# A Public Infrastructure for a Trusted Wireless World
## 2 Background
### Pki  
Public key infrastructure (PKI) has been around for decades as a means to identify and authenticate individuals and machines. Traditionally, the identification of an individual has been done through the use of a smart card and a personal identification number (PIN). The PIN is entered in addition to a smart card to prove that a person is who they claim to be. A smart card is about the size of a credit card and requires the use of a smart card reader, which makes the use of the smart card on mobile devices cumbersome. Industry, especially the United States Department of Defense (DoD), wants a lighter, more mobile-friendly solution. Since PKI provides everything necessary to securely communicate with an established and trusted digital identity in a static environment, it simply needs updating to accommodate the dynamic mobility of today. PKI provides the groundwork for creating and handling digital identities at the scale IoT requires.  
The root certificate is the foundation of trust for PKI, which is why it is also called the root of trust. In order for a certificate to be trusted it must originate from a trusted source. A certificate is signed by a root certificate issued by a program run under strict guidelines. Many well-known root certificates are distributed in operating systems such as Microsoft and Apple. A root certificate is invaluable because any certificate signed with its private key is automatically trusted [12].  
A credential service provider (CSP) establishes and maintains the enrollment records and binding authenticators of a digital identity within a PKI. They were formed in order to meet the challenge of linking a digital identity to a single precise person or thing. A CSP can meet one of three identity assurance levels (IALs) [13]:  
**IAL1:** Invalid or unverified digital identity. There does not have to be a link to a real person or thing.  
**IAL2:** There is some proof that the digital identity is real. The proof can be remote or physically present identity proofing.  
**IAL3:** The digital identity is verified and validated by an authorized and trained CSP representative by the physical presence of the real person or thing [13].  
A certification authority (CA) is an entity that certifies an identity with a public key. Basically, the CA is the method of generating the digital identity through providing a certificate. Certification is a binding that occurs in the form of a signed data structure called a public key certificate. A CA is an authority on the process of certification. The issuing CA digitally signs certificates, ensuring integrity; therefore, a CA must be trusted by both the issuer of the certificate and the owner of the certificate [14]. A CSP must provide security management services for key generation and storage.  
A validation authority (VA) is the authentication system within PKI. It verifies the validity of a digital certificate by following the requirements of the X.509 standard. A VA manages the certificate revocation list (CRL) issued by the CAs and provides online certificate status protocol (OSCP) functions. Some VAs may also provide access control and authorization services [14].