Generic Light Weight Certificate Management Protocol

Abstract

Mobile devices and digital gadgets are very popular and commonly used in daily life. Research community increased its processing power and designed new advanced applications to attract business community to use it for e-commerce, business activities, sharing of valuable documents and many other sensitive activities. There are many problems in the development of secure applications for mobile devices. First, most of the users are not technical enough to configure security parameters and even already developed libraries do not support extended security features like transparent handling of certificates, verification of identities, and distribution of certificates. It is also observed that already developed security libraries are very difficult to use and integrate with existing applications to provide security features. In order to solve above problems, a Generic Light Weight Certificate Management Protocol (GLCMP) is designed which is based on holistic approach in order to solve complex certificate management task. In order to achieve desired objectives, proxy based architecture has been adopted to offload computational intensive operations from mobile devices. In GLCMP, the trust between mobile device and proxy server is developed without exchanging any secret information on network. In addition, GLCMP designed and developed by using the concept of generic security objects. The claimed security properties, authentication, confidentiality and non-repudiation of the protocol are formally verified by employing formal Z-Notation modeling. In Z-Notation modeling, different attacks are formalized on messages exchange between components and discussed all possible scenarios in which an attacker can attack the protocol. After verification, it is concluded that the designed protocol resists against most of the attacks launched on registration and verification process such as impersonation, man-in-the-middle and replay. Furthermore, for the proof of the concepts, the GLCMP is implemented and evaluate its result. Computed Authentication latency is 0.394 sec which is less than its nearest competitors NSI (4.7), PKI (5.01), and PKASSO (5.19 delegation time + 0.082 authentication times). Moreover, our design is also providing secure registration and certificate management.