cryptovision Enterprise product line Use Smart Cards, the smart way

Transcription

1 cryptovision Enterprise product line Use Smart Cards, the smart way cv cryptovision GmbH T: +49 (0) F: +49 (0) info(at)cryptovision.com 1

2 Mindshare Enterprise 2

3 cryptovision Headquarters: Gelsenkirchen, Germany Subsidiary: New York City, USA Sales Offices: Silicon Valley, USA; Vienna, Austria Founded: 1999 by Markus & Andreas Hoffmeister Focus: IT Security, Cryptography, PKI Customer Base: hundreds of customers worldwide Mindshare Enterprise 3

4 Technology Chain GOVERNMENT ID ENTERPRISE IT Mindshare Enterprise 4

5 Technology Chain Documents Terminal Clients Server epasslet SCalibur sc/interface s/mail PKIntegrated CAmelot Mindshare Enterprise 5

6 epasslet Suite 6

7 Comparison: Native versus Java Card Native closed architecture expertise stays at the supplier customization only by supplier new applications only by supplier Java Card open architecture customer can build up expertise customization also by customer everybody can create new applications epasslet Suite 7

8 An applet framework should not depend on proprietary technology. This is only possible with Java Card Java epasslet Suite 8

9 Applications Border Control Secure Online Transactions Entitlement Company ID International Driver License Identification Digital Signatures epasslet Suite 9

10 Editions Custom eid ISO Filesystem ICAO MRTD European Citizen Card ISO Driving License EU Residence Permit epki/ Secure Signature Creation Device Health Insurance German eid Vehicle Registration epasslet Suite 10

11 Technical Details Elliptic Curves (up to 320 Bit) EC DSA signature generation and verification EC DH key agreement RSA/DL (up to 2048 Bit) RSA CRT key generation RSA signatures with PKCS#1 Encoding DH key agreement epasslet Suite v2.1 JCOP R3 J3E120E/J2E120E 120 kbyte EEPROM J3E082E/J2E082E 80 kbyte EEPROM epasslet/mrtd BAC SAC epasslet/mrtd EACv1 epasslet/epki SSCD epasslet/idl epasslet/eacv2 SAC Symmetric DES and Triple DES with 56, 112 and 168 bit AES with 128, 192 and 256 bit Hash SHA 1 with 160 bit SHA 224 with 224 bit SHA 256 with 256 bit Standards GlobalPlatform Java Card CC EAL4+ certification epasslet Suite v1.1 JCOP R3 J3A kbyte EEPROM J3A081/J2A kbyte EEPROM J3A041/J2A kbyte EEPROM J3A080/J2A kbyte EEPROM J2A040/J2A kbyte EEPROM ehealth epasslet/erp epasslet/ehic epasslet/evr epasslet/iso FS epasslet/geid epasslet/eucc epasslet Suite 11

12 epasslet Suite Architecture Applications User data Applet Instance Applet Instance Applet Instance Custom Applet EEPROM Modular Design Based on Common Core Libraries ROM Core Libraries epasslet Suite 12

13 Additional Information Highest certification of a Java Card mask Allows for postissuance applet activation from ROM with minimal EEPROM footprint Highest application range of all Java Card solutions on the market epasslet Suite 13

14 sc/interface 14

15 Smart Cards are the most secure and intelligent hardware solution for your Public Key Infrastructure sc/interface 15

16 What is Security Token Middleware? Interface between any token form factor and any PKI enabled software Hardware Software Middleware sc/interface 16

17 Supported applications depend on the middleware, not on the back end systems Application Middleware Card Management System Identity Management System Token/ Card sc/interface 17

18 Smart Card Applications WWW Login System Login Disk Encryption Secure E Mail Digital Signatures VPN Login SSO eid Card sc/interface 18

