Abstract
The distribution and revocation of public-key certificates are essential aspects of secure digital communication. As a first step towards a methodology for the development of reliable models, we present a formalism for the specification and reasoning about the distribution and revocation of public keys, based on graphs. The model is distributed in nature; each entity can issue certificates for public keys that it knows, and distribute these to other entities. Each entity has its own public key bases and can derive new certificates from this knowledge. If some of the support for the derived knowledge is revoked, then some of the derived certificates may be revoked as well. Cyclic support is avoided. Graph transformation rules are used for the management of the certificates, and we prove soundness and completeness for our model.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Cooper, D.A.: A closer look at revocation and key compromise in public key infrastructures. In: Proceedings of the 21st National Information Systems Security Conference, pp. 555–565 (1998)
Fox, B., LaMacchia, B.: Certificate revocation: Mechanics and meaning. In: Hirschfeld, R. (ed.) FC 1998. LNCS, vol. 1465, pp. 158–164. Springer, Heidelberg (1998)
Gunter, C.A., Jim, T.: Generalized certificate revocation. In: Proceedings of the 27th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pp. 316–329 (2000)
Housley, R., Ford, W., Polk, T., Solo, D.: Internet x.509 public key infrastructure certificate and certificate revocation list (crl) profile. Technical Report RFC 3280, IETF X.509 Public Key Infrastructure Working Group, PKIX (2002)
Hagström, Å., Jajodia, S., Parisi-Presicce, F., Wijesekera, D.: Revocations — a classification. In: Proceedings of the 14th IEEE Computer Security Foundations Workshop, Cape Breton, Nova Scotia, Canada (2001)
Maurer, U.: Modelling a public-key infrastructure. In: Martella, G., Kurth, H., Montolivo, E., Bertino, E. (eds.) ESORICS 1996. LNCS, vol. 1146, pp. 325–350. Springer, Heidelberg (1996)
Stubblebine, S.G., Wright, R.N.: An authentication logic supporting synchronization, revocation, and recency. In: Proceedings of the 3rd ACM Conference on Computer and Communications Security, New Delhi, India, pp. 95–105 (1996)
Kudo, M., Mathuria, A.: An extended logic for analyzing timed-release public-key protocols. In: ISICS, pp. 183–198 (1999)
Li, N., Feigenbaum, J., Grosof, B.N.: A logic-based knowledge representation for authorization with delegation (extended abstract). In: Proceedings of the 12th IEEE Computer Security Foundations Workshop (1999)
Li, N.: Delegation Logic: A Logic-based Approach to Distributed Authorization. PhD thesis, New York University, Chapter 4: A Nonmonotonic Delegation Logic (2000)
Liu, C., Ozols, M., Cant, T.: An axiomatic basis for reasoning about trust in pkis. In: Varadharajan, V., Mu, Y. (eds.) ACISP 2001. LNCS, vol. 2119, pp. 274–291. Springer, Heidelberg (2001)
Simmons, G.J., Meadows, C.: The role of trust in information integrity protocols. Journal of Computer Security 3, 71–84 (1995)
Kohlas, R., Maurer, U.: Reasoning about public-key certification: On bindings between entities and public keys. In: Franklin, M.K. (ed.) FC 1999. LNCS, vol. 1648, p. 86. Springer, Heidelberg (1999)
Wright, R.N., Lincoln, P.D., Millen, J.K.: Efficient fault-tolerant certificate revocation. In: [19], pp. 19–24
Aura, T.: On the structure of delegation networks. In: Proceedings of the 11th IEEE Computer Security Foundations Workshop, Rockport, MA (1998)
Buldas, A., Laud, P., Lipmaa, H.: Acountable certificate management using undeniable attestations. In: [19]
Bottoni, P., Koch, M., Parisi-Presicce, F., Taentzer, G.: Termination of high-level replacement units with application to model transformation. ENTCS 127(4), 71–86 (2005)
Rozenberg, G. (ed.): Handbook of Graph Grammars and Computing by Graph Transformation. Foundations, vol. I. World Scientific, Singapore (1997)
Samarati, P. (ed.): Proceedings of the 7th ACM Conference on Computer and Communications Security, Athens, Greece (2000)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2010 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Hagström, Å., Parisi-Presicce, F. (2010). A Model for Distribution and Revocation of Certificates. In: Ehrig, H., Rensink, A., Rozenberg, G., Schürr, A. (eds) Graph Transformations. ICGT 2010. Lecture Notes in Computer Science, vol 6372. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-15928-2_21
Download citation
DOI: https://doi.org/10.1007/978-3-642-15928-2_21
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-15927-5
Online ISBN: 978-3-642-15928-2
eBook Packages: Computer ScienceComputer Science (R0)