1. Integrating security services with the automatic processing of e-mail content TERENA 2001 Antalya, 14-17 May 2001 Francesco Gennai, Marina Buzzi Istituto per le Applicazioni Telematiche, CNR - Pisa, Italy Francesco.Gennai@iat.cnr.it, Marina.Buzzi@iat.cnr.it

2. Motivation The automatic processing of message content speeds up data processing, reducing human error as well. In this context, signature verification by e-mail client could become a system bottleneck, thus justifying an automatic verification system.

3. Objective To automate the verification process of signed e-mails (electronic forms) in order to simplify the registration of Internet domains under the.IT Top Level Domain.

4. Correct recognition of MIME parts containing protected data  The RFC 1847 (S-MIME) specifies how to apply security service to MIME body parts (two new content types are added: Multipart/signed and Multipart/encrypted).  The RFC 2630 describes the Cryptographic Message Syntax used to digitally sign, digest, authenticate, or encrypt messages.  The RFC 2633 defines the application/pkcs7-signature MIME type used to transport S/MIME signed messages and outlines requirements and recommendations for handling of incoming messages by receiving agents.

5. Correct application of the verification process to the extracted MIME parts Mechanisms for certificate retrieval and validation The RFC 2632 specifies basic rules to be applied by receiving agents in order to correctly verify a signed message. Framework for managing certificates and CRLs The I-D "Internet X.509 Public Key Infrastructure Certificate and CRL Profile" outlines the format and semantics of certificates and certificate revocation lists for the Internet PKI. Procedures are described for processing of certification paths in the Internet environment.

6. Tools MIME-compliant mail server OpenSSL toolkit (libraries and application samples) was fundamental for implementation of the system http://www.openssl.org/

7. MsgVerify system overview Msg/Fax input process Message input process Message Status Cache Message/Fax Database Verification Processes CA Database FAX input process printer CRL Database CRL Manager Process MsgSmtp Process LDAP query

8. MsgVerify system overview A global identifier is assigned to each message or fax entering the system, thus maintaining the temporal sequence of the requests; this is useful in order to avoid collisions on requests for the same domain name. The message is stored in the Message/Fax Database that includes both messages and requests received via fax, stored as postscript files. At the same time temporary information on the message status is stored in the Message Status Cache (for greater efficiency).

9. MsgVerify system overview A Message Verification process is activated in order to process the new message as well as messages already present in the Cache Database (due to temporary errors). The Message Verification process interacts with the CAs and CRLs databases. Certificates of trust CAs are added to (or removed from) the CA Database by the system administrator. CRLs are automatically downloaded by the CRL Manager Process (which uploads the local CRL Database).

10. MV verification processes MV verification processes MV verification processes MV verification processes NODO 1 (MX1) NODO 2 (MX2) MV input process 1 1 4 2243 3 1432 MV MsgSmtp process 1243 MsgVerify message pathway

12. Questions Please send an e-mail to: Francesco.Gennai@iat.cnr.it Marina.Buzzi@iat.cnr.it