19 Technical Details Cards ATOS CardOS: M4.01a / V4.2 / V4.2B / V4.2C / V4.3 / V4.3B / V4.4 / V5.0 / V5.3 AustriaCard JCOP: 21 V2.2 / 21 V2.3.1 / 31 V2.2 / 31 V2.2 contactless / 31 V2.3.1 / 31 V2.3.1 contactless / 31/72 V2.3.1 / 31 / 72 V2.3.1 contactless / 41 V2.2.1 / 41 V2.2.1 contactless / 41 V2.3.1 / 41 V2.3.1 contactless / 41 V2.4 / 41 V2.4 contactless Bundesdruckerei: GoID card v1 D Trust: D Trust Card 3.0, 3.1, 3.2 epasslet Suite 1.1/1.2: on JCOP V2.4.1R3, on JCOP V2.4.1R3 with PACE Profile epasslet Suite 2.0: on JCOP V2.4.2R3, on JCOP V2.4.2R3 with PACE Profile Gemalto: TOP IM GX4 G&D Sm@rtCafé Expert: 3.1 / 3.1 contactless / 3.2 / 4.0 / 5.0 / 6.0 / 6.0 SCP 03 / 7 G&D STARCOS: 3.0 / 3.2 / 3.4 (Swiss Health Card egk) / 3.5 HID Crescendo: C700 / C700 contactless Infineon: JCLX80 jtop / JCLX80 jtop contactless NXP JCOP: V 2.1 / V2.2 / V2.2 Contactless / V2.2 / V2.3.1 / V2.4 / V2.4.1 / V2.4.2 / V2.4.2 R3 / V2.4.2 R3 SCP03 SwissSign: suisseid (CardOS M4.3B / M4.4) TCOS: Signature Card 2.0 Tokens Certgate microsd (NXP JCOP) G&D Sm@rtCafé Expert 3.2 USB token NXP JCOP: V2.2.1 IDptoken 200 SwissSign SwissID (CardOS M4.3B) Swissbit (SCT3512) Windows, OS X, Linux, edirectory IE, Firefox, Safari, Chrome Windows, NCP, OpenVPN CryptWare, Secude, WinMagic s/mail, Outlook, Notes, Secure E Mail PGP, GroupWise, Secude Novell, Secude, IBM Tivoli Access Manager Adobe Reader, suisseid Citrix, IGEL SAP R/3, SSH sc/interface 19

20 sc/interface Architecture Applications Signature Browser E Mail SSO Client Admin Tool User Tool Register Tool TokenD PKCS#11 CSP Mini Driver Secure Token Interface Operating Systems Security Token sc/interface 20

21 Benefits sc/interface supports numerous tokens and profiles sc/interface supports a wide range of applications Card 3rd party card profiles USB Dozens of Smart Cards SIM microsd Readers VPN Login Mobile Security SSL epass Secure E Mail Single Sign on Encryption System Logon Web Authentication Digital Signature sc/interface 21

22 Benefits sc/interface supports multiple platforms Card 3rd party card profiles USB Dozens of Smart Cards SIM microsd Readers VPN Login Mobile Security SSL epass Secure E Mail Single Sign on Encryption System Logon Web Authentication Digital Signature sc/interface 22

23 Additional Information Cryptography Next Generation Elliptic Curve Cryptography (ECC) Password Authenticated Connection Establishment (PACE) Remote desktop operation and terminal servers Biometry Localization support through language files sc/interface 23

24 Customers Government Finance & Insurance Healthcare Industry & Retail Universitätsklinikum Würzburg Metropolitan Transportation Authority of the State of New York sc/interface 24

25 s/mail 25

26 Client based security... provides the best possible protection for your messages s/mail 26

27 s/mail Usage Environment End-to-End Encryption client mail server mail server client s/mail s/mail other s/mime client s/mail 27

28 Technical Details MS Outlook encryption group encryption S/MIME digital signature IBM Notes message recovery key management s/mail 28

29 s/mail Architecture Client s/mail Plugin Outlook/Notes specific s/mail engine S/MIME CDSA MIME CTIL CTIL CTIL LDAP OCSP OCSP OCSP s/mail 29

30 Key Features ECC Support Watchdog Management Tool Group Mailboxes Smart Cards (PKCS#11) Flexible Group Policies PIN/Password Caching PKI Support OCSP Support Message Recovery s/mail 30

31 s/mail in the SPHINX Project s/mail 31

32 CAmelot 32

33 Digital Certificates are an important means for binding a real identity to a digital identity CAmelot 33

34 PKI is the solution for digital certificate lifecycle management Registration Revocation/ EoL Key Generation Request X.509 Certificate Lifecycle Management Certificate Generation Provisioning Use Publication CAmelot 34

35 X.509 and CV syntax: flexible X.509 Certificate Version Serial Number Signature Issuer Validity Subject Subject Public Key Info Authority Key Identifier Subject Key Identifier Key Usage Private Key Usage Period Policy Mappings Subject Alternative Name Issuer Alternative Name typical size: 2,000 byte person or component PC, server certificate holder inspection system or terminal certificate verifier smart card chip syntax: simple Card Verifiable Certificate Profile Identifier Certification Authority Certificate Holder Certificate Holder Authorization Validity Period Key typical size: 200 byte CAmelot 35

