Subject: Trading Partner Web Certificates

From: "Doug M Williscroft" <[email-masked]>
Date: Fri, 23 Jun 2000 11:30:21 -0700

This note is to elicit feedback on a PKI model that my organization has
implemented for web delivery/collection of information. We call it the
"trading partner certificate" model.

The trading partner certificate model does not attempt to provide the
full benefits of the grand PKI vision but limits itself to browser-based
extranets. The solution we have adopted is rather simple but - due to
limitations of existing technology - not especially elegant. Even so, we
believe it to provide significant authentication benefit at at
significantly lower cost than other alternatives. 

At the end of this note I describe a desirable new function for
certificate management (at the browser and/or OS) that would provide
broad benefit for extranet applications under this model.  I believe
this additional functionality would be relatively easy to develop, and
would quite possibly find a large market. 

Our model:
1) Establish a trading agreement with an organization through standard
business processes which include contractual definition of obligaitions.

2) Issue a trading partner certificate to the organization. (In our
current case the certificates are "anonymous"; they make no statement
about the trading partner. This is not a necessary component of the
model. Neither is it necessary that we be the certificate issuer.)

3) The trading partner installs the certificate and private key on all
browsers that will be used to access our services. (Most of our trading
partners use the IE5 browser which allows the private key to be flagged
as "not exportable" from the computer - a highly desirable feature in
our from our perspective.)

4) The trading partner registers its users in our extranet directory -
and assumes responsibility for managing those users - including
assignment of access permissions within the bounds of the trading
partner agreement. (At this point user administration requires some
intervention on our part - we anticipate fully externalized user
management in the future.)

5) Users connecting to our web servers are challenged (via SSL) to
provide a client certificate. 

6) Users presenting a valid trading partner certificate are challenged
for UserID and Password.

7) Users presenting a valid password and the correct trading partner
certificate for that user's organization are granted access to the
appropriate services.

To impersonate a user an attacker must gain direct access to a computer
in the trading partner organization, and gain knowledge of a valid
userID and password pair. We see this 2-factor mechanism as offering
protection against password discovery (by attackers external to the
trading partner organization), and against man-in-the-middle attacks
based on URL hijacking or DNS poisoning.

Desirable new certificate management functionality: 
It would be helpful to our trading partners if certificates/private keys
could be centrally distributed en-masse to all computers/user profiles
in a trading partner organization. Currently, our trading partners must
manually install the private key to each user login account that will
use our services - a tedious activity. This task must be repeated prior
to certificate expiry. Fortunately our trading partners are willing to
accept this administrative burden because they consider the services we
offer sufficiently valuable. 

Comments?

-- 
Doug Williscroft
HealthNet/BC Architecture and Standards Branch
Ministry of Health Information Management Group

Telephone: (250) 952-2497
_______________________________________________