be chosen by users without any control, these networks can have security and operational problems. Therefore, like any other network or service, structured P2P networks require a robust access control to prevent potential attackers joining the network and a robust identity assignment system to guarantee their proper operation. In this thesis, firstly, we analyze the operation of the current structured P2P networks when managing identities in order to identify what security problems are related to the nodes’ identifiers within the overlay, and propose a series of requirements to be accomplished by any generated node ID to provide more security to a DHT-based structured P2P network. Secondly, we propose the use of implicit certificates to provide more security and to exploit the improvement in bandwidth, storage and performance that these certificates present compared to explicit certificates, design three protocols to assign nodes’ identifiers avoiding the identified problems, while maintaining user anonymity and allowing users’ traceability. Finally, we analyze the operation of the most used mechanisms to distribute revocation data in the Internet, with special focus on the proposed systems to work in P2P networks, and design a new mechanism to distribute revocation data more efficiently in a structured P2P network. Las redes P2P estructuradas fueron propuestas para solventar problemas de enrutamiento en infraestructuras de grandes dimensiones pero su nivel de seguridad lleva años siendo cuestionado por la comunidad investigadora. La mayor parte de los trabajos que intentan mejorar la seguridad de estas redes se han centrado en proporcionar encaminamiento seguro, sistemas de reputación, anonimato de los usuarios, etc. Sin embargo, la adecuada gestión de las identidades es un requisito sumamente importante para proporcionar los servicios mencionados anteriormente. La existencia de nodos anónimos y la falta de una autoridad centralizada capaz de monitorizar (y/o penalizar) a los nodos hace que estos sistemas sean más vulnerables que otros a comportamientos maliciosos por parte de los usuarios. Además, esos comportamientos inadecuados no pueden ser detectados proporcionando únicamente confidencialidad de los datos, autenticación de los nodos, no repudio, etc. Las redes P2P estructuradas deberían seguir las siguientes primitivas de enrutamiento seguro: (1) mantenimiento seguro de las tablas de enrutamiento, (2) enrutamiento seguro de los mensajes, and (3) asignación segura de las identidades. Pero la primera de los dos primitivas depende de alguna forma de la tercera. Si las identidades de los nodos pueden ser elegidas por sus usuarios sin ningún tipo de control, muy probablemente aparecerán muchos problemas de funcionamiento y seguridad. Por lo tanto, de la misma forma que otras redes y servicios, las redes P2P estructuradas requieren de un control de acceso robusto para prevenir la presencia de atacantes potenciales, y un sistema robusto de asignación de identidades para garantizar su adecuado funcionamiento. En esta tesis, primero de todo analizamos el funcionamiento de las redes P2P estructuradas basadas en el uso de DHTs (Tablas de Hash Distribuidas), cómo gestionan las identidades de sus nodos, identificamos qué problemas de seguridad están relacionados con la identificación de los nodos y proponemos una serie de requisitos para generar identificadores de forma segura. Más adelante proponemos el uso de certificados implícitos para proporcionar más seguridad y explotar las mejoras en consumo de ancho de banda, almacenamiento y rendimiento que proporcionan estos certificados en comparación con los certificados explícitos. También hemos diseñado tres protocolos de asignación segura de identidades, los cuales evitan la mayor parte de los problemas identificados mientras mantienen el anonimato de los usuarios y la trazabilidad. Finalmente hemos analizado el funcionamiento de la mayoría de los mecanismos utilizados para distribuir datos de revocación en Internet, con especial interés en los sistemas propuestos para operar en redes P2P, y hemos diseñado un nuevo mecanismo para distribuir datos de revocación de forma más eficiente en redes P2P estructuradas.

show abstract

Certificate Revocation List Distribution System for the KAD Network

Cited by 4 publications

References 0 publications

Towards a TEE-based V2V Protocol for Connected and Autonomous Vehicles

Towards a TEE-based V2V Protocol for Connected and Autonomous Vehicles

RIAPPA: a Robust Identity Assignment Protocol for P2P overlays

Secure identity management in structured peer-to-peer (P2P) networks

Contact Info

Product

Resources

About