1. Gregorio Martínez Pérez gremar@dif.um.es University of Murcia PROVIDING SECURITY TO UNIVERSITY ENVIRONMENT COMMUNICATIONS

2. University of Murcia * Distributed applications on TCP/IP: impressive growth ë Services improvement ë Decreasing costs * Very important security problems when applications deal with confidential information MOTIVATION (I)

3. University of Murcia * University of Murcia: infrastructure to provide secure communications ë Must warrant: Confidentiality Authentication Integrity ë Complex task: Broad community of users Heterogeneous systems MOTIVATION (II)

4. University of Murcia * Certification Authority (CA) ë Trust foundation of the overall system ë We are using Netscape Certificate Server Problem: certification request is a public operation Solution: intermediate elements –RQServer (Requests Server) –RQClient (Certification Requests Client) PUBLIC KEY INFRASTRUCTURE (I)

5. University of Murcia * Registration Authority (RA) ë Constituted by Administrative staff Software applications ë Performs the following tasks To verify people identities To generate the user private and public keys To store the private key in the smart card To create the certification requests To create the revocation requests PUBLIC KEY INFRASTRUCTURE (II)

6. University of Murcia * Directory Server ë Main use: To get the information needed to make certification requests To store the final certificates ë To get data stored in this server: LDAP protocol PUBLIC KEY INFRASTRUCTURE (III)

7. University of Murcia * Smart Cards ë Security device to store private keys ë Two kinds of smart cards: 4 Kbytes smart cards PUBLIC KEY INFRASTRUCTURE (IV) 1 KByte Security Field RSA Private Key

8. University of Murcia * Smart Cards ëTwo kinds of smart cards: 2 Kbytes smart cards PUBLIC KEY INFRASTRUCTURE (V) 16 Bytes Security Field Ciphered Private Keys DB IDEA Key CIPHER Ciphered Private Key RSA Private Key

9. University of Murcia * Certificate Request * Certificate Recovery * Certificate Revocation MAIN OPERATIONS

10. University of Murcia CERTIFICATE REQUEST Registration Authority RSA PRIVATE OR IDEA KEY LDAP Certification Authority SSL RQServer Client Authent. SSL Ciphered Private Keys DB SSL Client Authent. ID Number Directory Server USER PERSONAL DATA RQClient Client Authent. SSL CRON

11. University of Murcia CERTIFICATE RECOVERY PKCS#11 Module Netscape Communicator SSL Secure Server PIN RSA PRIVATE OR IDEA KEY Ciphered Private Keys DB SSL Directory Server

12. University of Murcia CERTIFICATE REVOCATION Registration Authority RQServer Client Authent. SSL LDAP Directory Server Certification Authority SSL Client Authent. RVKClient Client Authent. SSL CRON Ciphered Private Keys DB SSL Client Authent.

13. University of Murcia * Complete security infrastructure ë Certification Authority ë Registration Authorities ë Smart cards ë Custom PKCS#11 Module ë Main security protocols: SSL and S/MIME * Framework to develop custom security applications CONCLUSIONS

14. University of Murcia * Custom CA developed in Java * Solutions for other applications: Microsoft products (PC/SC) * New smart cards approaches: OCF, JavaCards, VOP * Parallel infrastructure that manages credentials: SPKI FUTURE WORK

15. Gregorio Martínez Pérez gremar@dif.um.es University of Murcia PROVIDING SECURITY TO UNIVERSITY ENVIRONMENT COMMUNICATIONS