# Presentation: 527650

## PKI in Today’s

**Mary Dixon**
**Director, Access Card Office**

**PKI in Today’s**
**Government**

**29 November 2001**

**Notes:**
Good morning, I am here to talk about the DoD Common Access Card. 

Topics  
Original Tasking
PKI Infrastructure
Background DEERS & RAPIDS
Smart Card Solution
Organizational Usage
With integrated Lessons Learned

## Background 

- Pilots / Studies since 1993
- Long list of benefits
- No “real savings” to pay for program
- Data-centric smart card
-  Synchronization issues

## Background 

-  Needed hardware-based token
-  Securing our networks
-  Non-repudiation for e-business
- Legally accepted
- Paperless contracting
- Added Benefit:  PKI facilitates moving from a data-centric to web-centric model

**Background**** **

**(cont.)**

## The Decision

**The Decision**

- I.D. card for:
- Active military
- Selected Reserves
- DoD civilians
- “Inside the wall” contractors
- Physical and logical access
- Authentication keys
- Military ID card infrastructure

**Common Access Card**

-                     *November 10, 1999*
*MEMO FROM:*
*  **Dr. John Hamre*
*  **(Deputy Secretary of Defense)*
***Create a Common Access Card***

**Notes:**
Authentication Keys :  Public Key Infrastructure was the killer application which justified the cost of the smart cards.   35 million dollars just to buy the cards.

Class 3 = Unclassified But Sensitive data.

DMDC was given one year to bring up a production system, and then two years to issue approximately 4.3 million cards.

## Issuance Process 

**(Business Process Re-engineering)**** **

***RAPIDS***

***LRA***

**ID Cards**
**Avg. 10 Minutes**

**PKI Registration**
**Avg. 15-20 Minutes**

**Download Certificates**
**Avg. 15-20 Minutes**

**One Stop CAC Issuance**
**10-15 Minutes and**
** *****Going Down!***

***Kiosk or Client PC***

- Integrated

***CAC-Enabled***
***RAPIDS***

## Why A Smart Card?

-  Facilitate E-commerce (non-repudiation)
-  Use PKI and the Internet to
-  Reduce paperwork
-  Decrease transaction / business process
-    time
-  Access legacy databases  (with strong 			authentication and security)
-  Improve / re-engineer business processes
-  Improve security of physical access
-  Improve security of unclassified networks

**Why A Smart Card?**

## Development Strategy

-  Incremental - do what can be done today;   	      defer other issues
-  Backward Compatible - do not obsolete 	tomorrow what we did today
-  Keep up with emerging standards
-  Migration with technology
-  Adherence to best commercial practices

**Development Strategy**

## Card Architecture Goals

**Card Architecture Goals**

**Requirements**
- Java 2.1
- Global platform
- Interoperability      Specification (BSI)
- 32K EEPROM
- FIPS 140-1 Level 2  Certification

**Goals**
- Security
- Multi-application
- Multiple vendors
- Interoperability
- Post issuance
- Best commercial practices
- COTS
- Cost effective

**RESULTED**
**IN**

## Strengthens Authentication of Identity

- Checks Credentials vs. DEERS (Not Source Database)
- Biometric
- Data from Component Personnel Systems
- Identity management - key ingredient in PKI

## Strengthens Security of Issuance Process 

- Card to be issued & checked vs. Card Management System
- DoD Card
- Provided to that RAPIDS site
- VOs need:
- CAC present
- Registered w/ access at site logging in
- Biometric verified vs. DEERS
- No Access granted by VOs (split function)
- Rules-based system

## System Audits

**Security**
- Servers govern access list for RAPIDS log on
-    and privilege level for each user
**Fraud Prevention**
- Servers audit data for potential fraud analysis (date of
- 	birth changes, lost or stolen ID cards, and invalid issuance)
**Card Production **
- Servers audit number and type of card produced ;
- 	sorted by site, service, personnel status, card type, and
- 	user
- Server card production data is rolled up to the main frame
- 	level for summaries at site, Service, and system wide
-    levels

## Initial Uses of Card

- _Core PKI Functions_
- Authentication
- Encryption
- Signing

- _PK-Enabled Applications_
- Defense Travel System
- Wide Area Workflow
- Electronic Document Access

**Initial Uses of Card**

## What Else Have We Accomplished? 

-  PKI Requirements
-  Certificate Practice Statement
-  Certificate Acceptance Form
-  CAC Policy Memo / Working on Directive
-  OT&E / Interoperability Testing
-  Middleware Specifications
-  Two Developers Conferences / Developers Guide
-  Card Management System

**What Else Have We Accomplished?**

## Where Are We Today?

- 246  Workstations in 113 Locations
-  107,719 Cards Issued as of 19 Nov
- (issuing about  1,400 cards per day)

## Where Are We Today?

**Where Are We Today?**

**(cont.)**

***Average Issuance Time < 15 minutes***

## Where Are We Today?

-  Military Services deploying readers / middleware and mass issuing of cards
-  FIPS 140-1 Level 2 certified card
-  First uses of chip on card
-  core PKI functions
-  warfighter support
-  e-business applications

