Sunday, December 6, 2009

Using Certificates for Authentication ? Where to store them ?

Question: 
Has anyone deployed a VPN solution that leverages user certificates for authentication?
We are considering the possibility of leveraging digital certificates as an authentication factor for VPN. Has anyone implemented this or looked at solutions that do this? We are not comfortable with solely relying on a certificate and the security/integrity of the PC as an authentication mechanism. If you are currently using certificates, I would be interested in hearing how you are deploying this.

Answer:
.....,
The short answer is yes.  We did deploy several off-the-shelf certificate based authentication solutions for remote access VPN systems such as Cisco, Check Point, Juniper, Citrix, Nortel.. It is again very possible to deploy similar solutions over SSL VPN solutions (This time easier since browser is the client).   I worked with Entrust as the PKI integration provider.  When using certs, most of the questions/problems are generic PKI related questions (CRLs,  OCSP, identity management etc)


9 out of 10, enterprise shops store the certs on PC or mobile devices since they want to avoid using tokens/smart cards. Using a 3rd party storage is ideal but to be honest smart cards share the fate of PKI for complexity so many solution sets avoid tokens/smart cards, unless the policies mandate certificates.
When smart cards are more expensive/complex (readers, personalization etc) enterprises use USB tokens to store certificates. (Several companies  provide tokens with certificate support, ActivIdentity, Aladdin, Authenex, Entrust, SafeNet (merged with Aladdin) , RSA (RSA has a hybrid token for OTP + certs)).


If you would like to use smart cards as the certificate container, or use the same certs for physical security simultaneously, you can simple take one of the ready to use HSPD-12 Personal Identity Verification (PIV) Card solutions (http://fips201ep.cio.gov/apl.php) so that you can avoid designing all components architecture yourself.


Of course do it yourself path is more fun, technically it is straightforward to integrate certs with any 802.1x based authentication server but as you know it usually gets more complex. We have deployed a complete system for enrollment, biometrics, cards, CMS etc, (took 3+ years)


cheers,
-     - yinal ozkan 

1 comment:

Anonymous said...

http://ophthalmoscopy.yoyohost.com/sex-dating-in-ramona-south-dakota.html dating christianw oman [URL=http://sirrahs.freehost123.com/dating-cousin-through-marriage.html]dating cousin through marriage[/URL] alex rodriguiz dating scandel
http://aeroduct.freehost123.com/sex-dating-in-rialto-california.html contacting free personal ad dating site [URL=http://sirrahs.freehost123.com/chatrooms-internet-dating.html]chatrooms internet dating[/URL] sex dating in dekalb illinois
http://enlarge.bigheadhosting.net/sex-dating-in-cropper-kentucky.html dating new london wi [URL=http://noninstrumental.yoyohost.com/advertise-on-try-internet-dating.html]advertise on try internet dating[/URL] adult dating in rutland illinois
http://enlarge.bigheadhosting.net/jimmy-kimmel-dating.html poems on being single woman [URL=http://affixes.xhost.ro/palm-springs-restaurants-meet-women.html]palm springs restaurants meet women[/URL] sex dating in fairfax south dakota
http://affixes.xhost.ro/free-dating-adult-personals.html free adult dating in maine [URL=http://sirrahs.freehost123.com/courtney-plumpprincess-dating.html]courtney plumpprincess dating[/URL] local asian dating
http://cousinship.sporshok.org/free-copy-of-dating-without-drama.html speed dating miami [URL=http://aleutian.sporshok.org/online-anime-dating-sims.html]online anime dating sims[/URL] asian dating marriage woman
http://enlarge.bigheadhosting.net/white-woman-dating-black-man-arizona.html dating personals over fifty [URL=http://cousinship.sporshok.org/sex-dating-in-port-oconnor-texas.html]sex dating in port oconnor texas[/URL] sex dating in hogansburg new york
http://cousinship.sporshok.org/albanian-personals-dating-directory.html sex dating in calista kansas [URL=http://pyromanias.webng.com/free-adult-dating-willowick-ohio.html]free adult dating willowick ohio[/URL] asian women dating
http://stances.freewebhostx.com/dating-free-line.html virgo woman and scoripo man dating [URL=http://noninstrumental.yoyohost.com/sex-dating-in-lindenau-texas.html]sex dating in lindenau texas[/URL] online dating site singles
http://disubstituted.o-f.com/dating-websites-in-rhode-island.html watchersweb clubhouse free adult dating online [URL=http://coying.wtcsites.com/dating-free-online-services-trial.html]dating free online services trial[/URL] china dating online friend chinese