This causes difficulty when users log in to many different systems, because the private key is stored on one system. There are several current initiatives to alleviate this problem. When a user logs in to DCE, the private key server sends his private key to him in encrypted form. In this way, he can access his private key regardless of his physical location. When a user requires validation, she inserts her smart card into a card reader.
Several techniques provide for enhanced physical security.
Most importantly, the server running the CA must be stored in a locked room. Only CA administrators must have access to the room. Using tamper-evident holographic seals will help deter and discover breaches of physical security. Configure your CA server behind an Internet firewall. Use the CA server only for CA functions.