Managing Secure Access Requirements with Smart Cards and Digital Certificates

Michelle Escalante

Product Manager

Novell, Inc.

Klaus Schmeh

Product Manager

Cryptovision

Jim Thompson

Category Specialist - Interlink

Novell, Inc.

Agenda

Access management issues

Implementation Considerations

Technology Solutions

Case Studies

US government

Commercial

Foreign Goverment

Summary

Access Management Issues

User

Different user names and credentials

Lost/forgotten credentials

Administrators

Undefined, un-enforced security policies

Repetitive tasks

Business

Costly non-integrated identity infrastructure

Difficult to include new business processes and applications

Information Protection

Regulation Compliance

Information Protection

Audit trails

Centralized Provisioning and Deprovisioning

Stronger Authentication

Smart Card Lifecycle*

*From Burton Group, “Public Key Infrastructure,” Nov. 13, 2003

START

Card Enrollment

Retire

Re-issuance (if lost)

User

Issuance

Physical/premises

card use

Logical

card use

Application

provisioning

Personalization

Card management

system

PKI/directory

Secure Web Access B2C

Highly Scalable

Web based user interface and updates

Secure transactions

Verify customer identity

Digitally signed workflow

Corporate Applications

Smart cards for AuthN

Digital Signatures

Encrypted eMail

VPN

Physical building access

PKI
What does it enable?

Government High Security

Enhanced multi-functional security cards

Graded Authentication

Centralized Control

Citizen ID Cards

Mobile Devices

Multi-Application

Highly Scalable

Distributed Management

Enterprise Security

Comprehensive life-cycle management

Linked to corporate identity

Securing digital assets

Expanding regulatory compliance needs

3rd Party Security Applications (RSA)

Implementation Considerations
PKI provisioning

Access Management Issues

“smart badge” projects offer a compelling blend of stronger identity assurance, data security, and cost reduction. To successfully deploy smart cards, organizations should use lifecycle management systems to integrate solution components and improve the user experience.”

Smart Cards in the Enterprise: Lifecycle Management Systems Are a Key Component

V1, August 26, 2004 – Burton Group

Corporate Identity

Linking smart card with an existing identity

Card management interface

Temporary Smart Card

Hardware vs. Software certificate authentication

Implementation Considerations
Smart Card management

Technology solutions

Integrated tested solutions

Strong partner and standards support

Flexible integration with existing components

Freedom of choice

Technology components

identity management

provisioning

life cycle management

business workflow

user interfaces

public key infrastructure

Smart Cards

middle ware

Practical Applications

DOD WHS Case Study

Challenge: Transparency and Security
Opportunity: Identity

Managing identities resolves the conflict between transparency and security

Constituents and employees are authenticated based upon X.509 certificates, digital signatures or other means

Authorization to access data is based upon defined policies, regulations and statutes

Transparency

Privacy

Identity

who am I?

what can I access?

Provides users the capability to login to either Microsoft Active Directory or Microsoft Domains with a required common access card (CAC), which contains an appropriate digital certificate to authenticate to the specified domain.

Disconnected mode for laptop or otherwise disconnected users

Configurable grace periods for CRLs

Temporary certificate based authentication mechanism for users of forgotten/lost CACs

Enforcement of hardware certificates for users using their permanent CAC

No user name and password required

Audit trail (to include disconnected mode)

Multiple CACs cannot authenticate to single account

One CAC cannot authenticate to multiple accounts

What were the DOD requirements?

Challenge: Transparency and Security
Opportunity: Identity

DoD Policies and Directives

DoDI 8520: “E3.4.1.1. Network Login. All DoD networks required by reference (a) to authenticate users shall perform this authentication using certificates issued by the DoD PKI on hardware tokens (e.g., the CAC or an equivalent assurance level DoD PKI token).”

DoDI 8520: “Certificates accepted by DoD relying parties must be issued by a PKI approved by the ASD(NII)/DoD CIO at an assurance level appropriate for the information being protected”

DoDI 8500.2: “Identification and authentication is accomplished using the DoD PKI Class 3 certificate and hardware security token (when available).”

