1. Internet 2 Weaving a Trust Fabric Shibboleth & PKI Spring 2003 Barry R Ribbeck Barry.R.Ribbeck@uth.tmc.edu University of Texas Health Science Center at Houston

2. UT Topology 16 physical institutions of higher learning 1 virtual institution All element operated independently In most cases, the institutions are geographically dispersed throughout Texas All institutions issue identity certificates as intermediate CA under the Verisign Public Root

3. Current PKI Uses System Wide SMIME signature Houston specific uses –SMIME signing and encryption –Strong A&I for 3 tier web applications Student Grades, Resident evaluations, LDAP Group management, CPHS, and many many others…… –VPN –Wireless Access (soon)

4. Commitments to PKI UT System wide publicly rooted PKI in its 5 th year Additional opportunities for use / expansion –Hippa –Events that exposed security weakness in a public venue

5. Collaboration Opportunities in Texas The University of Texas –Inter/Intra Institutional Within the Texas Medical Center-Houston –Inter-Institutional Outside the Texas Medical Center –Intra-Institutional

6. UT Collaborations Inter/Intra-Institutional UT Information Security (UT InfoSec) –Driving PKI requirements IT Security Hippa (TAC 202 Lite) Texas Administrative Code 202 Satellite Campuses –UT Houston School of Public Health –UT Houston School of Nursing

7. TMC Collaborations Graduate Medical Evaluations Student Exchange programs –UT, Rice, U of H, A&M, Baylor, Houston CC Adjunct Faculty from other institutions –MDACC, TCH, THI, TIRR, Methodist, St. Luke’s, Shriner’s, U of H, Private MDs

8. Today UT, Tomorrow ? 3 Tier Web based courses and applications –Cardio Physiology –Neurobiology and Anatomy –Blackboard –GMEDS –CPHS (possibly strong A&I) Helping Research and Security coexist Shared Library Resources

9. SHIB & PKI PKI as needed for authentication –Target presents requirements for strong authN –Users present UT/Verisign rooted certs to the Shib HS –HS validates cert, queries LDAP for existence of user in the directory and creates opaque handle etc…. –AA releases user’s credentials to target as required Shibboleth for authorization in the usual way Standardizing Identity Verification within UT via the same CP/CPS Boilerplates for bilateral agreements for Shibboleth Clubs / or UT Federation in terms of Target applications