Distributed Public Key Certificate-Issuing Infrastructure for Consortium Certificate Authority Using Distributed Ledger Technology

Abstract

With the development of cloud services and the Internet of Things, the integration of heterogeneous systems is becoming increasingly complex. Identity management is important in the coordination of various systems, and public key infrastructure (PKI) is widely known as an identity management methods. In PKI, a certificate authority (CA) acts as a trust point to guarantee the identity of entities such as users, devices, and services. However, traditional CAs that delegate the operations to a specific organization are not always suitable for heterogeneous services, and a new methodology is required to enable multiple stakeholders to securely and cooperatively operate a CA. In this study, we introduce the concept of a consortium CA and propose a distributed public key certificate-issuing infrastructure that realizes a consortium CA. The proposed infrastructure enables multiple organizations to cooperatively operate a CA suitable for services involving multiple stakeholders. We identify four requirements for the cooperative operation of a consortium CA and design the proposed infrastructure with distributed ledger technology. Furthermore, we present the implementation of smart contracts with Hyperledger Fabric and prove that the proposed infrastructure satisfies the four requirements. Finally, we confirm that certificate issuance and verification are stable at approximately 4 and 3 ms, respectively.

Securing Data Exchange with Elliptic Curve Cryptography: A Novel Hash-Based Method for Message Mapping and Integrity Assurance

“…To mitigate this threat in our proposed scheme, robust verification mechanisms are essential. Implementing protocols for public key authentication enables users to verify the legitimacy of received keys [43] while leveraging certificate authorities (CAs) provides digital certificates to validate the identities of communication parties [44]. Additionally, adopting trust-on-first-use (TOFU) mechanisms allows users to verify public keys during initial interactions [45].…”

Design of Enclosing Signing Keys by All Issuers in Distributed Public Key Certificate-Issuing Infrastructure

“…However, in light of the expansion of consortium-based IoT systems involving multiple stakeholders, the challenge is how to operate a private CA without relying on a specific party in the consortium. We have proposed a distributed public key certificate-issuing infrastructure (DCII) [2] that uses distributed ledger technology (DLT) to address the problem of a SPOT for CA-based PKI in private environments where devices are interconnected. In the DCII, CA functions are shared among parties as smart contracts, and logs of the process are recorded in a distributed ledger (DL) to improve CA transparency.…”