May 21 2002 DoD CIO Policy Memo: “PK-enable unclassified networks for hardware token, certificate-based access control by October 2003”

October 7 2003 DoD CIO Memo: Update to May 17 2001 “Components may review the PKI implementation milestones in reference (a) and modify or adjust their implementation dates as required, but in no case beyond April 2004.”

Novell Solution: Novell Certificate Login (NCL)
DOD Solution: Certificate Based Network Login (NCL=CBNL)

eDirectory: Foundation for Novell identity services; provides architectural base for directory-enabled solutions

NICI: underlying FIPS-compliant crypto module that supports these Novell products; FIPS 140-1 Certified

SecretStore: a secure central repository within eDirectory for storing user identity and credential information

NMAS: enables strong authentication and advanced authorization from a variety of platforms using many identity measures (e.g., smart cards, biometrics, etc)

Secure Identity Manager: Synchronizes and distributes information across directories, databases, and applications

Nsure Audit: A secure logging and auditing service

CBNL @ 39,999 ft

NICI

Authentication Server

NMAS

NMAS

Client

®

Windows Authentication



Validation

Username/Password

NT/2K/XP

NICI

Domain Controller

DirXML®

eDirectory

What is next?

HSPD12 – Homeland Security Presidential Directive 12 (HSPD12): Directive states that all US Government employees and contractors will use a government smartcard to gain access to government facilities and authenticate to access government data.

HSPD12 is federal today but will move to state and local government levels.

Commercial industries such as financial, energy, retail, and education are studying the future use of these technologies.

Combination of SLES 9 with EAL 4 + certification and NCL secure authentication equals a very powerful, secure environment.

Case Studies:
EMEA Government & Commercial

PKI case studies

US Government

Airline implementation (Star Alliance)

European state government

PKI architecture – outdated way

Telephone System

CRM System

Groupware

ERP System

Identity Management

PKI

Identity Management

PKI architecture – identity driven way

Telephone System

CRM System

Groupware

ERP System

PKI

Case Study 1: Star Alliance

Star Alliance: Network of 16 independent airlines, including Lufthansa, Air Canada, and United Airlines

Star Alliance introduced

Star Alliance:

Founded in 1997

Today 16 members

700 airports worldwide covered

128 countries covered

Wide range of frequent flyer benefits

320,000 employees

Star Alliance is the largest airline network in the world.

Star Alliance IT

Star Alliance IT couldn't be more heterogeneous:

Each member has its own different IT infrastructure

At the start there were no common platforms

Business applications for all member airlines had to be established

Star Alliance business applications

business application server

business application client

Access for airline employees from different platforms

Access for passengers

Access must be secure

Accounts and access must be managed

Security and Identity Management

business application server

business application client

Web Portal
SSL encryption

Identity
Management

SSL encryption
Web Browser

Security considerations in detail

Security considerations

Authentication and encryption are necessary

SSL is used for encryption

Other PKI applications are planned:

digital signatures

IPsec

Smart Cards

data encryption

=> PKI is needed

Star Alliance PKI requirements

PKI requirements

web-based administration

user self service

mobile clients

OCSP

SCEP

Integration into identity management, no additional infrastructure

Star Alliance

PKI product possibilities

Entrust PKI: High-end PKI solution with many features

PKIntegrated: Novell-integrated PKI solution by cryptovision

Star Alliance: PKI solutions

Novell integration

functionality

PKIntegrated

Entrust PKI

Low Price

SCEP

eDirectory

with cryptovision

schema extension

cryptovision general PKI architecture

PKI application

DirX, ADS

SAP, Peoplesoft

Lotus Notes

Identity Manager

cryptovision CA driver

Identity Manager

Signature Engine

cryptovision ca/server

iManager

with cryptovision

snapins

OCSP

LDAP

certificates

and CRLs

Administration

RA Operation

Smart Card Issuance

SCEP

eDirectory

with cryptovision

schema extension

Star Alliance PKI architecture

PKI application

United

Lufthansa

14 others

Identity Manager

cryptovision CA driver

Identity Manager

Signature Engine

cryptovision ca/server

iManager

with cryptovision

snapins

OCSP

LDAP

certificates

and CRLs

Administration

RA Operation

Smart Card Issuance

SCEP

eDirectory

with cryptovision

schema extension

Star Alliance PKI architecture

PKI application

United

Lufthansa

14 others

Identity Manager

cryptovision CA driver

Identity Manager

Signature Engine

cryptovision ca/server

iManager

with cryptovision

snapins

OCSP

LDAP

certificates

and CRLs

Administration

RA Operation

Smart Card Issuance

User self registration

issue soft certificates

SCEP

eDirectory

with cryptovision

schema extension

Star Alliance PKI architecture

PKI application

United

Lufthansa

14 others

Identity Manager

cryptovision CA driver

Identity Manager

Signature Engine

cryptovision ca/server

iManager

with cryptovision

snapins

OCSP

LDAP

certificates

and CRLs

Administration

RA Operation

Smart Card Issuance

User self registration

issue soft certificates

iChain

HTTPS with OCSP

certificate validation

SCEP

eDirectory

with cryptovision

schema extension

Star Alliance PKI architecture

PKI application

United

Lufthansa

14 others

Identity Manager

cryptovision CA driver

Identity Manager

Signature Engine

cryptovision ca/server

iManager

with cryptovision

snapins

OCSP

LDAP

certificates

and CRLs

Administration

RA Operation

Smart Card Issuance

User self registration

issue soft certificates

iChain

HTTPS with OCSP

certificate validation

Cisco

Cisco

IPsec

Case Study 2: European state goverment

Customer: European state government
authority (ESG)

12,000 employees

heterogeneous IT environment

uses eDirectory as metadirectory

has to use public CA

ESG PKI needs

ESG uses eDirectory for
identity management

ESG had to use external
government PKI

Solution: integration of external PKI and
internal identity management (identity driven)

ESG

ESG PKI architecture (first step)

eDirectory

User

PIN letter, welcome mail

PKI Provider

Web-Server

Certification
Authority

certificate generation

Internet

ESG PKI additional requirements

Problem: user key profile is only available on the user‘s PC

In other words: identity is tied to a PC, which is a limitation of the identity driven approach

Solution: realisation of roaming profiles

Roaming profile requirements

backup copy of key
must be available

roaming profile must
be based on eDirectory

same password for
eDirectory and key

enforced renewal
of certificate

only one valid
certificate per user

no key storage on
computer after logout

ESG

Extended ESG PKI architecture

eDirectory

User

PIN letter, welcome mail

PKI Provider

Web-Server

Certification
Authority

certificate generation

Internet

ESG

Extended ESG PKI architecture

eDirectory

User

PIN letter, welcome mail

PKI Provider

Certification
Authority

Web-Server

certificate generation

Internet

ESG

Extended ESG PKI architecture

eDirectory

User

PIN letter, welcome mail

PKI Provider

Certification
Authority

Certificate
Installation
Client

Certificate
Enrollment
Server

Web-Server

certificate generation

Internet

ESG

Extended ESG PKI architecture

eDirectory

User

PIN letter, welcome mail

PKI Provider

Certification
Authority

Certificate
Installation
Client

Certificate
Enrollment
Server

Web-Server

certificate generation

Internet

Case Study Summary

Integrated certificate lifecycle management reduces PKI TCO

cryptovision is a specialist for PKI integration in Novell identity management environments

this includes:

setup an internal PKI

integrate an external PKI

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

DODI 8500 & 8520

Government paperwork elimination act (GPEA)

Need electronic signatures

Electronic Transaction act

21 CFR Part 11

Control for closed systems.

Digital signatures

Non-repudiation

HIPAA

Health Insurance Portability and Accountability Act of 1996

Confidentiality, integrity, availability of health care information

Graham Leach Bliley Act

Protection of nonpublic personal information

Financial privacy

Sarbane Oxley

Record tampering or impeding an official proceeding

Patriot Act

Protection of computing resources, data, program, system information for any computer system used by the government to administer justice, national defence and national security.

These two regulations apply to “financial institutions,” which include not only banks, securities firms, and insurance companies, but also companies providing many other types of financial products and services to consumers. Among these services are lending, brokering or servicing any type of consumer loan, transferring or safeguarding money, preparing individual tax returns, providing financial advice or credit counseling, providing residential real estate settlement services, collecting consumer debts and an array of other activities.

