Presentation is loading. Please wait.

Presentation is loading. Please wait.

Ongoing Efforts to Build The US Federal PKI Bridge From Presentations by Federal PKI Policy Authority Officials and Others Put together by J. Scott, 2006.

Similar presentations


Presentation on theme: "Ongoing Efforts to Build The US Federal PKI Bridge From Presentations by Federal PKI Policy Authority Officials and Others Put together by J. Scott, 2006."— Presentation transcript:

1 Ongoing Efforts to Build The US Federal PKI Bridge From Presentations by Federal PKI Policy Authority Officials and Others Put together by J. Scott, 2006

2 Federal Bridge PKIJ. Scott 2006 Page 2 of 33 HSPD-12 -- George Bush On August 27, 2004, the White House issued Homeland Security Presidential Directive (HSPD) 12. Primary objectives of HSPD 12 are: –To develop and deploy a Federal Government-wide common and reliable identification verification system –To use this system to interoperate between all Government agencies and serve as the basis for reciprocity between those agencies.

3 Federal Bridge PKIJ. Scott 2006 Page 3 of 33 HSPD-12 Mandates all Federal Agencies issue ID credentials using FIPS-201 identity proofing procedures beginning 10/05 Mandates all Federal Agencies begin issuing SmartCards with medium assurance digital certificates by 10/06 Authorization remains a local prerogative within each participating agency

4 Federal Bridge PKIJ. Scott 2006 Page 4 of 33 Federal PKI Architecture after HSPD-12 Agency and other government PKIs required to cross-certify with the Federal Bridge CA As of 12/05 no new agency PKIs; agencies procure PKI services from vendors participating in the Shared Service Provider (SSP) program Architecture issues TLS/SSL certs to credential service providers who CAF, to provide mutual authentication Federal Bridge CA serves as “point of insertion” for external PKIs and other bridges.

5 Federal Bridge PKIJ. Scott 2006 Page 5 of 33 Simplified Diagram of Federal PKI Federal Bridge CA C4 CA E-Gov CAs (3) Common Policy CA Cross- Certified gov PKIs Cross- Certified External PKIs eAuth CSPs Shared Service Provider PKIs (Common Policy OID And root Cert)

6 Federal Bridge PKIJ. Scott 2006 Page 6 of 33 Electronic Authentication Initiatives –Assessment Framework for Credentials: evaluating the level of assurance (LOA) of identity of credential service providers –Membership in Liberty Alliance –Frequent meetings with Microsoft –Interfederation Interoperability Project with Cybertrust and Internet2/Shibboleth team

7 Federal Bridge PKIJ. Scott 2006 Page 7 of 33 Credentials Assessment Framework Credential Assessment Framework consists of the following: –A structured methodology and procedures for evaluating the LOA of a CSP’s credentials –An assessment team that goes out and evaluates CSPs –A process for conflict resolution –Posting CSPs and their credential LOAs to a trust list (unfortunate term) on the website

8 Federal Bridge PKIJ. Scott 2006 Page 8 of 33 E-Authentication: Interfed Interop inCommon Higher Education Identity Federation –Using Shibboleth middleware technical protocols –Policy-light E-Authentication US Identity Federation –Using a variety of technical protocols –Policy intensive

9 Federal Bridge PKIJ. Scott 2006 Page 9 of 33 What Are Electronic Identity Federations? Associations of electronic identity credential providers and credential consumers (electronic service providers) who: –Agree to trust each others’ credentials; –Agree to hold credential providers authoritative for the validity of their credentials; –Agree to use common communications protocols and procedures to enable interoperability –Agree to common business rules

10 Federal Bridge PKIJ. Scott 2006 Page 10 of 33 Purpose of Electronic Identity Federations To enable trusted electronic business transactions between end users and service providers –The service provider does not have to issue and manage identity credentials, including attributes. It’s all a matter of scaling.. No, it’s also a matter of control

11 Federal Bridge PKIJ. Scott 2006 Page 11 of 33 Characteristics of Identity Federations Standards and protocols for technical interoperability among credential providers, services providers, end users and infrastructure utilities A governance mechanism to assert common business rules, ensure credentials can be used and trusted by all members of the federation and a central control point for entry and exit of members

12 Federal Bridge PKIJ. Scott 2006 Page 12 of 33 LOA Mapping: E-Auth to Fed PKI E-Auth Level 1 E-Auth Level 2 E-Auth Level 3 E-Auth Level 4 FPKI Rudimentary, C4 FPKI Medium/HW & Medium/HW-cbp FPKI Basic FPKI Medium & Medium-cbp FPKI High (government only)

13 Federal Bridge PKIJ. Scott 2006 Page 13 of 33 Federal Bridge CA Goals Leverage emerging Federal Agency PKIs to create a unified Federal PKI and provide a cross- governmental, ubiquitous, interoperable Public Key Infrastructure. Limit workload on Agency CA staff Support Agency use of: –Any FIPS-approved cryptographic algorithm –A broad range of commercial CA products Propagate policy information to certificate users in different Agencies Support the development and use of applications which employ that PKI in support of Agency business processes.

