The nih pki pilots
This presentation is the property of its rightful owner.
Sponsored Links
1 / 17

The NIH PKI Pilots PowerPoint PPT Presentation

  • Uploaded on
  • Presentation posted in: General

The NIH PKI Pilots. Peter Alterman, Ph.D. … again. NIH publishes RFAs and other announcements of research topics and training opportunities Researchers submit applications for funding under a number of mechanisms Applications are reviewed by independent study sections 3 – 4X/year

Download Presentation

The NIH PKI Pilots

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript

The nih pki pilots

The NIH PKI Pilots

Peter Alterman, Ph.D.

… again

A simplified description of the nih extramural research business process

NIH publishes RFAs and other announcements of research topics and training opportunities

Researchers submit applications for funding under a number of mechanisms

Applications are reviewed by independent study sections 3 – 4X/year

Approved applications are ranked

Grants are funded by score and mission relevance

Annual reports submitted

Noncompeting renewals make up bulk of ~40k grants issued annually (about $13B!)

A Simplified Description of the NIH Extramural Research Business Process

Currently nih extramural business process is all paper

Currently, NIH Extramural Business Process is ALL PAPER

Phase i pki enable an adobe i form version of a phs 398 application for research grant

Phase I: PKI-enable an Adobe I-form Version of a PHS-398, Application for Research Grant

  • Allergy Institute created an electronic version of the application form

  • NIH and Digital Signature Trust working to allow attachment of two TrustID digital signatures to the completed I-form

  • Institutions will acquire TrustID digsigs courtesy of NIH, download I-form, complete dummy application, sign (PI and AOR) and return to NIH as email attachment

  • NIH will transfer attachment to local hard disk, then validate signatures using E-lock Assured Office client

  • Some platform and process constraints understood in pilot

  • Outcomes:

    • demonstration of successful creation, signing and validating of I-form 398

    • Identification of areas requiring further development

What it looks like

What it Looks Like

NIH test user

University 1


University 3

End users


And Directory




DST CA for


University 2


The nih pki pilots

Phase II: Replace NIH-supplied Digital Certificate with Institution’s Digital Certificate (in multiple flavors)

  • UAB, UW-M and UCOP

    • TrustID cert (no-brainer, already done in Phase I)

    • VeriSign cert

    • Netscape IPlanet cert

  • NIH cross-certifies with the Fed Bridge at the test level of assurance

  • Educause sets up the HE Bridge

  • Fed Bridge and HE Bridge cross-certify at the test level of assurance

  • Institutions cross-certify with the HE Bridge at the test level

  • NIH validates certs using modified E-Lock product

  • Validation path runs through Fed Bridge toHE Bridge to Institutions’ CRLs

Remember this slightly modified

Remember This? Slightly Modified…

NIH CA, Directory,

End user

HE Bridge CA

And Directory

Fed Bridge CA

And Directory




DST CA for



CRL, end users

CA, Directory,

CRL, end users

The federal bridge certification authority description and current status

The Federal Bridge Certification Authority – Description and Current Status

Peter Alterman, Ph.D.

Senior Advisor to the Chair, Federal PKI Steering Committee


Acting Director, Federal Bridge Certification Authority

The fbca architecture

The FBCA Architecture

CA, Directory,

End users

Bridge CA

And Directory

Bridge CA

And Directory




End users


CA, Directory,

End users

Fbca overview

FBCA Overview

  • Designed for the purpose of creating trust paths between among PKI domains

  • Issues cross-certificates to Member CAs only

  • Employs a distributed, NOT a hierarchical, model

  • Commercial products participate within the membrane of the Bridge OR interoperate with products within the membrane

  • Develops cross certificates within the membrane to bridge the gap among dissimilar products

Fbca goals

FBCA Goals

  • Leverage emerging Federal Agency PKIs to create a unified Federal PKI

  • Limit workload on Agency CA staff

  • Support Agency use of:

    • Any FIPS-approved cryptographic algorithm

    • A broad range of commercial CA products

  • Propagate policy information to certificate users in different Agencies

Fbca operation

FBCA Operation

  • Issues Cross-Certificates to Participating CAs only

  • FPKI Steering Committee oversees FBCA development and operations

    • Documentation

    • Enhancements

    • Client-side software

  • Operates in accordance with Policy Authority and FPKISC direction

Fbca management hierarchy

FBCA Management Hierarchy

  • Steering Committee oversees FBCA development and operations

    • Direct Operational Authority

    • Bridge Documentation

    • Enhancements

  • Policy Authority determines participants and levels of cross-certification

    • Administers Certificate Policy

    • Approves requests to cross-certify

    • Enforces compliance by member organizations

  • GSA named Operational Authority

    • Operates in accordance with Policy Authority and Steering Committee direction

Current status august 10 2001

Current Status - August 10, 2001

  • Policy Authority approved final documentation on June 18, 2001

    • Certificate Policy

    • Certification Practices Statement

    • Independent Compliance Analysis

  • FBCA “open and ready for business” at the GSA/FTS WillowWoods facility operated by Mitretek Systems on June 7, 2001

  • Prototyping/Compatibility lab continues operational off-site

  • Hot backup site nearing completion

  • C & A Audit under way by KPMG

  • Three federal agencies and one state government preparing documentation for application for interoperability with Bridge: NASA, NFC, FDIC, Illinois

What will it take to use the fbca

What Will It Take to Use the FBCA?

  • Policy mapping of certificate policies

  • Sharing annual audits

  • Careful management of cross-certificates to limit transitive trust (exclusion trees)

  • Directory interoperability and synchronization

  • Client software for certificate path discovery and processing

Next steps

Next Steps

  • Continue to bring federal agencies into interoperability

  • Bring additional products into Bridge membrane and/or verify interoperability with products in membrane: working with RSA, Cylink, Spyrus and talking with VeriSign and Microsoft

  • Pursue interoperability with State PKIs

  • Pursue interoperability with Nation of Canada

  • Pursue interoperability with non-government sector bridges



  • Federal PKI Steering Committee Website:

  • FBCA Page:

  • NIST PKI Website:

  • Login