RiskLaine: A Probabilistic Approach for Assessing Risk in Certificate-Based Security Articles uri icon

authors

publication date

  • August 2018

start page

  • 1975

end page

  • 1988

issue

  • 8

volume

  • 13

International Standard Serial Number (ISSN)

  • 1556-6013

Electronic International Standard Serial Number (EISSN)

  • 1556-6021

abstract

  • Digital certificates, based on X.509 PKI standard, are located at the core of many security mechanisms implemented in services and applications. However, the usage of certificates has revealed flaws in the certificate validation process (e.g., possibility of unavailable or non-updated data). This fact implies security risks that are not assessed. In order to address these issues that such flaws entail, we propose a novel probabilistic approach for quantitative risk assessment in X.509 PKI, together with trust management when there is uncertainty. We have evaluated our risk assessment approach and demonstrated its usage, considering as a use case the secure installation of mobile applications. The results show that our approach provides more granularity, appropriate values according to the impact, and relevant information in the risk calculation than other approaches.

subjects

  • Telecommunications

keywords

  • risk assessment; certificate validation; trust management; x.509 pki; mobile applications