Uploaded October 2022 | Updated September 2026, 12 hours ago
Cryptographic hardware and software is often certified under security certification standards like the Common Criteria or FIPS 140 . The certification process involves a vendor submitting the product under evaluation to an independent evaluation facility, which evaluates the vendor’s claims on the security of the product and its development. This certification process produces several publicly available documents: the certification report, the security target, and sometimes a protection profile. These documents contain valuable information for the certification system stakeholders, researchers, and for vulnerability assessment. With the high level of secrecy in the secure hardware development space, these documents are often the best source of information on some devices as demonstrated by their use for vulnerability impact assessment. However, the security certification ecosystem contains thousands of certificates and associated documents, which were not made to be machine readable and vary in their format and structure.
In this talk, we propose an automated way of mining these documents for information valuable to system stakeholders. We also use this information ourselves to analyze temporal trends in the security certifications landscape as well as the references between certificates and demonstrate their helpfulness for vulnerability impact assessment.
Speaker: Ján Jančár, Masaryk University
►About the event
Research Day showcases successful research cooperation between Red Hat and academic institutions worldwide and connects researchers with Red Hat engineers, customers, partners, industry representatives, and others interested in research that will impact open source software.
►Are you interested in open source projects we are incubating at Red Hat Research? Visit research.redhat.com to learn more and get involved!
Cryptographic hardware and software is often certified under security certification standards like the Common Criteria or FIPS 140 . The certification process involves a vendor submitting the product under evaluation to an independent evaluation facility, which evaluates the vendor’s claims on the security of the product and its development. This certification process produces several publicly available documents: the certification report, the security target, and sometimes a protection profile. These documents contain valuable information for the certification system stakeholders, researchers, and for vulnerability assessment. With the high level of secrecy in the secure hardware development space, these documents are often the best source of information on some devices as demonstrated by their use for vulnerability impact assessment. However, the security certification ecosystem contains thousands of certificates and associated documents, which were not made to be machine readable and vary in their format and structure.
In this talk, we propose an automated way of mining these documents for information valuable to system stakeholders. We also use this information ourselves to analyze temporal trends in the security certifications landscape as well as the references between certificates and demonstrate their helpfulness for vulnerability impact assessment.
Speaker: Ján Jančár, Masaryk University
►About the event
Research Day showcases successful research cooperation between Red Hat and academic institutions worldwide and connects researchers with Red Hat engineers, customers, partners, industry representatives, and others interested in research that will impact open source software.
►Are you interested in open source projects we are incubating at Red Hat Research? Visit research.redhat.com to learn more and get involved!
