Cross-Certification Towards Distributed Authentication Infrastructure: A Case of Hyperledger Fabric

Abstract

In Internet of Things ecosystems, where various entities trade data and data analysis results, public key infrastructure plays an important role in establishing trust relationships between these entities to specify who trusts whose private keys. The owner of a private key is provided with a public key certificate issued by a certificate authority (CA) representing a trusted third party. Although this certificate ensures the reliability of the ecosystem by verifying the data source and preventing the denial of trading, it often causes an overconcentration of trust in a particular CA. Consequently, if that CA is infringed, all the related trust relationships become compromised. The paper proposes a distributed authentication infrastructure called Meta-PKI that decentralizes such overconcentration via a cross-certification procedure performed by multiple CAs. Although cross-certification is capable of establishing mutual trust relationships, it does not evaluate the trustworthiness of other CAs in a standardized manner. Therefore, this paper also proposes a new crosscertification method using a distributed ledger technology for building trust relationships based on unified criteria. It also describes the implementation of a Meta-PKI system for Hyperledger Fabric as a proof of concept. Once trust relationships have been established, it takes approximately 65.7 ms to validate them using the proposed system, which is secure against CA takeover and spoofing by outsider attackers.

Smart grid security: Attacks and defence techniques

“…An attacker can exploit a homograph attack by confusing a server in distinguishing the name of an original certificate from the name of a fake one [56]. Session key exposure is distributing a fake key to the target network to mislead victims and take data stealthily from them.…”

Hyperledger for IoT: A Review of Reconstruction Diagrams Perspective

“…The authorization efficiency is improved while ensuring the security of distributed authorization, but the first strategy requires higher computational cost. To solve the problem of centralized CA authentication, Kakei [38] proposed a strategy for distributed CA authentication (Fabric). In Figure 15, it is shown that the CA nodes in Texas are divided into meta-CA and CA.…”

Current Trends in Blockchain Implementations on the Paradigm of Public Key Infrastructure: A Survey

“…To classify the reviewed proposals, we have divided them according to their implementation, as follows: a: Classical PKI Systems improved with blockchain This classification shows pseudo-decentralised implementation where traditional CAs are the main part of the implementation to generate the PKI system, besides the use of blockchain. For example, Kakei et al [38] present crosscertification system for CAs on a PKI based on Hyperledger blockchain. This proposal uses three layers for PKI: 1) users, where all CA existent users are registered, 2) CAs, where all the classic CAs communicate with each other, and 3) the ledger, consisting of entities known as meta-CAs, which functions as the Hyperledger nodes.…”