1. NASA PKI for PKI FORUM Presenters: Paul Ma, NASA-Ames Research Center

2. Outline
Background Information on Information Technology Security Development Group (ITSDG)
NASA PKI Deployment Plan
Objectives and Scope
NASA Public Key Infrastructure (PKI)
PKI Components
NASA PKI Components and Architecture
NASA Issues
Issues for the PKI Forum

3. NASA NASA has 11 major Centers distributed all over United States:
Ames Research Center (ARC) at Moffett Field, CA
Dryden Flight Research Center (DFRC) at Southern CA
Glenn Space Flight Center (GRC) at Cleveland, OH
Goddard Space Flight Center (GSFC) at Greenbelt, MD
Jet Propulsion Laboratory (JPL) at Pasadena, CA
Johnson Space Center (JSC) at Houston, TX
Kennedy Space Center (KSC) at Cape Canaveral, FL
Langley Research Center (LaRC) at Hampton, VA
Marshall Space Flight Center (MSFC) at Huntsville, AL
Stennis Space Center (SSC) at Bay St. Louis, MI

4. Principal Center for IT Security
GSFC
GRC
MSFC
JPL
ARC
IT Security Notifications, Incident Coordination & Response
Expert Center
IT Security Training
and Awareness
IT Security Networks & Communications
Expert Center
IT Security Systems & Applications
Expert Center
IT Security Development
Expert Center
(ITSDG)
Incident(s) Identification
Curriculum Requirements
Network Audit Tools
Audit Tools
Architecture Planning
Intrusion Tracking
IT Security Workshops
Firewalls
Application Security
Enabling Applications
Response Teams
IT Security Awareness
Internet Security Req.
Virus Detection
Secure Video Conferences
Threat Evaluate
On-Line Courses
Incident Tracking Tools
WWW Secure Applications
Crypto-Technology
Demonstrations
Threat Resolution
ITS Technical Training
Monitoring & Testing
Secure O/S Configurations
IT Security Tools
WorkFlow Secure Processes
Liaison
System Testing Tools

5. NASA PKI Deployment Plan
Objectives
To implement a public key infrastructure contains the following components:
A common NASA directory or repository for certificates
A certificate authority (CA)
Agents of the CA, registration authorities (RA)
Policies to guide the operation of the PKI

6. PKI Deployment Plan Scope
Establishing one central CA located at ARC and RA at ARC
Assist the setup of RAs at other Centers
Providing PKI services to secure sensitive but unclassified electronic information
Creating documents for CA operation; Certificate Policy Statement, Certificate Practice Statement, and Security Plan
Implementing security mechanisms and procedures for secure CA operation
Establishing a disaster recovery plan
Establishing a technical support service

7. NASA PKI Components The NASA PKI services are provided by:
Certification Authority (CA)
Ames manages the NASA CA. The software used is Entrust Technologies’ Entrust Infrastructure version 4.0.
Registration Authority (RA)
Each NASA Center manages its own RA operation using Entrust Technologies’ Administration Software.
Certificate Repository
Certificates are stored in the existing NASA X.500 infrastructure.
Policy
NASA’s policies are defined in the X.509 Certificate Policy for NASA PKI and the NASA Certification Authority Certification Practice Statement.

8. NASA PKI Architecture Certificates are stored here RAs sends requests
X500
Certificates are
stored here
NASA
Center
RAs sends requests
for certificates to the CA
Certificates are
managed
by the CA
Center RA
Entrust Authority
(Entrust CA)
Main System
Ames
Backup
Data
Entrust Authority
(Entrust CA)
Backup System
MSFC

9. User Access USER COMMUNITY End users retrieve certificates
from the distributed directories
for use by their PKI-enabled
applications.
X500
NASA
ARC
MSFC
DFRC
JSC
GSC
GSFC
KSC
JPL
LaRC HQ
SSC
USER COMMUNITY
Entrust Authority
(Entrust CA)
Main System
Ames
End users access the CA
During certificate creation/
recovery/update operations.

10. PKI Status
Secure CA at ARC and backup CA at MSFC have been tested and have been operational.
Seven Centers have been passed through the ORR Audit.
2 Centers need more documentation before the final ORR approval.
2 more Centers are preparing for the ORR.
Currently we are hoping to finish the ORR by the end of March providing the Centers are ready.

11. NASA Applications NASA PKI Secure Web Secure Desktop Secure E-Mail
Secure Networking
NASA PKI
Secure
Web
Secure File Transfer
Secure Remote
Access
Secure E-Forms
Secure Desktop
Secure
E-Grant
Copyright 1997 Entrust Technologies 3

12. Information Integrity: Key To A Safe Free-Flight Airspace System

13. NASA Issues
Interoperability between CAs, applications (Eudora and MS Exchange/Outlook)
Directory Service was a major problem internally
Policy issues gave us more troubles or as much troubles as technically issues
export, auditing, archiving, license tracking, etc
how to deal with external partners

14. Issues for PKI Forum
PKI Forum needs to deal with scalability issues as well as interoperability issues
Heavy client
Directory lookup
CRL distribution
How is PKI is going to deal with all the millions of IPSec devices that are coming that require security?