mobile credentials ennio j. carboni product manager, keon pki 781-301-5323ecarboni@rsasecurity
Post on 15-Jan-2016
215 views
TRANSCRIPT
Mobile CredentialsEnnio J. CarboniEnnio J. Carboni
Product Manager, Keon PKIProduct Manager, Keon PKI
781-301-5323781-301-5323
ecarboni@rsasecurityecarboni@rsasecurity
RSA Keon®
• Robust, flexible Certification Authority
• Enhanced PKI Services – Interoperable across multiple certificate authorities,
directory servers and applications
– Powerful desktop with common credential store, two-factor authentication and file encryption
– Security server providing policy management, trust management and credential mobility
• Application Integration– RSA BSAFE® Cert tools natively PKI-
enabling applications
– RSA Keon Agent toolkit for integrating existing non-PKI applications (SSO)
RSA Keon Agent
RSA Keon Enhanced Services
RSA Keon Advanced PKI
RSA Keon Certificate Server
Web App
Applicationserver
(e.g.SAP)
RSA BSAFEPKI-enabled app.
RSA Keon Security
Server
RSA SecurIDAuthenticator
RSA Keon Desktop
RSA Keon Security Server
• Keon Credential Store management and delivery for mobile users
• Focal point for CA interoperability within Keon
• Automated certificate validation
• Centralized management for private key access policy
• Centralized logging depot for Keon components
• Replication for scalability
• Simplified Administration
Extend the use of digital certificates across organizations and applications
RSA Keon Desktop
• File Encryption
• Protection of Credentials
• PKI Credential Interoperability
• Smart Card Support
• Reduced Logon
• Ease of Deployment
Providing the critical requirements for desktop e-Security
Certificates & Cryptography bind digital identities to the data and transactions they manipulate
Authenticators bind people to their digital identities
SecurityNon-repudiation requires trust in certificates
How Secure is the Private Key?
Crypto OperationCrypto Operation
Where is it stored?Where is it stored?Hard DriveHard Drive
SmartSmartCardCard
How user authenticatesHow user authenticatesto the store?to the store?
VirtualVirtualSmart CardSmart Card
PKCS #12 export
PasswordPassword
Local PKI Credential Storage
PasswordPassword
PKCS #12 Issues
• PKCS #12 implementations hard to use
• Requires manual intervention
• No life cycle support
• Inconsistent update of credentials
• Limited security for private key– Password based
• Allows replication of identity
Smart Cards and Authentication
• Smart Cards are ideal for PPK Authentication– The Private Key lives in secure tamper
resistant storage
– “2 factor” authentication is re-introduced since you need both the Smart Card and a PIN to unlock it
– The crypto happens on the Smart Card with the help of a crypto accelerator
– They fit into your wallet, and they scrape frost off car windows nicely!
The Benefits of Smart Cards
• They are secure
• They are portable
• They can perform operations other than authentication– signatures, encryption
• They can support other applications– E-cash, Loyalty, ...
