key management

To address critical security challenges in IoT—including severe resource constraints, expansive attack surfaces, and imminent quantum threats—this paper proposes an end-to-end, full-stack security framework spanning the chip, firmware, communication, and application layers to ensure confidentiality, integrity, and availability across the device lifecycle. Methodologically, it innovatively integrates a hardware-based root of trust, CBOR-encoded lightweight digital certificates, an optimized TLS 1.3 protocol stack, and a seamless post-quantum cryptographic migration mechanism, enabling cross-layer coordinated defense and resource-adaptive security provisioning. Experimental evaluation demonstrates over 30% reduction in communication overhead, millisecond-scale secure boot latency, and certificate sizes compressed to sub-kilobyte levels. This work establishes the first verifiable, scalable, and quantum-resistant lightweight security paradigm for resource-constrained IoT devices.

To address access control challenges arising from the dynamicity, distribution, and heterogeneity of computing continua, this paper proposes a zero-trust-oriented cross-domain access control framework. The framework deeply integrates decentralized identifiers (DIDs) and verifiable credentials (VCs) to enable fine-grained, cryptographically verifiable identity management. It introduces, for the first time, a synergistic modeling approach that unifies relationship-based access control (ReBAC) with DID/VC primitives, thereby supporting evolving multi-party trust relationships and adaptive policy updates. Evaluated via a prototype implementation, the framework demonstrates significantly enhanced policy expressiveness compared to conventional RBAC and ABAC models; it reduces average authorization latency by 32% and improves security, controllability, and trust verifiability in decentralized environments.

This study investigates the effectiveness of hardware-based security mechanisms—specifically boot chain integrity, Trusted Execution Environment (TEE) isolation, and hardware-bound key protection—when smartphones are reused outside their native ecosystems. Leveraging the PinePhone open hardware platform, the work presents the first systematic analysis of the challenges in re-establishing trust during cross-environment device reuse. Through empirical validation of the boot chain, TEE isolation testing, and key protection experiments, the research demonstrates that existing vendor lock-in mechanisms significantly impede secure device repurposing. The paper articulates fundamental requirements for secure smartphone reuse and shows that current closed security architectures are ill-suited to support sustainable utilization beyond their original, vendor-controlled environments.

This work addresses the interoperability challenges in digital credential ecosystems, which stem from heterogeneous standards and independent evolution, and which traditional approaches fail to fully explain—particularly regarding incompatibilities that persist even under shared data models and the precise trust requirements of verifiers. To resolve this, the paper proposes a verifier-centric conceptual model that decomposes credential verification into three layers: signature validation (L1), semantic interpretation (L2), and validity assessment (L3). It further introduces two orthogonal planes—institutional and logistical—to construct a five-function framework within a three-dimensional deployment space. Building on this foundation, the authors design the Shinken framework, which integrates trust declarations, verification material exchange, and deployment strategies to enable cross-stack analysis. Evaluations across four learner credential stacks and an accreditation federation demonstrate that the model effectively elucidates and mitigates key issues including interoperability barriers, verification overhead, privacy risks, and terminological ambiguity.

To address static permission bloat, coarse-grained auditing, and inadequate support for zero-trust principles in CI/CD pipelines, this paper proposes a dynamic credential proxy architecture grounded in runtime-verifiable identities (SPIFFE/SVID). The architecture decouples identity from access permissions and enables instantaneous, short-lived (second-scale) cross-trust-domain credential issuance via OAuth 2.0 Token Exchange. It integrates a gRPC-based proxy with unified RBAC/ABAC policy enforcement, enabling fine-grained, policy-driven authorization. This work introduces the first pipeline-centric dynamic credential proxy design paradigm, bridging a critical engineering gap in applying zero-trust identity models to continuous delivery. Evaluation in production demonstrates sub-500 ms policy enforcement latency, substantial reduction in long-lived credential exposure risk, and significant improvements in audit real-time performance and traceability.

Traditional control of cryptographic assets relies on permanent private key possession, which hinders regulatory compliance, conditional delegation, and on-chain revocable transfers. This work proposes CT-DAP, a novel approach introducing dormant authorization paths based on destructible authorization factors jointly held by the user and an independent custodian. These paths activate asset control upon predefined conditions and support stateless revocation. The scheme integrates deterministic key derivation, context isolation, and cryptographic primitives—including AES-GCM-SIV, HKDF, Argon2id, and SHA-256—to construct the ACE-GF framework. Under standard security assumptions, ACE-GF achieves sub-second activation latency while enabling flexible trade-offs between security and performance.

This work addresses the privacy risks associated with the reuse of patient identifiers in healthcare systems by proposing a patient-centric identity management framework. The framework innovatively integrates anonymous pseudonyms with a conditional traceability mechanism and is grounded in a security architecture built upon a hardware-rooted trust anchor. Through rigorous evaluation—including MSRA architectural analysis, formal verification, and simulation-based assessment—the study demonstrates that the proposed approach is both feasible and secure under typical clinical workflow latency constraints. It effectively balances stringent privacy protection, regulatory compliance, and operational efficiency in real-world medical environments.

This work addresses the challenge of efficiently implementing zero-trust-compliant, multi-tenant secure network connectivity in computationally or entropy-constrained environments. The authors propose and implement a cloud-native VPN-as-a-Service (VPNaaS) solution that, for the first time, integrates zero-trust network isolation capabilities with customizable cryptographic algorithms—supporting either RSA or elliptic curve cryptography. The system enables on-demand, dynamic provisioning of tenant-level isolated secure tunnels and seamlessly interoperates with mainstream identity and access management (IAM) platforms. By adhering to the principle of least privilege and enforcing strict multi-tenancy isolation, the proposed approach significantly enhances both deployment efficiency and security in resource-constrained settings.

This work addresses the challenge posed by MAC address randomization, which undermines the ability of traditional Network Access Control (NAC) systems to uniquely identify devices, thereby compromising enterprise compliance and management. To resolve this, the authors propose a compatibility framework leveraging the RADIUS protocol that assigns a globally unique identifier (GUID) within the Access-Accept message without requiring modifications to client operating systems. This GUID is cryptographically bound to the device certificate, enabling persistent, cross-session identity tracking. The solution seamlessly integrates with existing 802.1X and MAC Authentication Bypass (MAB) infrastructures and aligns with RFC 9797 and IEEE 802.11bh-2024 standards. It effectively restores device visibility, ensures accurate license accounting, and maintains regulatory compliance—all while preserving the privacy benefits afforded by MAC address randomization.

This work addresses the fragmentation and high friction in data management across consumer electronics caused by manual input and opaque sharing practices. To this end, the paper proposes a User Data Sharing System (UDSS), which introduces the first hardware-anchored privacy middleware designed for shared-device environments. Notably, UDSS operates without requiring persistent user–device binding and integrates Contextual Scope Enforcement (CSE) with protocol-driven data minimization to dynamically restrict the exposure of personally identifiable information (PII) according to user intent. A prototype implementation on the ARMv8 Linux architecture demonstrates that, under GDPR/CCPA-compliant tiered access control, UDSS reduces user registration latency by 65% while significantly mitigating the risk of PII overexposure.