Abstract:As the voucher for identity, digital certificates and the public key infrastructure (PKI) system have always played a vital role to provide the authentication services. In recent years, with the increase in attacks on traditional centralized PKIs and the extensive deployment of blockchains, researchers have tried to establish blockchain-based secure decentralized PKIs and have made significant progress. Although blockchain enhances security, it brings new problems in scalability due to the inherent limitations of blockchain’s data structure and consensus mechanism, which become much severe for the massive access in the era of 5G and B5G. In this paper, we propose ScalaCert to mitigate the scalability problems of blockchain-based PKIs by utilizing redactable blockchain for "on-cert" revocation. Specifically, we utilize the redactable blockchain to record revocation information directly on the original certificate ("on-cert") and remove additional data structures such as CRL, significantly reducing storage overhead. Moreover, the combination of redactable and consortium blockchains brings a new kind of attack called deception of versions (DoV) attack. To defend against it, we design a random-block-node-check (RBNC) based freshness check mechanism. Security and performance analyses show that ScalaCert has sufficient security and effectively solves the scalability problem of the blockchain-based PKI system.

A Study on CRL Revocation Delay of PKI

On the release of CRLs in public key infrastructure

Investigate and Improve the Certificate Revocation in Web PKI

Optimal CRL Releasing Strategy in Public Key Infrastructure.

Certificate Revocation Release Policies

The Condition and Future of Research on the Revocation Methods of Digital Certificate

Efficient User Revocation for Privacy-Aware PKI

Research on the Segmented and Over-Issued CRL Synthesis Model

Fast public key infrastructure authentication based on CA caching

ScalaCert: Scalability-Oriented PKI with Redactable Consortium Blockchain Enabled "On-Cert" Certificate Revocation

Optimized User Revocation for Group Signature Based Privacy-Aware PKI.

Certificate Revocation Scheme CRPSL Based on Priority Skip Lists

The Research of the Corporation-Rate Certificate Authority

Certificate Revocation List SchemeBased on Partial Signature Hash Table

Private Status Retrieval for Blockchain-Based Certificate Revocation System

Study on the security of the authentication scheme with key recycling in QKD

Research on Open Identity Authentication Model for PKI

A New Provably Secure Certificateless Signature with Revocation in the Standard Model

A Note on the Security of KHL Scheme

Conformation and Application of Dynamic Public Key Infrastructure

Resolution of Proof of Possession in Public Key Infrastructure