14 Federal Bridge PKIJ. Scott 2006 Page 14 of 33 FBCA Certification Overview Designed for the purpose of creating trust paths between among PKI domains Issues cross-certificates to Member CAs only Employs a distributed, NOT a hierarchical, model Commercial products participate within the membrane of the Bridge OR interoperate with products within the membrane Develops cross certificates within the membrane to bridge the gap among dissimilar products

15 Federal Bridge PKIJ. Scott 2006 Page 15 of 33 FBCA Management Hierarchy Steering Committee oversees FBCA development and operations –Direct Operational Authority –Bridge Documentation –Enhancements Policy Authority determines participants and levels of cross- certification –Administers Certificate Policy –Approves requests to cross-certify –Enforces compliance by member organizations GSA named Operational Authority –Operates in accordance with Policy Authority and Steering Committee direction

16 Federal Bridge PKIJ. Scott 2006 Page 16 of 33 Generalized FBCA Architecture Bridge CA And Directory Bridge CA And Directory CA, Directory, End users CA, Directory, End users CA,Directory, End users Trust paths

17 Federal Bridge PKIJ. Scott 2006 Page 17 of 33 A Snapshot of the U.S. Federal PKI Federal Bridge CA DOA NFC PKI Higher Education Bridge CA NASA PKI DOD PKI Illinois PKI University PKI CANADA PKI

18 Federal Bridge PKIJ. Scott 2006 Page 18 of 33 FBCA Membrane Architecture Multiple commercial CAs within a “membrane” that cross-certify and interoperate –CyberTrust and Entrust Enterprise CA’s for cross-certification CAs offline No network connectivity –CA uses “Sneaker Net” to get to the directory FBCA directory online 24 X 7 X 365

19 Federal Bridge PKIJ. Scott 2006 Page 19 of 33 Cybertrust CAEntrust CA SFL Client Entrust Client Entrust Client SFL Client DoD Bridge CA Entrust Client Entrust Client Entrust Client Entrust Client SFL Client PCA CA

20 Federal Bridge PKIJ. Scott 2006 Page 20 of 33 What Will It Take to Use the FBCA? Policy mapping of certificate policies Sharing annual audits Careful management of cross-certificates to limit transitive trust (exclusion trees) Directory interoperability and synchronization Client software for certificate path discovery and processing

21 Federal Bridge PKIJ. Scott 2006 Page 21 of 33 Next Steps To Federal Bridge PKI Continue to bring federal agencies into interoperability Bring additional products into Bridge membrane Pursue interoperability with State PKIs Pursue interoperability with Nation of Canada Pursue interoperability with non-government sector bridges

22 Federal Bridge PKIJ. Scott 2006 Page 22 of 33 Why A U.S. Federal PKI? Mandates, such as HSPD-12, for e-government and implementing electronic signature technology Demands for improved services at lower cost International Competition International Collaboration

23 Federal Bridge PKIJ. Scott 2006 Page 23 of 33 Why NOT a U.S. Federal PKI? Concerns of Privacy Advocates Agency internal politics Vendor battles for market space Cost

24 Federal Bridge PKIJ. Scott 2006 Page 24 of 33 Building A U.S. Federal PKI Agencies implement their own PKIs Create a Federal Bridge CA using COTS products to cross-certify individual Agency PKIs and bind them together Establish a Federal PKI Policy Authority to oversee operation of the Federal Bridge CA Ensure directory compatibility Use ACES for transactions with the public

25 Federal Bridge PKIJ. Scott 2006 Page 25 of 33 FPKI Policy Authority Determines participants and levels of cross- certification –Participants become voting members Administers Certificate Policy Enforces compliance by member organizations General Services Administration serves as Operational Authority

26 Federal Bridge PKIJ. Scott 2006 Page 26 of 33 Policy Mapping Candidate Certificate Policies evaluated against the FBCA CP for adequacy and levels of assurance: –Identity binding –CA security Performed by the Federal Policy Management Authority Certificate Policy Working Group with contractor support Requirements publicly available on NIST website

27 Federal Bridge PKIJ. Scott 2006 Page 27 of 33 Policy Equivalence Example Can High ISO Banking Fed PKI High Fed PKI Med Fed PKI Basic Fed PKI Rud Can Medium Can Basic Can Rud DoD 4 DoD 3 DoD 2

