DICTATE: DIstributed CerTification Authority with probabilisTic frEshness for ad hoc networks

• Published in: IEEE transactions on dependable and secure computing 2005-10, Vol.2 (4), p.311-323
• Main Authors: Jun Luo, Hubaux, J.-P., Eugster, P.T.
• Format: Article
• Language: English
• Subjects: Ad hoc networks; Analytical models; Certification; Communications systems; Computer networks; Cryptography; Identity management systems; Identity-based encryption; Index Terms- Ad hoc networks; Infrastructure; Mathematical models; Network security; Network servers; Protocol; Protocols; Public Key Infrastructure; Quorum Systems; Robustness; Scalability; Security; simulations; Statistical analysis; Studies; system design; Wireless networks
• ISSN: 1545-5971; 1941-0018
• DOI: 10.1109/TDSC.2005.49

Securing ad hoc networks is notoriously challenging, notably due to the lack of an online infrastructure. In particular, key management is a problem that has been addressed by many researchers but with limited results. In this paper, we consider the case where an ad hoc network is under the responsibility of a mother certification authority (mCA). Since the nodes can frequently be collectively isolated from the mCA (e.g., for a remote mission) but still need the access to a certification authority, the mCA preassigns a special role to several nodes (called servers) that constitute a distributed certification authority (dCA) during the isolated period. We propose a solution, called DICTATE (DIstributed CerTification Authority with probabilisTic frEshness), to manage the dCA. This solution ensures that the dCA always processes a certificate update (or query) request in a finite amount of time and that an adversary cannot forge a certificate. Moreover, it guarantees that the dCA responds to a query request with the most recent version of the queried certificate in a certain probability; this probability can be made arbitrarily close to 1, but at the expense of higher overhead. Our contribution is twofold: 1) a set of certificate management protocols that allow trading protocol overhead for certificate freshness or the other way around, and 2) a combination of threshold and identity-based cryptosystems to guarantee the security, availability, and scalability of the certification function. We describe DICTATE in detail and, by security analysis and simulations, we show that it is robust against various attacks.