A smart card is given to a user

Provisioning identity with security credentials. The card needs certificates which are assoicated with an identity within the card management system. Ideally it can also be associated with a corporate identity.

Card can be used to access physical resources, network resources – via applications, hardware, web, full clients, etc.

The applications need to be provisioned to recognize the certs and associate them with the proper user, and some applications will require certificates getting down to the user at a later time. EX: If you already have a smart card system deployed and wish to add another application that requires a special purpose certificate (like digital signing only cert)… how do you get that certificate created with the proper information, associated to the user, distributed to the users desktop and/or smart card?

Cards get lost, employees leave, new applications are desired to leverage the system… provisioning solution must automate this life cycle management process.

Many organizations have deployed PKI, or Smart Cards, or applications that require certificates today. The problem lies in managing that existing solution and also if they want to go further with security applications. There needs to be a provisioning process around Identity Management and PKI. Otherwise it end up being an expensive single purpose application that is difficult to integrate and leverage for other uses.

Some customers will have no smart card or PKI solution and be investigating a full smart card project (Australian DoD)

Some will already have deployed Smart Cards, Directory, and PKI and be looking to get more value out of that infrastructure. (DoD – Netscape PKI, CaC cards, eDir and AD)

Some will have a desired use but no PKI and need to integrate the application and PKI with their identity framework. (Swiss Tax Authority, sold on using RSA Keon Client and eDir)

Some will have an Identity infrastructure only and want to deploy a certificate based application or a smart card application (Postbank and GfK)

Some will have a mandate to do a large scale project, but not direction on the “how” and want to investigate a “manageable PKI solution” (City of Aarhus, Denmark)

Star Alliance is an example of a web based B2C application using certificates.

Working with CryptoVision we can integrate with a customers existing environment via IDM (*we will need to define a set of compatible PKI – today they are testing against Entrust and their own CA… which is a very strong start as Entrust is the top requested CA for Novell integration), existing smart card deployments, and existing directory deployments.

If you are an agency within the Department of Defense (DoD), you are charged with ensuring that your infrastructure meets the stringent security requirements laid out in DoD directives 8500 and 8520 and the recent Homeland Security Presidential Directive 12. [These directives specify that in order to maintain a high level of assurance security within the DoD, users must be authenticated to network systems based on something they have (a Common Access Card, or CAC) and something they know (a personal identification number, or PIN).]

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

DODI 8500 & 8520

Government paperwork elimination act (GPEA)

Need electronic signatures

Electronic Transaction act

21 CFR Part 11

Control for closed systems.

Digital signatures

Non-repudiation

HIPAA

Health Insurance Portability and Accountability Act of 1996

Confidentiality, integrity, availability of health care information

Graham Leach Bliley Act

Protection of nonpublic personal information

Financial privacy

Sarbane Oxley

Record tampering or impeding an official proceeding

Patriot Act

Protection of computing resources, data, program, system information for any computer system used by the government to administer justice, national defence and national security.

These two regulations apply to “financial institutions,” which include not only banks, securities firms, and insurance companies, but also companies providing many other types of financial products and services to consumers. Among these services are lending, brokering or servicing any type of consumer loan, transferring or safeguarding money, preparing individual tax returns, providing financial advice or credit counseling, providing residential real estate settlement services, collecting consumer debts and an array of other activities.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

User inserts CAC into CAC reader and enters PIN.

PIN unlocks the CAC.

NMAS Client passes username and CAC certificate to eDirectory

Novell Certificate Server APIs validates Certificate

eDirectory (&NMAS) authenticate user with certificate on the CAC

SecretStore passes securely stored authentication credentials back to Client

Novell Client passes credentials to Windows GINA

These credentials are used to authenticate to the Windows AD, Windows NT (or other OS) server

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

Getting access mgmt under control results in cost reductions come from a few areas:

unified badging system combining formerly disparate high security uses into one badge

help desk: help desk PW resents are expensive on users and HD personel

Speeding the process of WS authentication, reduce wasted redundant efforts.

2003-12-08T12:43:39

Michelle Escalante