Lightweight DCE Client in NetSEAT PKMS

Transcription

1 Lightweight DCE Client in NetSEAT PKMS

2 DCELite Project Overview DCE for Modern Network Applications

3 Motivations No Clientside Configuration Downloadable Embeddable in client Enable user mobility Multiple, simultaneous Cell contexts Eliminate preinstalled middleware Ships as part of the NetSEAT client

4 Traditional DCE Client DCE Control Program DCE Configuration Program DCE Daemon CDS Clerk DTS Clerk DCE Dynamic Link Library Security Services Directory Services Time Services RPC Services Thread Services

5 Light Weight DCE Client PCDCE Compatibility DLL DCE for NT Compatibility DLL DCELite Dynamic Link Library Configuration Services Time Services Directory Services Security Services RPC Services Thread Services

6 DCE Enhancements User Host System Application sales functions customer support functions sales cell contexts DCELite support cell contexts sales cell support cell

7 DCELite Components Desk Top Server Application Data Center DCELite Application NS Proxy CDSD SECD DTSD

8 DCELite Full DCEClient Functionality with ONE DLL source and binary compatibility with DEC&Gradient No DCEServers running on the Client no daemons, no startup processes, no installation scripts Excellent MSWindows Citizen VisualC++, symbolic debugger, native threads, native endpoint mapper Zero Client Admin user installable and dynamic configuration at runtime Small Memory Footprint (16MB less than full DCEclient) DCE Cell MultiHoming DCEClient concurrently maintains login contexts for multiple cells Easily embedded in Applications

9 DCELite Roadmap Additional Server Options (More DLLs) dcecp JAVA Integration Jade IDL compiler Native Java DCELite implementation LDAP Name Space support CDSA Integration into GSSAPI and Publickey based DCE login

10 Java Integration IDL JADE Compiler C C++ Java Bindings

11 Java Integration Cont. Browser or JVM NetSEAT DFS GSO Cryptoki DCELite DLL

12 Integrated DCE Model Java Applications Java Client Network DCEweb or WebSEAL Transaction Frontend

13 PKMS V2.0 Authentication via X.509 and SSL V2.0 Authentication via X.509 and SSL V3.0 Certificate key rings Virtual Smart Card Publickey crypto accellerator CRL via IntraVerse Authorization

14 PKMS SSL V2 Login Authentication and Authorization using SSL V2 Client application that supports SSL V2 (No clientside X.509) IntraVerse (DCE) Security Server 2. PKMS Logs in user and gets DCE credentials (PAC) 1. Client authenticates via dce_login over SSL V2 encrypted tunnel using PKMS server certificate NetSEAL/ WebSEAL with PKMS support 3. NetSEAL uses credentials (PAC) for access control Backend server application 13/10/97 IntraVerse PKMS 14

15 PKMS SSL V3 Authentication 4. NetSEAL obtains user credentials (PAC) based on authenticated identity IntraVerse (DCE ) Security Server 1. NetSEAL (during startup or after mgmt event) downloads valid CA list and CRL service configuration info CA CRL Service (accessed via CDSA) Client application that supports SSL V3 (Clientside X.509 installed) 2. Client and PKMS authenticate with X.509 over SSL V3. 3. CRL processing via CDSA NetSEAL/ WebSEAL with PKMS support 5. NetSEAL uses credentials (PAC) for access control Backend server application 13/10/97 IntraVerse PKMS 15

16 PKCS#11 Support Client DCE Login Personal Security Module cryptoki adapter PKCS#11 Interface DCEKerberos Security Server Extended Attributes PK Certificates Public Keys PKCS#11 Interface DCE Login Personal Security Module cryptoki adapter Smartcard cryptoki driver Smartcard cryptoki driver SmartCard Client's Private Key SmartCard Security Server's Private Key 13/10/97 IntraVerse PKMS 16

17 ClientSide Smartcard DCEKerberos Security Registry Extended Attributes PK Certs secret Private Keys Server Server Application (e.g. webserver, mail, directory) client principal Secure RPC Virtual Cryptoki Server Private Key Management PK cryptography caching of PK Certs Private Keys PK Certificates Secret Private Keys encrypted challenge Secure RPC challenge Virtual Cryptoki driver SessionKeys bulk encryption DCE Login Credentials Client PKCS#11 Interface challenge SSL v.3 / GSSAPI Client Application (e.g. browser) Smartcard cryptoki driver encrypted challenge PKCS#11 Interface Secure Environment SmartCard (optional) secret Private Key 13/10/97 IntraVerse PKMS 17

18 Client and Server Smartcard DCEKerberos Security Registry Server Secure RPC Virtual Cryptoki driver Server Application (e.g. webserver, mail, directory) Principal PK Certs Secret Private Keys Server Authentication Virtual Cryptoki Server Private Key Management Client SSL v.3 / GSSAPI PK cryptography caching of PK Certs & Private Keys Client Authentication Virtual Cryptoki driver Client Application (e.g. browser) Secure Environment 13/10/97 IntraVerse PKMS 18

19 IntraVerse (DCE) Security Server Certificate Key Ring 3. IntraVerse Mgmt tool loads certifate as ERA 1. CA generates user & svr certificates 5. NetSEAL uses authenticated identity to fetch certificate stored in DCE ERA CA CRL Service Client application 4. Client authenticates 7. NetSEAL uses PAC for access control and passes correct certificate to application 6. NetSEAL processes CRL via CDSA NetSEAL/ WebSEAL with PKMS support Backend server application with SSL V3 support 2. CA tools to load certificate Backend server application with SSL V3 support

20 IntraVerse (DCE) Security Server 2. Client authenticates via SSL and X.509 Crypto Accelerator 5. NetSEAL obtains PAC based on DN Client SSL V3 application Backend server application 6. NetSEAL uses PAC for access control 1. NetSEAL downloads CA list and CRL config info NetSEAL/ WebSEAL with PKMS support CRL Service 3. Send certificate to NetSEAL for decrypting 4. CRL processing via CDSA Multi NetSEA L Crypto Servers