Authentication Challenges in a Global Environment

Abstract

In this article, we address the problem of scaling authentication for naming, routing, and end-entity (EE) certification to a global environment in which authentication policies and users’ sets of trust roots vary widely. The current mechanisms for authenticating names (DNSSEC), routes (BGPSEC), and EE certificates (TLS) do not support a coexistence of authentication policies, affect the entire Internet when compromised, cannot update trust root information efficiently, and do not provide users with the ability to make flexible trust decisions. We propose the Scalable Authentication Infrastructure for Next-generation Trust (SAINT), which partitions the Internet into groups with common, local trust roots and isolates the effects of a compromised trust root. SAINT requires groups with direct routing connections to cross-sign each other for authentication purposes, allowing diverse authentication policies while keeping all entities’ authentication information globally discoverable. SAINT makes trust root management a central part of the network architecture, enabling trust root updates within seconds and allowing users to make flexible trust decisions. SAINT operates without a significant performance penalty and can be deployed alongside existing infrastructures.

Cross-Certification Towards Distributed Authentication Infrastructure: A Case of Hyperledger Fabric

“…Matsumoto et al [26] proposed two important properties: scoped authority and global authentication. These properties enable EEs who trust each other to communicate even if they are located in separate domains.…”

“…In [26], the domains can represent groups of various scales, such as companies, conglomerates, or countries, but overconcentration of trust will occur in groups where PKI systems are built using the hierarchical model. To prevent the overconcentration of trust, we build trust points at service levels such that the trust points do not span multiple services.…”

An Architecture for Accountable Anonymous Access in the Internet-of-Things Network

“…It is worth noting that, in recent years many research efforts have been made on new types of network addresses, most of which emphasized self-certifying [19], [20]; this has been considered to be the trends in the development of communication networks. The self-certifying identifiers have been widely adopted in a variety of distributed systems.…”

ARTEMIS: Neutralizing BGP Hijacking Within a Minute

“…Currently, networks rely on practical reactive mechanisms to try to defend against prefix hijacking, since proposed proactive mechanisms [38], [39], [42], [43], [64] (e.g., RPKI) are fully efficient only when globally deployed, and operators are reluctant to deploy them due to associated technical and financial costs [27], [45], [49]. Defending against hijacking reactively consists of two steps: detection and mitigation.…”