28 Federal Bridge PKIJ. Scott 2006 Page 28 of 33 Policy Mapping Example Bridge CA Canadian CA DoD CLASS 3 Subscriber DoD CLASS 3 Subscriber Can. HIGH Subscriber Can. MED Subscriber DoD CLASS 4 = Federal High DoD CLASS 3 = Federal Medium Federal High = DoD CLASS 4 Federal Medium = DoD CLASS 3 Canadian High = Federal High Canadian Medium = Federal Medium Federal High = Canadian High Federal Medium = Canadian Medium DOD CA

29 Federal Bridge PKIJ. Scott 2006 Page 29 of 33 Cross Certifying with the Bridge Applicant PKIs and Bridges may cross- certify with the Federal PKI at one or more of the five levels of assurance of the Federal Bridge CA –Rudimentary, basic, medium, medium hardware and high Applicants can also cross certify at the Citizen and Commerce Class Certificate level of assurance.

30 Federal Bridge PKIJ. Scott 2006 Page 30 of 33 Requirements for Cross-Certifying Managers of PKI’s that wish to Cross Certify with the Federal Bridge PKI should contact the Policy Authority prior to submitting any documentation, so that we can work with you actively to smooth the process.contact the Policy Authority Requirements for Cross-Certification and Interoperability with the Federal PKI: 1.Submit a copy of your PKI Certificate Policy for mapping, along with contact information for the individual tasked with seeing to the cross- certification. Please download a copy of the "mapping matrix" available on the web site to use as you prepare your Policy for mapping.mapping matrix 2.Submit an Application for Cross-Certification signed by the responsible executive in charge of the applicant PKI (e.g., CIO, VP for Systems, etc.) to the Federal PKI Policy Authority Chair. Usually, this individual is in charge of funding and budget for the applicant's PKI.Application for Cross-Certification

31 Federal Bridge PKIJ. Scott 2006 Page 31 of 33 More Bridge Requirements 3.Submit a copy of the summary of your PKI's audit, stating that your operations comply with your CPS and that your CPS is in conformance with your CP. Please download a copy of the Audit Review Requirements from this web site to ensure you understand what language we are looking for.Audit Review Requirements If steps 1 - 3 are accomplished successfully, the Federal PKI Policy Authority will enter into negotiations with you to sign a mutually-acceptable Memorandum of Agreement (MOA) that will spell out our mutual responsibilities and expectations. For Bridges cross-certifying with the Federal Bridge CA, there are additional requirements to be fulfilled mutually. Memorandum of Agreement Once the MOA is signed, the Federal PKI Policy Authority Chair directs the Director of the Federal PKI Operational Authority to exchange cross- certificates with the new member PKI. Detailed discussions of all of these steps may be found in the FPKI Criteria and Methodology document on this web site, as well as many other supporting documents.FPKI Criteria and Methodology document

32 Federal Bridge PKIJ. Scott 2006 Page 32 of 33 An FCBA Status Report On Sept. 18, 2002, the FBCA cross-certified with the public key infrastructures to allow them to trust and validate the digital signatures on files issued and received from one another –The US Department of Defense –U.S. Department of the Treasury –U.S. Department of Agriculture –National Finance Center –National Aeronautics and Space Administration

33 Federal Bridge PKIJ. Scott 2006 Page 33 of 33 Cross Certified PKI’s March 2006 Organization CertifiedCertification LevelDate Certified NASAMediumSeptember 18, 2002 USDA/National Finance CenterMediumSeptember 18, 2002 USDA/National Finance Center BasicOctober 20, 2003 Department of DefenseMedium* September 18, 2002 Department of the TreasuryHighSeptember 18, 2002 Department of the Treasury MediumSeptember 18, 2002 Department of StateHighJanuary 21, 2004 State of IllinoisMediumJanuary 21, 2004 State of Illinois Basic** March 8, 2005 ACES/Digital Signature TrustMediumFebruary 11, 2004 Department of EnergyMediumApril 27, 2004 DoD External Certification Authority Medium** February 8, 2005 ACES/ORC, Inc. Medium** February 8, 2005 US Patent & Trademark OfficeMediumJune 1, 2005 Department of Homeland SecurityMediumJune 1, 2005 Department of Homeland Security HighJune 1, 2005 Department of Homeland Security BasicJune 1, 2005 Wells FargoBasic* December 13, 2005 Government Printing OfficeMedium** December 13, 2005 Department of JusticeHigh** December 15, 2005 * FBCA issued cross-certificate allowing one-way trust ** This was the date the Federal PKI Policy Authority voted on and approved issuing a FBCA cross-certificate


Download ppt "Ongoing Efforts to Build The US Federal PKI Bridge From Presentations by Federal PKI Policy Authority Officials and Others Put together by J. Scott, 2006."

Similar presentations


Ads by Google