Project Description. Understanding PKI

Transcription

1 Executive Summary Discussion on Public Key Infrastructure (PKI) in Kansas began more than eight years ago. After careful consideration, input from many groups, extensive research and the creation of an infrastructure, which included both statues and a certificate policy, PKI was made operational in Kansas PKI combined resources (personnel and financial) across state agency boundaries to create an enterprise-wide service that can be used by all agencies, regardless of size and budget. The cost of creating the PKI infrastructure was covered by a $261,000 grant from the Information Network of Kansas (INK). INK is a quasi-state agency that uses no appropriated tax dollars. By the end of 2005 it is estimated that five state agencies will be using PKI, which represents a cost avoidance for the state of more than $1.3 million. Once INK s three-year grant is exhausted PKI will be a self-supporting service through users digital certificate renewals and purchases. Kansas PKI can be implemented as a reliable, efficient, cost-effective, secure, authentic and non-repudiable method to receive authorization of an electronic transaction and to transmit data. The overriding mission of Kansas PKI is to make government more efficient and accessible to businesses. Any individual or business that is required to interact with a state government agency in a transaction needing an ink signature or needing to transmit data through an unsecured network is a potential user. All state agencies can examine processes that can be re-engineered to use PKI and eliminate or greatly reduce paper processing. Currently both Kansas Department of Revenue s E-lien program and the Kansas Public Employees Retirement System Employer Contribution System are using Kansas PKI. The Kansas Secretary of State s office is working to implement PKI with the 105 county election offices as a security layer for the Election Voter Information System. The Kansas Department of Transportation is also developing an application using PKI that will allow contractors to securely submit contract bids on road projects electronically.

2 Project Description Kansas State government has worked for more than eight years to build a solid enterprise architecture for the implementation of Public Key Infrastructure (PKI). Kansas PKI can be implemented as a reliable, efficient, cost-effective, secure, authentic and non-repudiable method to receive authorization of an electronic transaction and to transmit data. The overriding mission of Kansas PKI is to make government more efficient and accessible to businesses. Kansas PKI combines resources (personnel and financial) across state agency boundaries to create services that can be used by all agencies, regardless of size and budget. The PKI committee carefully reviews each project and selects only those that are truly ready for PKI. Projects are evaluated on the basis of need, readiness to implement PKI, associated risks and return on investment (customer service and revenue). At this point new PKI implementations are added one at a time to ensure sufficient resources are available to make each implementation successful. The committee builds on the knowledge gained from each implementation. Understanding PKI PKI is an electronic framework encompassing digital certificates, key pairs, digital signatures and encryption. A digital certificate is an electronic component that consists of a public and private key used to digitally sign and encrypt electronic information. The digital certificate is installed on a certificate holder s computer or token device. A digital signature links a person s exclusive identity to an electronic document or transaction to accomplish what a written signature accomplishes. A digital signature provides signer and document authentication. Signer authentication is the ability to identify the person who digitally signed the document. This provides non-repudiation, meaning a signer cannot deny they signed a document or transaction. Document authentication ensures the information was not altered after it was digitally signed. Kansas state government treats PKI as a signature instead of access control (login & password protection). Kansas does not support treating PKI as access control, but as a supplement to these systems. Digital certificates also have the ability to encrypt information so the information cannot be understood by anyone other than the intended party. A digital certificate is obtained from a Registration Authority (RA) who establishes the user s identity to the satisfaction of the Certificate Policy. This policy provides several levels of certification of increasing complexity depending on the importance of the transaction for which the digital certificate is intended. PKI Implementation To implement PKI as an enterprise-wide solution, Kansas stratified PKI responsibilities. The Information Technology Executive Council, a broad-based executive level committee representing state and local government interests and the private sector, is responsible for approving IT policy for all branches of state government and oversight of the official Kansas

