Trusted Identities That Drive Global Commerce IdenTrust: NCMS Presentation JPAS Logon changes requiring PKI credentials Richard Jensen, October 19 th 2011

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 2 Agenda  Summary of PKI requirement  What is PKI  What are these things called Digital Certificates  Who’s behind this  Types of Certificates  What’s the difference  Getting a Certificate  Where do you begin  What’s required  Documentation and forms  Trusted Correspondent Program  Questions

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 3 So what is PKI?  In broad terms, Public Key Infrastructure (PKI) refers to the methods, technologies and techniques that together provide a secure infrastructure that enables users of a basically unsecured public network (the Internet) to securely and privately exchange information  A systemic approach where every participant agrees to abide by a specific set of rules (the Policy) regarding Identity Management  Application owners want to ensure that the people trying to access their sites really are who they say they are  End Users have someone verify their identity so they can be issued a Digital Certificate to use in online transactions or to access protected sites  Certificate Authorities (like IdenTrust) issue Digital Certificates to individuals once they are certain of a person’s identity, based on a set of rules (the Policy) Policy CA Digital Certificates Policy CA Digital Certificates Applications

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 4 Who is in charge of this program?  The DoD established the External Certificate Authority (ECA) program to accommodate the issuance of DoD approved PKI certificates to individuals that do not have or qualify for a Common Access Card (CAC). DoD is the ‘owner’ of the ECA Policy  DISA Manages the ECA Program. ECA is just the name of the Certificate Policy under which the credentials are issued. DISA certifies Certificate Authorities (like IdenTrust) after the CA goes through a rigorous set of testing to meet ECA Policy requirements: Security, System Architecture, Fulfillment, Processes, Revocation, etc.  DMDC decided to accept ECA certificates for use in the JPAS system. JPAS is simply an application that relies on the integrity of ECA certificates

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 5 PKI’s ‘product’ is a Digital Certificate  a PKI Digital Certificate is a Digital Identity issued to an individual so they can:  Authenticate your identity to an online system. For JPAS this augments the username and password currently in use  Digitally sign documents. You can use your Digital Certificate to replace your wet ink signature; and  Encrypt documents and transactions. Digital Certificates allow you to send encrypted so that only the intended recipient can view your message and attachments

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 6 What type of certificate does JPAS require?  Both certificate types are hardware based certificates and must be stored on a FIPS level 2 or higher Key Storage Mechanism (KSM) per DoD policy  KSM’s available are either Smart Cards (similar to CAC Cards) or USB devices  JPAS strongly recommends the KSM be in a Smart Card format. DoD facilities may not let you bring a USB token on site 1. ECA Medium Hardware Assurance; or 2. ECA Medium Token Assurance

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 7 What’s the difference?  Both ECA certificate types are hardware based certificates  One key difference is who performs the Identity Vetting  The hardware devices are exactly the same  However, there is a ‘mapping’ difference  ECA Medium Hardware is a higher assurance certificate than Medium Token  Some DoD applications require Medium Hardware In either case, you must meet face to face with the person performing the identity vetting Certificate TypeIdentity VettingMapping ECA Medium Hardware Assurance  IdenTrust Registration Agent  Trusted Agent  Medium High level of Federal Bridge ECA Medium Token Assurance  IdenTrust Registration Agent  Trusted Agent  Notary Public  Authorized DoD Employee  Medium level of Federal Bridge

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 8 How do you get an ECA certificate?

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 9 Choose one of the three (you’d better choose correctly!) 

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 10 IdenTrust has a customized approach for JPAS

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 11 All you have to do is click on the “buy” button

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 12 Go through the on-line application process

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 13 What is required? There are identity documents to show to the Trusted Agent or Notary

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 14 Then you both get to sign (this example is Medium Hardware) Once for the applicant… And once for the Trusted Correspondent…

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 15 Then you both get to sign (this example is Medium Token) Once for the applicant… And once for the Notary…

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 16 There is also a Subscribing Organization Agreement  Requires the signature of someone within the company who can agree to the conditions of the ECA contract for the applicant  Company is acknowledging that the associate is getting a certificate as a representative of the company and that they agree to allow the associate to use the certificate on their behalf

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 17 Both forms are sent to the Registration department  The Registration team conducts an investigation into the probability of the identity  They assign a “confidence score” based on a comprehensive criteria  Once they decide, they send an to the applicant informing of the decision  If favorable, they send certificate retrieval instructions  If un-favorable, they send information regarding rejection   ?

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 18 If successful, you’ll receive…  An from the Registration department telling you you’ve been approved  A package with a letter on retrieval instructions and your hardware  Guidance on protecting your device  A CD with Drivers and middle-ware for your computer to understand your certificate  Instructions on how to:  Load the drivers  Prepare the KSM  Load the private keys  Certificate test  Once your certificate test is complete  Go to JPAS and register your certificate

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 19 Who, What, Where, When, How: Trusted Correspondent Who: Typically in HR or Security What: Internal associate who perform identity vetting on company’s own employees Where: In person appointments When: Whenever an employee needs a certificate How: Company ‘officer’ signs a separate agreement accepting terms/conditions for the actions of their employee to act as a Trusted Correspondent.  Your company becomes liable for the truthfulness of the identity  Agrees to rules regarding documentation and identity checking  Must follow the “letter of the law” just like we do  No short cuts, just because they’re your employees

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 20 Benefits of having your own Trusted Correspondent No need to wait for an appointment with the CA Allows ‘bulk loading’ for multiple users  Eliminates the need for individual users to go through the entire application process  Minimum of five per submission  All supporting documents must be included together Streamlines processing  CA does not have to do some of the usual steps (VoE) Reduces costs Enhanced control  Upon termination of an employee, a TC can immediately revoke certificate  New employees can be added quicker  May be able to resolve basic certificate issuance quicker than relying on CA The only cost is for the certificate of the TC candidate  The TC is required to have their own Medium Hardware certificate so they can send encrypted s back and forth to the CA

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 21 TC Addendum to Subscribing Organization Agreement Company officer signs this agreement:

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 22 And begin ‘bulk loading’ your associates TC sends completed spreadsheet via signed and encrypted to Registration Department

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 23 Questions? Richard Jensen Director of Government Sales ECA Program Manager Associate Member NCMS ? Contact Info:

Copyright ©2011 IdenTrust, Inc. | All Rights Reserved 24 NCMS Members qualify for a 20% Discount