**Where Are We Today?**

**(cont.)**

## Issuance Infrastructure

**NIPRNET**

**DEERS**

**Issuance Portal**
**https Server**

**Installation**
**Communications**

**RAPIDS **
**Issuance **
**Station**

**NIPRNET**

**CA**

**Directories**

**NIPRNET**

*= What We Can Control*

*= What We Can’t Control*

***Legend***

## Distributed Issuing

**DEERS**

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Netscape Cert Server
- DISA

## Verification Officer Authentication to DEERS

**DEERS**

- Netscape Cert Server
- DISA

- HSM

- HSM

- HSM

- HSM

- RAPIDS Station

- Issuance Portal
- https Server

## SSL v3 Session to DEERS

**DEERS**

- Netscape Cert Server
- DISA

- HSM

- HSM

- HSM

- HSM

- RAPIDS Station

- Issuance Portal
- https Server

- SSL v3

## SSL v2 Session with Issuance Portal

**DEERS**

- Netscape Cert Server
- DISA

- HSM

- HSM

- HSM

- HSM

- RAPIDS Station

- Issuance Portal
- https Server

- SSL v3

- SSL v2

## VO Authenticates to CA

**DEERS**

- Netscape Cert Server
- DISA

- HSM

- HSM

- HSM

- HSM

- RAPIDS Station

- Issuance Portal
- https Server

- SSL v3

- SSL v2

- SSL v3

## OP Secure Channel to New Card

**DEERS**

- Netscape Cert Server
- DISA

- HSM

- HSM

- HSM

- HSM

- RAPIDS Station

- Issuance Portal
- https Server

- SSL v3

- SSL v2

- SSL v3

**OP Secure Channel**

## Card Application Managers (CAMs)

**DEERS**

- Netscape Cert Server
- DISA

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

**ID**

**Generic**
**Container**

**PKI**

- SSL v3

- SSL v2

- SSL v3

**OP Secure Channel**

## Create Card Applets - ID

**DEERS**

- Netscape Cert Server
- DISA

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Card Application Managers (CAMs)

**ID**

**PKI**

- SSL v3

- SSL v2

- SSL v3

**Generic**
**Container**

## Create Card Applets – Generic Containers

**Create Card Applets – Generic Containers**

**DEERS**

- Netscape Cert Server
- DISA

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Card Application Managers (CAMs)

**ID**

**PKI**

- SSL v3

- SSL v2

- SSL v3

**Generic**
**Container**

## Create Card Applets - PKI

**DEERS**

- Netscape Cert Server
- DISA

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Card Application Managers (CAMs)

**ID**

**PKI**

- SSL v3

- SSL v2

- SSL v3

**Generic**
**Container**

## Instantiate ID Applet

**DEERS**

- Netscape Cert Server
- DISA

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Card Application Managers (CAMs)

**ID**

**PKI**

- SSL v3

- SSL v2

- SSL v3

**Generic**
**Container**

## Instantiate Generic Container Applet

**DEERS**

- Netscape Cert Server
- DISA

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Card Application Managers (CAMs)

**ID**

**PKI**

- SSL v3

- SSL v2

- SSL v3

**Generic**
**Container**

## Instantiate PKI Applet

**DEERS**

- Netscape Cert Server
- DISA

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Card Application Managers (CAMs)

**ID**

**PKI**

- SSL v3

- SSL v2

- SSL v3

**Generic**
**Container**

## Profile, Parameters, PIN Data

**DEERS**

- Netscape Cert Server
- DISA

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Card Application Managers (CAMs)

**ID**

**PKI**

- SSL v3

- SSL v3

**Generic**
**Container**

## Generic Container Data

**DEERS**

- Netscape Cert Server
- DISA

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Card Application Managers (CAMs)

**ID**

**PKI**

- SSL v3

- SSL v3

**Generic**
**Container**

## Encryption Key

**DEERS**

- Netscape Cert Server
- DISA

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Card Application Managers (CAMs)

**ID**

**PKI**

- SSL v3

- SSL v2

- SSL v3

**Generic**
**Container**

## First Signature Key

**DEERS**

- Netscape Cert Server
- DISA

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Card Application Managers (CAMs)

**ID**

**PKI**

- SSL v3

- SSL v2

**Generic**
**Container**

- SSL v3

## Second Signature Key

**DEERS**

- Netscape Cert Server
- DISA

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Card Application Managers (CAMs)

**ID**

**PKI**

- SSL v3

- SSL v2

**Generic**
**Container**

- SSL v3

## Print Card

**DEERS**

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Netscape Cert Server
- DISA

## Print Card

**DEERS**

- RAPIDS Station

- Issuance Portal
- https Server

- HSM

- HSM

- HSM

- HSM

- Netscape Cert Server
- DISA

## Interoperability

-  Most interoperable solution in industry
-  Standards subject to interpretation
-  Industry participation

## In Development

-  Biometrics
-  Physical Access
-  Warfighter support
-  Card maintenance
-  Centralized issuance process

## Questions?

**Mary Dixon**
**(703) 696-7396**
**dixonmm@osd.pentagon.mil**
_**www.dmdc.osd.mil/smartcard/**_