3 Certificate Policy. The Kansas Secretary of State is responsible for the contract for Certification Authority (CA) services, which establishes a clear line of authority for enforcement of the contract s terms, conditions and registration standing. VeriSign is the CA, as they are the experts in this area. The Information Network of Kansas (INK), a public and private sector enterprise, is the RA. Kansas is the first state to successfully implement PKI as a true enterprise solution. Other states experimented with PKI but many over projected the audience and use. They (New Jersey for example) said every citizen would have a certificate. Several states had the build it and they will come attitude. Other states have invested large sums of money and tried to be their own Certificate Authority (CA), which is very expensive. Kansas knew the market contained vendors that had the security resources for digital signatures, but these vendors were weak in the area of vetting (RA role). Kansas decided the success of the initiative depended on the ability to assure the identity of the individual; therefore the RA role may be better controlled and monitored by the State. Kansas left the large infrastructure investment of becoming a CA to the experts and created procedures to allow trusted parties vet other trusted parties. Another significant difference between Kansas and other states is that Kansas made the decision to be self-sustaining and only strive for appropriate users. It has never been Kansas intention for every citizen to have a digital signature. Kansas does not solve PKI problems/issues until they exist. For example, Kansas does not currently have rules for all levels of vetting, because a need for high level vetting has not been identified. Other states defined issues before there was a need. This resulted in issues being too narrowly or too broadly defined, which required change and created delays and confusion among the participants. PKI in Use The first PKI transactions Kansas implemented were Kansas Department of Revenue s (KDOR) E-liens. E-liens are high dollar transactions that are crucial to operations of financial institutions, automotive dealers and KDOR. This implementation demonstrates Kansas and KDOR s confidence in the PKI solution. E-liens were implemented in 2003 to provide businesses the convenience of entering and submitting lien data electronically. E-lien uses PKI to augment user authentication and provide non-repudiation. It augments authentication by verifying a digital certificate before the user can access the log in page. During the process of an E-lien transaction information is extracted from the digital certificate and stored in KDOR s database for use in the transaction. This electronic process replaces the requirement for an ink signature by ensuring this certificate holder is the individual who performed the transaction. Once a business user has obtained a Kansas digital certificate, a KDOR user ID and KDOR password, he/she can access the E-lien system through their Web browser. When the user enters the Web address of the application, the system validates the digital certificate and if successful, the user is presented with the E-Lien log in screen. The user then enters a user ID

4 and password to access the system s main menu. The main menu allows users to create Notices of Security Interest (NSI), perform inquiries on NSIs, cancel NSIs, create NSI Statements, release liens, edit/add loan numbers, and view a report menu for electronic communications. The digital certificate information is permanently logged with the transactional information. The Kansas Public Employees Retirement System (KPERS) implemented PKI in 2004 to help control access to its Employer Contribution System. The KPERS system allows State government employers to reconcile employer contributions to member accounts online. KPERS also uses PKI for VPN authentication to help control who can remotely connect to the KPERS systems. The Kansas Secretary of State s (KSOS) office is implementing Kansas PKI with all 105 county election offices as a security layer for the Election Voter Information System. KSOS anticipates issuing PKI certificates to approximately 500 users. The Kansas Department of Transportation (KDOT) is currently developing an application utilizing PKI that will allow contractors to securely and electronically submit bids on road projects. There are 2,000 contractors registered with KDOT. KDOT estimates 200 of these will be early adopters of the electronic system. Significance to the improvement of the operation of government All state agencies can examine processes to see which may be re-engineered to use Kansas PKI to eliminate or reduce the paper process. Any individual or business that is required to interact with a state government agency in a transaction needing an ink signature or needing to transmit data through an unsecured network is a potential user. Because Kansas PKI is an enterprise solution, one Kansas digital certificate may be accepted by all participating agencies. Therefore, an individual can use one digital certificate to conduct any business with any Kansas state government entity that requires a digital certificate. The certificate may need to be upgraded depending on the security level each agency requires. To ensure PKI meets Kansas agencies and citizens needs, all branches of Kansas state government, in cooperation with private organizations, associations and academic institutions participated in the development of PKI requirements. These organizations continue to participate in PKI through administration roles and responsibilities distributed to the Information Technology Executive Council (ITEC), the Kansas Secretary of State (KSOS) and the Information Network of Kansas (INK). The Kansas PKI model was built from the ground up. To guarantee that a statewide PKI infrastructure would be available for agencies in all three branches of government, the PKI work group drafted proposed legislation in 1999, which became part of the Kansas Uniform Electronic Transactions Act in This legislation not only provided a uniform law but also ensured that

5 the various units of state government would not build silos for which bridges would need to be built later. After this foundation was firmly in place, the work group proceeded to draft regulations and a certificate policy to provide the detail of the statewide infrastructure and clarify the roles to be assumed by ITEC, INK and KSOS. All state agencies and subunits of government now rely on these integrated laws and policies to implement their secure applications. The Kansas Department of Revenue (KDOR) was the first agency to implement PKI. The goal of KDOR s E-lien program is to streamline the process of filing liens and NSI s for both businesses and KDOR staff. E-lien saves KDOR a significant amount of time and money. Currently KDOR is using PKI to securely and efficiently process more than 8,000 transactions monthly. The Kansas Public Employees Retirement System implemented PKI to provide a higher level of access control to their systems via an online application or VPN. The Kansas Secretary of State s Office (KSOS) plans to implement PKI with all county election offices as a security layer for the Election Voter Information System, which is being implemented as part of the Help America Vote Act (HAVA). PKI will help provide election accuracy, efficiency and timeliness. KDOT s goal of using PKI in their upcoming electronic bidding application is to streamline the process for contractors and KDOT by eliminating or greatly reducing the need to process paper forms. Project management continues with each possible use of PKI. The PKI committee carefully reviews each project and selects only those that are truly ready for PKI. Projects are evaluated on the basis of need, agency or entity readiness to implement PKI, associated risks and return on investment (customer service and revenue). New PKI implementations are added one at a time to ensure sufficient resources are available to make each implementation successful. The group builds on the knowledge gained from each implementation. Benefits realized by service recipients, taxpayers, agency or state PKI provides State agencies added security, cost avoidance, cost savings, time savings and improved customer service. PKI provides added security through signer and document authentication, and encryption. Since PKI is an enterprise-wide initiative it provides cost avoidance by allowing all agencies to use the structure and policy developed with the INK $261,500 grant. Each agency does not need to invest the money or time in recreating this structure. Time savings are also achieved through moving paper processes online, which significantly reduces staff time in processing and data entry. Customer service is provided through a joint effort between INK and each agency using PKI. Each agency provides customer assistance for their users, providing answers to frequently asked questions and common problems for both the agency process and PKI. INK offers customers a second level of assistance by providing more detailed troubleshooting for digital certificate problems that cannot be easily solved and are not directly attributed to the agency

6 process or application. PKI saves users a significant amount of time. Users gain the ability to complete transactions with the State entirely electronically, which could previously only be performed by paper. PKI eliminates the need to mail or fax signatures to complete an official electronic transaction and increases the security of the transaction. PKI users need only to invest in one certificate to conduct transactions with multiple Kansas state government entities. Kansas E-lien provides business partners the convenience of entering data online rather than completing a paper form and submitting the information electronically rather than handling and sending the paper by mail. Additionally, the business partner receives electronic communications verifying that the transactions have occurred. As a result, the business partner saves vast amounts of time and money, and avoids delays and fraudulent activities. It is estimated that the business user saves $2.47 per transaction, i.e. time differential of 10 minutes for $12/hr individual equals $2 and material cost of $.47. E-lien processes approximately 8000 transactions each month. This produces an annualized cost saving of over $237,000 to the E- lien business partners. In addition, E-lien increases the speed of filing liens. Previously a lien filing would not be on record for 10 to 15 days. E-liens are on record in 24 hours. The implementation of KDOR s E-lien system has significantly improved the relationship between KDOR staff and businesses, while saving KDOR time and money. KDOR has reduced data entry staff by one full time employee. E-lien has also reduced phone calls by 22%. Return on investment The greatest return on investment from Kansas PKI is the cost avoidance all agencies receive by building an enterprise architecture. Each agency that implements PKI receives an additional return on investment in actual cost savings for an application and/or in improved operations of the agency. The enterprise PKI initiative saves $261,000 per agency in the ownership cost for each agency to individually implement a PKI system. By the end of 2005 it is estimated that five state agencies will be using PKI, which represents a cost avoidance for the state of more than $1.3 million. A $261,000 grant from the Information Network of Kansas (INK) covered the cost of the PKI infrastructure for the first three years. INK is a quasi-state agency that uses no appropriated tax dollars. Once INK s three-year grant is exhausted PKI will be a self-supporting service through users digital certificate renewals and purchases. Agencies may also see cost savings through the movement of paper transactions to electronic transactions. KDOR has reduced data entry staff by one full time employee, saving approximately $20,000 annually. The reduction in time and materials for each electronic notice is approximately $.67, saving more than $34,000 annually. E-lien records more than 5,300 NSI transactions monthly for a $2.50 fee per transaction, producing revenue of more than $159,000 annually.