Project Status Report for the

1Introduction

1.1Summary

The expanded project began in January 2002. Our original Mellon Foundation proposal began “Dartmouth College proposes to develop and deploy an end-to-end public key infrastructure (PKI) for its academic user base, that overcomes the obstacles that to date have prevented PKI from taking root, and that is easily reproducible by other universities. We want to make PKI finally ‘happen,’ and to transform academic computing.” A little more than a year later, we are well toward accomplishing our goal. This grant has allowed us to become involved in projects and activities that go beyond and could not have been specifically anticipated by the original proposal. Accordingly, what we describe in the “Phase Two” section of this report is part of a larger vision for PKI activities at Dartmouth College and for all of Higher Education.

The PKI Lab unites faculty and students (graduate and undergraduate) from Dartmouth’s Computer Science Department together with staff from the central IT organization (Peter Kiewit Computing Services). The PKI Lab also collaborates with faculty from Dartmouth’s Thayer School of Engineering and the Institute for Security and Technology Studies located at Dartmouth College. The grant from the Mellon Foundation has enabled the PKI Lab to gain national prominence among other projects and workers in this field.

The Dartmouth Mellon PKI project is addressing the issues that have slowed the adoption and use of PKI technology and applications in academic environments. The original project proposal described needs in Higher Education that PKI technology could solve. It described known problems with this technology and laid out research efforts to address them. It proposed sociological studies of actual user perceptions and behavior to investigate user behaviors. The project rapidly established integrated research and deployment teams with strong skills, and we have made excellent progress.

The deployment team built and operates a production quality PKI at Dartmouth College. As part of the developing production infrastructure, the deployment team has worked as well to develop compelling PKI enabled applications, in the process developing documentation, conducting pilot tests with end users and working with campus computer support personnel to provide a production quality infrastructure that serves as a beginning and growing base for PKI deployment at Dartmouth and at other institutions.

The research team continues to investigate a variety of PKI issues and to test fundamental assumptions. In addition, the research team’s analysis of the products and applications in use or developed by the deployment team discovered and documented unanticipated security issues. Both of these areas of research have generated a number of refereed papers and have yielded several software components and applications that provide possible solutions.

1.2Vision

The need for improved cyber security is apparent. The number and efficiency of computer viruses increase at a ferocious pace, and the havoc they can wreak now includes broadcasting archived email and providing illicit remote control of the infected computer. Hacker attacks on the Internet are rampant, and are now even part of protests and international hostilities. These attacks cost billions of dollars in damage, and lost productivity and lost revenues. Email spam is so prevalent that it is inspiring legislation in attempts to curb it. Identity theft is the fastest growing white collar crime in the United States. Horror stories abound. As our society becomes more and more reliant on electronic communications and networked services, the ramifications of these security exposures become more severe for the “masses”. It is clearly time for greater security in our computing infrastructure.

PKI offers by far the most comprehensive and widely available infrastructure to address these problems. Through its foundations in asymmetric cryptography, PKI is uniquely suited to problem domains (such as higher education) where many different organizations, with distinct administrative boundaries, must interact and share information services. It is a fundamental improvement to the computing infrastructure in a systematic way to address crucial issues of:

• 
  Authentication
  
• 
  Digital signing
  
• 
  Data encryption
  

Point solutions exist for each category, but PKI is the only standards-based solution that coherently addresses them all well with broad support from vendors and other solutions providers. Robust services, commercial tools, and freely available tools provide a sound foundation for the infrastructure. Applications such as browsers, email readers, web servers, web services, email list servers, database servers, PDF readers, VPN appliances, WPA wireless authentication, USB keys, smart cards, and many others all have integrated PKI support. Because PKI is standards-based, these all (at least in principle) interoperate with each other. PKI attribute certificates show strong promise for implementing critical authorization services. PKI enables end-to-end security (in particular, securing both clients and servers and not just the pipe between them). Inherently secure servers are a necessary ingredient to allow e-business to evolve to the next level. An industry-wide foundation is in place for widespread deployment of PKI with significant applications already available, and the stage is set for more applications to follow so that PKI can become an all-encompassing solution for HEIs’ needs for improved security. PKI is well-tested in the research and development labs and now in trial and early deployments.

PKI has to date proven relatively difficult to deploy. This is due to its ambitious and general purpose definition, the breadth of its scope, the complexity of its technology, and difficulties with standards-based approach interoperability. Improvements in PKI tools and applications combined with increasingly urgent need for greater security are simultaneously lowering the barrier to entry and raising the motivation for organizations to enter the realm of deployed PKI.

Dartmouth sees the outstanding potential of PKI once it gathers critical mass on the deployment side. We plan massive deployment of PKI internally and seek to help others deploy it extensively at their own institutions.

This work will likely be as much organizational as technical.

Dartmouth’s vision for PKI adoption takes an incremental and evolutionary approach:

• 
  Develop PKI infrastructure (we have accomplished the first round of this).
  
• 
  Start small with simple and well-contained PKI applications (we need to prime the pump). Make incremental additions and improvements to these applications over time.
  
• 
  First add new capabilities for users (for example, the ability to authenticate to services from off-campus or the ability to digitally sign documents).
  
• 
  Save replacing with PKI “the old way” on existing applications until later stages.
  
• 
  In the long run, PKI provides a comprehensive solution for all campus mainstream authentication, signing, and encryption needs.
  
• 
  Assist other early adopters:
  
  • 
    Provide both general PKI education and specific “how to” documentation.
    
  • 
    Be opportunistic.
    
  • 
    Help with applications that matter to them.
    

Dartmouth College intends to become a recognized leader in securely using computing technology in support of education, research, and administration, and PKI is an important component of our strategy. This goal starts with foundations in computer network security, secure systems, and applied cryptography. Areas of specialization include:

• 
  developing enhanced security features for software products and computer systems,
  
• 
  testing and vulnerability analysis of security features in software products,
  
• 
  implementation practices for production environments supporting production applications,
  
• 
  architectures and applications for secure coprocessors, and
  
• 
  infrastructure for trustable systems.
  

An overarching goal is the continued development of a laboratory to support and further develop these activities at Dartmouth and at other institutions. This direction integrates a number of activities including the Internet2-sponsored PKI Lab, this Dartmouth-Mellon PKI project, I2 Middleware efforts in general, research work supported by NSF and the US Department of Justice, as well as key participation in the EDUCAUSE-sponsored HEBCA BID. In addition, Dartmouth actively participates in OKI and is among the CSG schools investigating the Chandler project. Dartmouth is working to further expand the activities of and develop additional and self-sustaining resources for this laboratory, which will help integrate existing and originate future projects in this area.

Download 152.32 Kb.

Share with your friends: