Smart Certificates Extending X 509 for Secure Attribute

Smart Certificates: Extending X. 509 for Secure Attribute Service on the Web October 1999 Joon S. Park, Ph. D. Center for Computer High Assurance Systems Naval Research Laboratory

Abstract n In this paper, we have – identified the models for secure attribute services on the Web – developed n smart certificates based on X. 509 – introduced n Possible applications of smart certificates

Introduction n WWW (World Wide Web) – synthesizes diverse technologies and components in Web environments – widely used for electronic commerce and business – mostly, Web servers use identity-based access control n scalability problem

Background n An attribute – a particular property of an entity n n e. g. , role, group, clearance, etc. If attributes are provided securely, – Web servers can use those attributes n n e. g. , authentication, authorization, access control, electronic commerce, etc. A successful marriage of the Web and secure attribute services is required

User-Pull Model

User-Pull Model n Each user – pulls appropriate attributes from the Attribute Server – presents attributes and authentication information to Web servers n Each Web server – requires both identification and attributes from users n No new connections for the same attributes

Server-Pull Model

Server-Pull Model n Each user n Each Web server n Authentication information and attribute do not go together More convenient for users Less convenient for Web servers n n – presents only authentication information to Web servers – pulls users’ attributes from the Attribute Server

X. 509 Certificate n n n Digitally signed by a certificate authority to confirm the information in the certificate belongs to the holder of the corresponding private key support security on the Web based on PKI standard simply, bind users to keys have the ability to be extended Certificate Revocation List (CRL)

X. 509 Certificate n Contents – version, serial number, subject, validity period, issuer, optional fields (v 2) – subject’s public key and algorithm info. – extension fields (v 3) – digital signature of CA

X. 509 Certificate

Smart Certificates n Short-Lived Lifetime – More secure typical validity period for X. 509 is months (years) n the longer-lived certificates have a higher probability of being attacked n – users may leave copies of the corresponding keys behind – No Certificate Revocation List (CRL) n supports simple and less expensive PKI

Smart Certificates n Containing Attributes Securely – Web servers can use secure attributes for their purposes – Each authority has independent control on the corresponding information basic certificate (containing identity information) n each attribute can be added, changed, revoked, or re-issued by the appropriate authority n – e. g. , role, credit card numbers, clearance, etc.

Separate CAs in a Certificate

Smart Certificates n Postdated/Renewable Certificates – The certificate becomes valid at some time in the future n It is possible to make a smart certificate valid for a set of duration – The certificate can be renewed until the “renewable time” a user keeps renewing it for shorter period n no need for CRL n

Smart Certificates n Confidentiality – Sensitive information can be n encrypted in smart certificates – e. g. passwords, credit card numbers, etc.

Applications of Smart Certificates On-Duty Control n Compatible with X. 509 n User Authentication n Electronic Transaction n Pay-per-Access n Eliminating Single-Point Failure n Attribute-based Access Control n

Conclusions n In this paper, we have – identified the models for secure attribute services on the Web – developed n smart certificates based on X. 509 – introduced n Possible applications of smart certificates

A Smart Certificate