Efficient Certification and Zero-Knowledge Proofs of Knowledge on Infrastructure Topology Graphs

Abstract

Digital signature schemes are a foundational cryptographic building block in certification and the projection of trust. Based on a signature scheme on committed graphs, we propose a framework of certification and proof methods to sign topology graphs and to prove properties of their certificates in zero-knowledge. This framework allows an issuer, such as an auditing system, to sign the topology representation of an infrastructure. The prover, such as an infrastructure provider, can then convince a verifier of topology properties including connectivity and isolation without disclosing the blueprint of the topology itself. By that, we can certify the structure of critical systems while still maintaining confidentiality. We offer zero-knowledge proofs of knowledge for a general specification language of security goals for virtualized infrastructures such that high-level security goals can be proven over topology certificates. We offer an efficient and practical construction, built upon the Camenisch-Lysyanskaya signature scheme [11], honest-verifier proofs and the strong RSA assumption.

Signatures for Privacy, Trust and Accountability in the Cloud: Applications and Requirements

“…Their application allows an auditor to analyse the configuration of a cloud, and to issue a signature on its topology (or a sequence of signatures on dynamically changing topologies). [7]. The signature encodes the topology as a graph in a special way, such that the cloud provider can prove high-level security properties such as isolation of tenants to verifiers.…”

“…A more elaborate version of this scenario was presented in [7]. Figure 3 depicts the system model for the topology certification.…”

Efficient Zero-Knowledge Proofs of Graph Signature for Connectivity and Isolation Using Bilinear-Map Accumulator

“…In this context, in [13,14], the graph structure is focused, and the signatures and zero-knowledge proofs for graphs are proposed. In the proposed system, an issuer generates a signature certifying the topology of an undirected graph, and issues a prover the signature.…”

“…In [13], as the application, a trusted third party auditing system on a distributed system of virtualized infrastructure is considered. In this system, an auditor, an infrastructure provider and tenants participate.…”

“…In the graph signature/proof system of [13,14], the CL signatures are used to sign a graph. The CL signatures are computed on RSA modulus = ( , are distinct primes), and the zeroknowledge proofs are also constructed using integer commitments [11] on the modulus.…”