36 CAmelot Environment Enterprise environment HSM Card Management System Clients CAmelot PC Repository IDM System CAmelot 36

37 CAmelot Environment Government environment Card production system Document signer (CAmelot) Registration office National identity data base CVCA (CAmelot) CSCA (CAmelot) End user CA (CAmelot) Inspection system DVCA (CAmelot) Certificate repository CAmelot 37

38 Technical Details System Login Windows, Mac, Linux, edirectory WWW Encryption IE, Firefox, Safari VPN Windows, NCP, OpenVPN Disk Encryption CryptWare, WinMagic, McAfee Database IDM Personalisation System Connectors LDAP, SOAP, JDBC Smart Card WiFi Protection E Mail Encryption eid Document Signing Digital Signatures Windows, Xsupplicant s/mail, Outlook, Notes, PGP, GroupWise VeriSign Adobe Reader, SwissSigner Remote Access Citrix, IGEL Document Signing doc/signer Document Authentication Trust ID Terminal Authentication VISOCORE CAmelot 38

39 CAmelot Architecture CAmelot Access Module Database Management Console Protocol Handler Modules Certifier Modules CA Modules Key Manager Modules Certificate Template Modules Publisher Modules LDAP File Smart Card HSM Software CAmelot 39

40 Additional Information General Hierarchies, SubCA Multi-tenancy Logging Smart card support Security HSM, dual security Certificate based login Workflow, signed approval Monitoring Algorithms and standards X.509 and CV CMC EACv2 / TR3129 OCSP SCEP ECC and RSA Convenience Auto-Enrolment Maximum certificate profile flexibility Easy regionalization CAmelot 40

41 cryptovision PKI product evolution ECC crypto SDK 1 st Generation PKI 2 nd Generation PKI 3 nd Generation PKI library First professional ECC SDK with smart card support Foundation for all product development to date ca/manager: X.509 with RSA and ECC Offline only CA with LDAP and CRL support Based on library/pc PKIntegrated: Identity Mgmt. meets PKI Full featured solution with OCSP, HSM and Smart Cards C++ based and requires Novell IDM CAmelot: eliminates all boundaries Flexible and modular design, 100% Java based Enables trust for enterprise IT and government ID nd + Generation PKI extend CAmelot PKI client RA Workflow Engine Key server with remote Key Solutionoriented 2015 / CAmelot 41

42 CAmelot Environment Local RA HSMs Card Management System epasslet card User Employee badge Registration Authority (CAmelot) Certification Authority (CAmelot) Smart card middleware Sc/interface IDM system PKI client Directory service Remote key Keyserver Key recovery CAmelot 42

43 Enrollment (Signatur Certificate) Local RA Keygen application Public key Certificate Directory Service User Key generation Smart card Registration Authority (CAmelot) Certificate Authority PKI client Remote key Keyserver Key recovery CAmelot 43

44 Enrollment (Encryption Certificate) Local RA Directory service User Smart card Registration Authority (CAmelot) Key pair Certificate Certificate Authority PKI client Key generation Private key Remote key Keyserver Key recovery CAmelot 44

45 Use Cases Gateways Server Smart card login Mail encryption Smart card Signing User Authentication Enterprise Auth Payment Physical Access CAmelot 45

46 CAmelot as an Appliance CAmelot Appliance is scalable: Cheap PC can be used Several CA Instances may run on one server As software appliance on a virtual machine vs. High end hardware Desaster Recovery Concepts Extra hardened systems Unique robust systems CAmelot 46

47 Full-featured PKI solution Appliance V-PKI with SIG certificates eidas edict CAmelot with AUTH / ENC certificates eidas compliant PKI appliance with interface to V-PKI services CAmelot 47

48 Full-featured PKI solution Operational area of CAmelot appliance Consolidation of different PKI scenarios 1. Internal CA Log-On Auth Sign Enc Company ID Card eidas compliant PKI appliance with interface to V-PKI services 2. Interface to signature services SIC client Connection to SSA, SAP/SAD 3. Inclusion of signature certificates Run own trusted services CAmelot 48

49 End Contact cv cryptovision cv cryptovision GmbH Munscheidstr Gelsenkirchen Germany Tel: +49 (0) 2 09 / Fax: +49 (0) 2 09 / E Mail: info@cryptovision.com Public Relations Klaus Schmeh Marketing Guido Ringel Product Management Benjamin Drisch, Joachim Kessel, Guido Ringel Sales Marco Smeja, Uwe Skrzypczak, Sascha Wester Thank You! Mindshare Enterprise 49