PKI for Supporting Cross-Border

Transcription

1 PKI for Supporting Cross-Border e-commerce Kwok-Yan Lam 3 October

2 Background Research project commissioned by Asia-Pacific Economic Cooperation TEL in 2002 Acknowledge APEC TEL (chaired by IDA of Singapore) for sponsoring this project Courtesy of PrivyLink for using the materials Promote secure cross-border e-commerce among APEC members Use of PKI for strong security Use of token-based approach for user-friendliness Interoperability issues of cross-border transactions This talk presents some of the findings and recommendations of the study 2

3 General Perception of PKI Lack of awareness Costly Inconvenient to use Complicated to implement Not portable Burden to computing performance Complex to understand (CA, RA, VA, OCSP, ) Low cross-border/-application interoperability Extensive work on standards Low adoption rate 3

4 Project Approach Survey the present security infrastructure for e- commerce employed by government and private sectors Identify concerns/issues faced by PKI regulators PKI application/service providers PKI users Analyze mindset and priorities of PKI players Recommend strategies for further strengthening and promoting secure cross-border e-commerce 4

5 The Survey Regulators from Singapore, Hong Kong China, Chinese Taipei and PR China were involved in this survey Application/service providers from Singapore, Hong Kong China, Chinese Taipei and PR China were covered in this survey Banks Telco CA Operators E-Commerce Hub Operators 5

6 Finding 1 There are active bodies within the economies mentioned who act to promote the use of PKI 80% Respondents believe in the use of PKI for enhancing security of e-commerce transactions Awareness of PKI is high There are tremendous efforts in promoting the use of PKI for securing e-commerce Why adoption is still low? What went wrong? 6

7 Finding 2 Respondents rank key drivers of PKI in the following order of importance Legislation Incentives Regulatory requirements Funding Online services Non-repudiation Security and trust Legislation is more important than security as a business driver for PKI 7

8 Finding 2 (Cont d) How is legislation related to PKI? How to deploy PKI to meet legislative needs? Legislation is extended to allow electronic data to be accepted as evidence in court of law But electronic data may be modified easily Electronic data must be properly protected in order to be accepted PKI plays a role here i.e. for creating persistent evidence RE-POSITION PKI IN SECURE E-COMMERCE 8

9 Finding 3 Respondents rank standards the biggest barrier to token-based interoperable PKI This is contrary to the perception that there are extensive standards!!! Generic standards are not sufficient for implementation Different PKI applications may implement standard data structures differently Smart tokens are also not interoperable i.e. may have different APIs to the token device 9

10 Finding 3 (Cont d) Legislation is usually the key driver for PKI Legislation usually influence security policies PKI needs to implement/support security policies which are Industry specific Application specific Country/region specific Implementing policies into the PKI layer is likely to complicate matters and create interoperability issues 10

11 Finding 4 1/3 Respondents are interested in evidence retention when using PKI (1/2 did NOT respond though) This is an improvement in terms of understanding the proper use of PKI in e-commerce applications In the early days, PKI were used almost invariably for supporting SSL This is an indication of better maturity in application of PKI 11

12 Finding 5 About 40% of Respondents use PKI for B2B and B2G applications This shows a healthier trend in use of PKI for e- commerce applications In the early days, PKI were used mostly for B2C applications for greater visibility and publicity This is an indication of better understanding of risk awareness of e-commerce i.e. use PKI for high risk transactions This is consistent with the finding that ~40% respondents prefer to use token-based PKI deployment 12

13 Finding 6 82% Respondents prefer to use public CA but 60% respondents prefer to issue their own smart cards This shows that token-based PKI deployment for addressing user convenience is viable People see the value of smart cards to their business People are afraid of the complexity/cost of setting up CA Technologically, need a secure framework for segregating the CA and card issuing functions and allow key pairs certified by one party to be injected into a card issued by another party card issuer applies for cert on behalf of end users 13

14 Finding 7 Not much effort in developing legal framework for crossborder PKI interoperability Not much effort in establishing technical standards for PKI interoperability Industry players are actively promoting and experimenting cross-border PKI interoperability This is an improvement in approach for handling new technology Industry/Application-driven NOT technology-driven Understand the application before standardizing Understand the business scenario before developing legal framework 14

15 Summary Awareness of security is high Awareness of PKI and smart cards is high Legislation is the key driver but has been handled quite well for intra-economy e-commerce Cost is not always a key concern Standard is a key concern for cross-economy PKI Standard is a key concern for smart cards Higher maturity in application of PKI Market awareness of risk is improving PKI drivers are not rushing to develop legislation for crosseconomy e-commerce, but emphasize more on experiences through new inter-economy initiatives 15

16 Some Recommendations PKI deployment to be assisted by smart tokens To address user convenience and portability Application of PKI should be fit-for-purpose To reflect the level of transaction risks Allow cost and computing overhead to be justifiable PKI should be application-driven NOT technology-driven Hide the complexity of PKI implementation from application Focus on applying PKI to meet business needs rather than further introducing more complex PKI components 16

17 Some Recommendations PKI deployment to address legislation requirements Ensure creation of trusted electronic evidence rather than simply providing channel protection e.g. SSL PKI implementation to be policy-independent Use a flexible implementation architecture that allows policy modules to be added without affecting the PKI layer A reference implementation of PKI layer to address shortcomings of generic PKI standards To minimize ambiguity and facilitate interoperability tests 17

18 Change the Perception Lack of awareness NOT true Costly and computing overhead Use PKI only when it is justifiable Inconvenient to use and not portable Use smart tokens Complicated to implement Simple interface between application and PKI library Policy-adaptor for legislation-specific codes Complex to understand Application-driven NOT technology-driven Low cross-border/-application interoperability Industry efforts and reference implementation for standards Industry initiatives to experiment 18

19 Conclusion PKI is widely accepted to be a mechanism for enhancing security of e-commerce Smart tokens are believed to help promote secure e- commerce and cost is not always an issue There is better maturity in deploying PKI to make the overhead justifiable R&D efforts in applied PKI should help address Legislative requirements of e-commerce applications Trust model that segregate CAs and card issuers Industry players that drive cross-economy PKI initiatives Should provide more feedback on cross-border scenarios Minimize ambiguity of generic PKI standards The future of applied PKI is promising 19

20 Contact Me School of Software Tsinghua University Beijing People s Republic of China lamky@tsinghua.edu.cn 20