• They can be used as Employee badges
RSA SecurID 3100 Smart Card
• Highest security – On-card digital signatures
• Supports latest application features – Dual keys and certificates
• Mobility – Credential store on-card with keys,
certificates, login information and RSA SecurID seed
• Versatile– Supports RSA Keon Desktop for PKI
applications and classic RSA SecurID-protected systems
RSA SecurID 3100 Smart Card
Smart Card Readers– PC/SC– Setec SetCad 203N– Philips PE112/PE122
• Smart Cards– Philips DX– Setec 8k– Setec 16k– GemPlus GPK8000
Smart Card-Reader Interface
• There are actually two standardization issues to be dealt with– The electrical interface between the reader hardware and the
PC
• Fortunately standards exist here RS232 and USB
– More problematic is the interface between the reader hardware and the smart card
• Two classes of interface were needed here:
– Electrical Interface StandardsElectrical Interface Standards
– Command Interface StandardsCommand Interface Standards• ISO 7816 addresses these issues
Smart Card Reader Interface
• The next level of problem is the API between the smart card reader, and the host PC software– Until recently, each reader manufacturer had a
proprietary API which was used to talk to the reader driver
• This was an effort by the smart card reader manufacturers to lock applications into a particular reader
• Several years ago a consortia headed by Microsoft defined the PC/SC interface
– It was intended to be use by systems other It was intended to be use by systems other than Windows (Unix, PDAs, …)than Windows (Unix, PDAs, …)
– In reality, it is primarily a Microsoft Windows In reality, it is primarily a Microsoft Windows standardstandard
Smart Card Formatting
• There are two major ways of dealing with this formatting problem:– One solution is to develop a standardized way to layout
the card directory, and name the files
• PKCS15 developed by RSA Labs is an example
– The other solution is to abstract the interface to the card so that you no longer deal with directories and files
• JavaCard is an example
NetscapeCommunicator
Microsoft apps
RSA KeonCredentialStore
CAPI/CSP PKCS#11
PKI Credential InteroperabilitySharing credentials across multiple applications
The Barriers to Smart Cards
• They need a reader– This will be an issue until these become embedded in
keyboards and notebooks
• They cost money– But prices are getting pretty reasonable
• Not all applications support PPK and Smart Cards– But many of today’s applications are Web based, and the
browsers do support them
• Industry compatibility– PC/SC Readers now available
– PKCS #15 from RSA Labs
PKCS15
• What is it?– It is a specification for organizing cryptographic data onto an
authentication objects (e.g. card, other devices)– Allows multiple PKCS15 applications to live
on same card
• People frequently confuse PKCS11 and PKCS15– PKCS11 is a standard which defines how to plug cryptographic
tokens into a crypto solution• These tokens could be smart cards or crypto accelerators for
example– PKSC15 is a standard which defines the layout of a smart card
format, and the naming standard for common files
• The application developers who use smart cards are focusing on PKCS15
Virtual Smart & Physical Smart Card
RSA Keon Advanced PKICredential Store Format
Keon Credential Store
Private Area
Public Area
Symmetric FileEncryption Key
NT/NetWare Credentials
RC4 128-bit Private Area Key
User’s EncryptionX.509 Certificate
Public Key
User’s SigningX.509 Certificate
Public Key
RC4 128-bit Private Area Key
SigningPrivate Key
Encryption Private Key
Unique PKI Issues forB2B & Extended Enterprises
• Partners wishing to use PKI to protect transactions over the Internet.– Must support the “Big 2” web browsers and mail clients
– Must be secure over a public network
– Must be unobtrusive to partners’ PCs
– Must be easy to use
– Solution must be secure, scalable, and manageable
– Users credentials must be mobile
• Large enterprise deployments wanting to use PKI for a variety of functions– Browser, S/MIME, IPSec
– The enterprise requires unobtrusive software
– Must be easy to use
– The solution must be secure and be run over a public network
Unique PKI Issues forB2B & Extended Enterprises
RSA Keon Advanced PKI Ease of Use: Credential Mobility
RSA Keon Security Server
Downloadable Desktop Architecture
COM server
Local Security Service
RSA Security Cryptographic Services
PKCS #11 Browsersand Mail Clients
Microsoft Browsersand Mail Clients
IPSec andOther Applications
PKCS #11 PKCS #11 or CSPCSP
LogoffService
Downloadable Desktop
• Credential mobility
• Multiple user credentials
• Certificate auto-enrollment– Keon Certificate Server Support
• Optional SecurID authentication
• Standards-based repository
Downloadable Desktop
• Unobtrusive software– Small footprint– No device drivers– Installed by a normal user– No reboot
• Reduced sign-on/web SSO
• Interoperability with client PKI applications– Microsoft Internet Explorer, Outlook Express, Outlook 2000– Netscape Navigator, Messenger– Other “CSP” Applications
• Compatibility with authorization products
• Public APIs and CLIs for integration and customization
Authentication Options
• Physical Smart Card
• Virtual Smart Card– PKCS #5 Password Enhancement
– SecurID
The Most Trusted Name in e-Security
WWW.RSASECURITY.COM