Johnson & Johnson’s Public Key Infrastructure Bob Stahl

Nov Johnson & Johnson The world’s largest and most comprehensive manufacturer of health care products Founded in 1886 Headquartered in New Brunswick, New Jersey Sales of $42 billion in operating companies in 50+ countries 109,000+ employees worldwide Customers in over 175 countries

Nov Baseline PKI Architecture JJEDS Enterprise Directory JJEDS Offline Root CA (ORCA) JJEDS Principal Online CA (POLCA) JJEDS CRL Distribution Website PKI and Directory Enabled Applications Authoritative Feeds - Employees, Partners, Servers, addresses, Windows IDs

Nov JJEDS PKI Principles Based on open standards Directory-driven  Directory is the global identity master Web-based, self service model Strong identity proofing Build and operate it ourselves Separate signing and encryption keys Hardware tokens preferred Support operation in FDA-validated environments

Nov Standards Based LDAP Directory X.509v3 Certificates and CRLs  RFC 2459, Internet X.509 Public Key Infrastructure Certificate and CRL Profile RFC 2527 Certificate Policy and Certificate Practice Statement  Rewrite underway based on RFC 3647

Nov Self-Service Registration 1. New employee, Alice, is entered into HR Database 2. Overnight, Alice has an entry in the Enterprise Directory 3. When Alice is ready to get her Digital Identity, she visits the JJEDS web site IVC 4. One-time codes are generated and ed to Alice and her supervisor Enterprise Directory CAC 4. Alice’s supervisor delivers her IVC to her person-to-person 5. Alice returns to JJEDS and authenticates with her IVC and CAC 6. Alice’s certificates are generated on her client, and provide only her ID, not her access privileges 8. Alice’s signature key is never duplicated -- her decryption key is escrowed for contingencies If Alice ever need to recover an old encryption key, she can do it herself 9. When Alice’s cert is about to expire or if her Name or changed, then she can revoke her old certificate and get a new one by herself. 7. Alice’s certificates are published to the Enterprise Directory and from there to the directory

Nov Security Vision Legal & Regulatory Compliance Directory- Centric Corporation (Global Identity Master) Eliminate Passwords Secure Electronic Transactions JJEDS Digital Identities Authoritative Sources Unique identities for people (and machines)

Nov Applications Directory took off on its own – 150,000+ active entries  WWID-based login  Workflow routing  Phonebook replacement  Online organization charts  Compliance tracking / training  lookups for applications

Nov PKI Applications Remote Access – 60,000+ users Secure  Research collaboration  Legal department  Marketing  Personnel discussions Adverse event reporting Skincare marketing intelligence web site SOX compliance reporting Ethics certification Coming Soon – Enterprise Apps  e.g., SAP, Oracle, Windows Login

Nov Next Leap - SAFE SAFE – Secure Access for Everyone What is it?  Biopharma industry consortium aimed at facilitating e-transactions through SAFE-wide digital credentials  Participants include J&J, Pfizer, Merck, GSK, Aventis, Lilly, PG, Novartis, others  Technology selected for use: PKI PKI perspective:  Additional emphasis on Digital Signatures

Nov SAFE Value Potential