The nih pki pilots
Download
1 / 17

The NIH PKI Pilots - PowerPoint PPT Presentation


  • 228 Views
  • Uploaded on

The NIH PKI Pilots. Peter Alterman, Ph.D. … again. NIH publishes RFAs and other announcements of research topics and training opportunities Researchers submit applications for funding under a number of mechanisms Applications are reviewed by independent study sections 3 – 4X/year

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about ' The NIH PKI Pilots' - irisa


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
The nih pki pilots

The NIH PKI Pilots

Peter Alterman, Ph.D.

… again


A simplified description of the nih extramural research business process

NIH publishes RFAs and other announcements of research topics and training opportunities

Researchers submit applications for funding under a number of mechanisms

Applications are reviewed by independent study sections 3 – 4X/year

Approved applications are ranked

Grants are funded by score and mission relevance

Annual reports submitted

Noncompeting renewals make up bulk of ~40k grants issued annually (about $13B!)

A Simplified Description of the NIH Extramural Research Business Process



Phase i pki enable an adobe i form version of a phs 398 application for research grant
Phase I: PKI-enable an Adobe I-form Version of a PHS-398, Application for Research Grant

  • Allergy Institute created an electronic version of the application form

  • NIH and Digital Signature Trust working to allow attachment of two TrustID digital signatures to the completed I-form

  • Institutions will acquire TrustID digsigs courtesy of NIH, download I-form, complete dummy application, sign (PI and AOR) and return to NIH as email attachment

  • NIH will transfer attachment to local hard disk, then validate signatures using E-lock Assured Office client

  • Some platform and process constraints understood in pilot

  • Outcomes:

    • demonstration of successful creation, signing and validating of I-form 398

    • Identification of areas requiring further development


What it looks like
What it Looks Like Application for Research Grant

NIH test user

University 1

end-users

University 3

End users

NIH CA

And Directory

trustpath

trustpaths

Actually

DST CA for

Pilot

University 2

end-users


Phase II: Replace NIH-supplied Digital Certificate with Institution’s Digital Certificate (in multiple flavors)

  • UAB, UW-M and UCOP

    • TrustID cert (no-brainer, already done in Phase I)

    • VeriSign cert

    • Netscape IPlanet cert

  • NIH cross-certifies with the Fed Bridge at the test level of assurance

  • Educause sets up the HE Bridge

  • Fed Bridge and HE Bridge cross-certify at the test level of assurance

  • Institutions cross-certify with the HE Bridge at the test level

  • NIH validates certs using modified E-Lock product

  • Validation path runs through Fed Bridge toHE Bridge to Institutions’ CRLs


Remember this slightly modified
Remember This? Slightly Modified… Institution’s Digital Certificate (in multiple flavors)

NIH CA, Directory,

End user

HE Bridge CA

And Directory

Fed Bridge CA

And Directory

Validationpath

Validationpaths

Actually

DST CA for

Pilot

CA,Directory,

CRL, end users

CA, Directory,

CRL, end users


The federal bridge certification authority description and current status

The Federal Bridge Certification Authority – Description and Current Status

Peter Alterman, Ph.D.

Senior Advisor to the Chair, Federal PKI Steering Committee

and

Acting Director, Federal Bridge Certification Authority


The fbca architecture
The FBCA Architecture and Current Status

CA, Directory,

End users

Bridge CA

And Directory

Bridge CA

And Directory

Trustpaths

Trustpaths

CA,Directory,

End users

Trustpaths

CA, Directory,

End users


Fbca overview
FBCA Overview and Current Status

  • Designed for the purpose of creating trust paths between among PKI domains

  • Issues cross-certificates to Member CAs only

  • Employs a distributed, NOT a hierarchical, model

  • Commercial products participate within the membrane of the Bridge OR interoperate with products within the membrane

  • Develops cross certificates within the membrane to bridge the gap among dissimilar products


Fbca goals
FBCA Goals and Current Status

  • Leverage emerging Federal Agency PKIs to create a unified Federal PKI

  • Limit workload on Agency CA staff

  • Support Agency use of:

    • Any FIPS-approved cryptographic algorithm

    • A broad range of commercial CA products

  • Propagate policy information to certificate users in different Agencies


Fbca operation
FBCA Operation and Current Status

  • Issues Cross-Certificates to Participating CAs only

  • FPKI Steering Committee oversees FBCA development and operations

    • Documentation

    • Enhancements

    • Client-side software

  • Operates in accordance with Policy Authority and FPKISC direction


Fbca management hierarchy
FBCA Management Hierarchy and Current Status

  • Steering Committee oversees FBCA development and operations

    • Direct Operational Authority

    • Bridge Documentation

    • Enhancements

  • Policy Authority determines participants and levels of cross-certification

    • Administers Certificate Policy

    • Approves requests to cross-certify

    • Enforces compliance by member organizations

  • GSA named Operational Authority

    • Operates in accordance with Policy Authority and Steering Committee direction


Current status august 10 2001
Current Status - August 10, 2001 and Current Status

  • Policy Authority approved final documentation on June 18, 2001

    • Certificate Policy

    • Certification Practices Statement

    • Independent Compliance Analysis

  • FBCA “open and ready for business” at the GSA/FTS WillowWoods facility operated by Mitretek Systems on June 7, 2001

  • Prototyping/Compatibility lab continues operational off-site

  • Hot backup site nearing completion

  • C & A Audit under way by KPMG

  • Three federal agencies and one state government preparing documentation for application for interoperability with Bridge: NASA, NFC, FDIC, Illinois


What will it take to use the fbca
What Will It Take to Use the FBCA? and Current Status

  • Policy mapping of certificate policies

  • Sharing annual audits

  • Careful management of cross-certificates to limit transitive trust (exclusion trees)

  • Directory interoperability and synchronization

  • Client software for certificate path discovery and processing


Next steps
Next Steps and Current Status

  • Continue to bring federal agencies into interoperability

  • Bring additional products into Bridge membrane and/or verify interoperability with products in membrane: working with RSA, Cylink, Spyrus and talking with VeriSign and Microsoft

  • Pursue interoperability with State PKIs

  • Pursue interoperability with Nation of Canada

  • Pursue interoperability with non-government sector bridges


References
References and Current Status

  • Federal PKI Steering Committee Website: http://www.cio.gov/fpkisc

  • FBCA Page: http://www.cio.gov/fpkisc/fbca/index.htm

  • NIST PKI Website: http://csrc.nist.gov/pki


ad