ARECA: A highly attack resilient Certification Authority

Jiwu Jing; Peng Liu; Dengguo Feng; Ji Xiang; Neng Gao; Lin Jingqiang

ARECA: A highly attack resilient Certification Authority

Jiwu Jing, Peng Liu, Dengguo Feng, Ji Xiang, Neng Gao, Lin Jingqiang

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Certification Authorities (CA) are a critical component of a PKI. All the certificates issued by a CA will become invalid when the (signing) private key of the CA is compromised. Hence it is a very important issue to protect the private key of an online CA. ARECA systems, built on top of threshold cryptography, ensure the security of a CA through a series of defense-in-depth protections. ARECA systems won't be compromised when a few system components are compromised or some system administrators betray. The private key of a CA is protected by distributing different shares of the key to different (signing) components and by ensuring that any component of the CA is unable to reconstruct the private key. In addition, the multi-layer system architecture of ARECA makes it very difficult to attack from outside. Several threshold-cryptography- based methods are proposed in the literature to construct an intrusion tolerant CA, and the uniqueness of ARECA is that it engineers a novel two phase signature composition scheme and a multi-layer CA protection architecture. As a result, ARECA is (a) practical, (b) highly resilient to both insider and outsider attacks that compromise one or more components, and (c) can prevent a variety of outside attacks.

Original language	English (US)
Title of host publication	Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems (In Association with 10th ACM Conference on Computer Communications Security)
Editors	P. Liu, P. Pal
Pages	53-63
Number of pages	11
State	Published - Dec 1 2003
Event	Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems (In Association with 10th ACM Conference on Computer Communications Security) - Fairfax, VA, United States Duration: Oct 31 2003 → Oct 31 2003

Publication series

Name	Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems

Other

Other	Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems (In Association with 10th ACM Conference on Computer Communications Security)
Country/Territory	United States
City	Fairfax, VA
Period	10/31/03 → 10/31/03

All Science Journal Classification (ASJC) codes

General Engineering

Cite this

Jing, J., Liu, P., Feng, D., Xiang, J., Gao, N., & Jingqiang, L. (2003). ARECA: A highly attack resilient Certification Authority. In P. Liu, & P. Pal (Eds.), Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems (In Association with 10th ACM Conference on Computer Communications Security) (pp. 53-63). (Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems).

Jing, Jiwu ; Liu, Peng ; Feng, Dengguo et al. / ARECA : A highly attack resilient Certification Authority. Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems (In Association with 10th ACM Conference on Computer Communications Security). editor / P. Liu ; P. Pal. 2003. pp. 53-63 (Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems).

@inproceedings{96a938055d6c477fb44d51585f230ace,

title = "ARECA: A highly attack resilient Certification Authority",

abstract = "Certification Authorities (CA) are a critical component of a PKI. All the certificates issued by a CA will become invalid when the (signing) private key of the CA is compromised. Hence it is a very important issue to protect the private key of an online CA. ARECA systems, built on top of threshold cryptography, ensure the security of a CA through a series of defense-in-depth protections. ARECA systems won't be compromised when a few system components are compromised or some system administrators betray. The private key of a CA is protected by distributing different shares of the key to different (signing) components and by ensuring that any component of the CA is unable to reconstruct the private key. In addition, the multi-layer system architecture of ARECA makes it very difficult to attack from outside. Several threshold-cryptography- based methods are proposed in the literature to construct an intrusion tolerant CA, and the uniqueness of ARECA is that it engineers a novel two phase signature composition scheme and a multi-layer CA protection architecture. As a result, ARECA is (a) practical, (b) highly resilient to both insider and outsider attacks that compromise one or more components, and (c) can prevent a variety of outside attacks.",

author = "Jiwu Jing and Peng Liu and Dengguo Feng and Ji Xiang and Neng Gao and Lin Jingqiang",

year = "2003",

month = dec,

day = "1",

language = "English (US)",

isbn = "1581137842",

series = "Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems",

pages = "53--63",

editor = "P. Liu and P. Pal",

booktitle = "Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems (In Association with 10th ACM Conference on Computer Communications Security)",

note = "Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems (In Association with 10th ACM Conference on Computer Communications Security) ; Conference date: 31-10-2003 Through 31-10-2003",

}

Jing, J, Liu, P, Feng, D, Xiang, J, Gao, N & Jingqiang, L 2003, ARECA: A highly attack resilient Certification Authority. in P Liu & P Pal (eds), Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems (In Association with 10th ACM Conference on Computer Communications Security). Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems, pp. 53-63, Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems (In Association with 10th ACM Conference on Computer Communications Security), Fairfax, VA, United States, 10/31/03.

ARECA: A highly attack resilient Certification Authority. / Jing, Jiwu; Liu, Peng; Feng, Dengguo et al.
Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems (In Association with 10th ACM Conference on Computer Communications Security). ed. / P. Liu; P. Pal. 2003. p. 53-63 (Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - ARECA

T2 - Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems (In Association with 10th ACM Conference on Computer Communications Security)

AU - Jing, Jiwu

AU - Liu, Peng

AU - Feng, Dengguo

AU - Xiang, Ji

AU - Gao, Neng

AU - Jingqiang, Lin

PY - 2003/12/1

Y1 - 2003/12/1

N2 - Certification Authorities (CA) are a critical component of a PKI. All the certificates issued by a CA will become invalid when the (signing) private key of the CA is compromised. Hence it is a very important issue to protect the private key of an online CA. ARECA systems, built on top of threshold cryptography, ensure the security of a CA through a series of defense-in-depth protections. ARECA systems won't be compromised when a few system components are compromised or some system administrators betray. The private key of a CA is protected by distributing different shares of the key to different (signing) components and by ensuring that any component of the CA is unable to reconstruct the private key. In addition, the multi-layer system architecture of ARECA makes it very difficult to attack from outside. Several threshold-cryptography- based methods are proposed in the literature to construct an intrusion tolerant CA, and the uniqueness of ARECA is that it engineers a novel two phase signature composition scheme and a multi-layer CA protection architecture. As a result, ARECA is (a) practical, (b) highly resilient to both insider and outsider attacks that compromise one or more components, and (c) can prevent a variety of outside attacks.

AB - Certification Authorities (CA) are a critical component of a PKI. All the certificates issued by a CA will become invalid when the (signing) private key of the CA is compromised. Hence it is a very important issue to protect the private key of an online CA. ARECA systems, built on top of threshold cryptography, ensure the security of a CA through a series of defense-in-depth protections. ARECA systems won't be compromised when a few system components are compromised or some system administrators betray. The private key of a CA is protected by distributing different shares of the key to different (signing) components and by ensuring that any component of the CA is unable to reconstruct the private key. In addition, the multi-layer system architecture of ARECA makes it very difficult to attack from outside. Several threshold-cryptography- based methods are proposed in the literature to construct an intrusion tolerant CA, and the uniqueness of ARECA is that it engineers a novel two phase signature composition scheme and a multi-layer CA protection architecture. As a result, ARECA is (a) practical, (b) highly resilient to both insider and outsider attacks that compromise one or more components, and (c) can prevent a variety of outside attacks.

UR - http://www.scopus.com/inward/record.url?scp=2642531236&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=2642531236&partnerID=8YFLogxK

M3 - Conference contribution

AN - SCOPUS:2642531236

SN - 1581137842

SN - 9781581137842

T3 - Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems

SP - 53

EP - 63

BT - Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems (In Association with 10th ACM Conference on Computer Communications Security)

A2 - Liu, P.

A2 - Pal, P.

Y2 - 31 October 2003 through 31 October 2003

ER -

Jing J, Liu P, Feng D, Xiang J, Gao N, Jingqiang L. ARECA: A highly attack resilient Certification Authority. In Liu P, Pal P, editors, Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems (In Association with 10th ACM Conference on Computer Communications Security). 2003. p. 53-63. (Proceedings of the ACM Workshop on Survivable and Self-Regenerative Systems).

ARECA: A highly attack resilient Certification Authority

Abstract

Publication series

Other

All Science Journal Classification (ASJC) codes

Other files and links

Fingerprint

Cite this