The nih pki pilots
1 / 17

The NIH PKI Pilots - PowerPoint PPT Presentation

  • Uploaded on

The NIH PKI Pilots. Peter Alterman, Ph.D. … again. NIH publishes RFAs and other announcements of research topics and training opportunities Researchers submit applications for funding under a number of mechanisms Applications are reviewed by independent study sections 3 – 4X/year

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about ' The NIH PKI Pilots' - irisa

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
The nih pki pilots

The NIH PKI Pilots

Peter Alterman, Ph.D.

… again

A simplified description of the nih extramural research business process

NIH publishes RFAs and other announcements of research topics and training opportunities

Researchers submit applications for funding under a number of mechanisms

Applications are reviewed by independent study sections 3 – 4X/year

Approved applications are ranked

Grants are funded by score and mission relevance

Annual reports submitted

Noncompeting renewals make up bulk of ~40k grants issued annually (about $13B!)

A Simplified Description of the NIH Extramural Research Business Process

Phase i pki enable an adobe i form version of a phs 398 application for research grant
Phase I: PKI-enable an Adobe I-form Version of a PHS-398, Application for Research Grant

  • Allergy Institute created an electronic version of the application form

  • NIH and Digital Signature Trust working to allow attachment of two TrustID digital signatures to the completed I-form

  • Institutions will acquire TrustID digsigs courtesy of NIH, download I-form, complete dummy application, sign (PI and AOR) and return to NIH as email attachment

  • NIH will transfer attachment to local hard disk, then validate signatures using E-lock Assured Office client

  • Some platform and process constraints understood in pilot

  • Outcomes:

    • demonstration of successful creation, signing and validating of I-form 398

    • Identification of areas requiring further development

What it looks like
What it Looks Like Application for Research Grant

NIH test user

University 1


University 3

End users


And Directory




DST CA for


University 2


Phase II: Replace NIH-supplied Digital Certificate with Institution’s Digital Certificate (in multiple flavors)

  • UAB, UW-M and UCOP

    • TrustID cert (no-brainer, already done in Phase I)

    • VeriSign cert

    • Netscape IPlanet cert

  • NIH cross-certifies with the Fed Bridge at the test level of assurance

  • Educause sets up the HE Bridge

  • Fed Bridge and HE Bridge cross-certify at the test level of assurance

  • Institutions cross-certify with the HE Bridge at the test level

  • NIH validates certs using modified E-Lock product

  • Validation path runs through Fed Bridge toHE Bridge to Institutions’ CRLs

Remember this slightly modified
Remember This? Slightly Modified… Institution’s Digital Certificate (in multiple flavors)

NIH CA, Directory,

End user

HE Bridge CA

And Directory

Fed Bridge CA

And Directory




DST CA for



CRL, end users

CA, Directory,

CRL, end users

The federal bridge certification authority description and current status

The Federal Bridge Certification Authority – Description and Current Status

Peter Alterman, Ph.D.

Senior Advisor to the Chair, Federal PKI Steering Committee


Acting Director, Federal Bridge Certification Authority

The fbca architecture
The FBCA Architecture and Current Status

CA, Directory,

End users

Bridge CA

And Directory

Bridge CA

And Directory




End users


CA, Directory,

End users

Fbca overview
FBCA Overview and Current Status

  • Designed for the purpose of creating trust paths between among PKI domains

  • Issues cross-certificates to Member CAs only

  • Employs a distributed, NOT a hierarchical, model

  • Commercial products participate within the membrane of the Bridge OR interoperate with products within the membrane

  • Develops cross certificates within the membrane to bridge the gap among dissimilar products

Fbca goals
FBCA Goals and Current Status

  • Leverage emerging Federal Agency PKIs to create a unified Federal PKI

  • Limit workload on Agency CA staff

  • Support Agency use of:

    • Any FIPS-approved cryptographic algorithm

    • A broad range of commercial CA products

  • Propagate policy information to certificate users in different Agencies

Fbca operation
FBCA Operation and Current Status

  • Issues Cross-Certificates to Participating CAs only

  • FPKI Steering Committee oversees FBCA development and operations

    • Documentation

    • Enhancements

    • Client-side software

  • Operates in accordance with Policy Authority and FPKISC direction

Fbca management hierarchy
FBCA Management Hierarchy and Current Status

  • Steering Committee oversees FBCA development and operations

    • Direct Operational Authority

    • Bridge Documentation

    • Enhancements

  • Policy Authority determines participants and levels of cross-certification

    • Administers Certificate Policy

    • Approves requests to cross-certify

    • Enforces compliance by member organizations

  • GSA named Operational Authority

    • Operates in accordance with Policy Authority and Steering Committee direction

Current status august 10 2001
Current Status - August 10, 2001 and Current Status

  • Policy Authority approved final documentation on June 18, 2001

    • Certificate Policy

    • Certification Practices Statement

    • Independent Compliance Analysis

  • FBCA “open and ready for business” at the GSA/FTS WillowWoods facility operated by Mitretek Systems on June 7, 2001

  • Prototyping/Compatibility lab continues operational off-site

  • Hot backup site nearing completion

  • C & A Audit under way by KPMG

  • Three federal agencies and one state government preparing documentation for application for interoperability with Bridge: NASA, NFC, FDIC, Illinois

What will it take to use the fbca
What Will It Take to Use the FBCA? and Current Status

  • Policy mapping of certificate policies

  • Sharing annual audits

  • Careful management of cross-certificates to limit transitive trust (exclusion trees)

  • Directory interoperability and synchronization

  • Client software for certificate path discovery and processing

Next steps
Next Steps and Current Status

  • Continue to bring federal agencies into interoperability

  • Bring additional products into Bridge membrane and/or verify interoperability with products in membrane: working with RSA, Cylink, Spyrus and talking with VeriSign and Microsoft

  • Pursue interoperability with State PKIs

  • Pursue interoperability with Nation of Canada

  • Pursue interoperability with non-government sector bridges

References and Current Status

  • Federal PKI Steering Committee Website:

  • FBCA Page:

  • NIST PKI Website: