[an error occurred while processing this directive]

ECURE 2002

PKI Records Management and Archive Issues

October 10, 2002
Phoenix, AZ

Charles Dollar
Dollar Consulting

1

Agenda

  1. Introduction/Orientation
  2. Digital Communication
  3. What is PKI?
  4. PKI Administrative Records Functions
  5. PKI Operational Records v. PKI Electronic Recordkeeping Requirements
  6. Recommendation

2

PKI Case Study: Overview

3

Digital communication

4

PKI a “hot technology”

5

What is PKI?

A PKI is an asymmetric cryptography security environment that supports the transmission, delivery, and receipt of digital communications over a non-secure communications channel.

6

What Does PKI Do?

7

How PKI Works in Digital Communications

[Diagram of the process in which a transmitted message goes from
			Originator to Recipient]

8

Hash Digest Values

[photo of the serial numbers on a One-Hundred Dollar bill]

337.60 KB
AaAEAACoAQAKAGjhX84+VC1d3)
NgDiPHvG+/R8hKCAUCACOvWKAT
FOYIz3XS5gAAgI1wrAKO1geAAA
AAAAAAAAAAAAAA=

337.60 KB
AaAEAACoAQAKAGy2YV8gORj
Feuf3yfnn7V)QMKBCgKywNfTD+
avB8UVEYKAAAoUB2gKo1gEAALg
AAAAAAAAAAAA
=

9

Key PKI maangement concepts

10

Certificate Policy (CP) for Access Certificates for Electronic Services

11

CP Operational Requirements

12

Certificate Practice Statement (CPS)

To Be Discussed Later
Under PKI Operational and
Electronic Recordkeeping
Requirements

13

PKI Records

[Hierarchy of All PKI Records which includes Administrative Records and
			Transaction Records subgroups]

14

PKI Administrative Records

[Hierarchy of Administrative Records which includes Unique Administravtive Records
			and Supporting Administrative Records subgroup]

15

PKI Administrative Records Guidance Constraints

16

PKI functions

17

PKI Functions, Activities, and EXAMPLE Records

[Box list of Function, Activites, and Example Records for Plan/Define, Establish,
			Operate, Audit/Monitor, and Reorganize categories]

18

Example Operate Functions and Related Records

[Description of Functions to Records procedure Diagram]

19

PKI Requirements Overview

PKI Operational and Recordkeeing Requirements

Operational Systems

Recordkeeping Systems

1. Records Capture X X
2. Records Metadata X X
3. Records Retreval X X
4. Records Classification X
5. Records Disposition X X
6. Records Integrity X X
1. Records Storage* X
1. Vital Records X
9. Records Audit/History Log X X
10. Records Privacy X X
11. Records Security X X
12. Records Freezes X X
13. Records Transfer to ERS X
14. Records Preservation* X
15. Records Transfer to Archives X

* Records storage in an operational system is substantially different from records preservation in an electronic recordkeeping system. Some of the specific requirements for records preservation include those of records storage.

20

PKI Record capture

Operational

  1. Accurate and complete at or near the time of the event
  2. Event log that trachs all activities associated with capture
  3. Automatic population of record series title, disposition, and vital records status.

Recordkeeping

  1. As database tables or as “rendered for viewing”
  2. Technology neutral formats
  3. Paper-based records
  4. Document transfer of recurds to ERS
  5. Confirm integrity of transferred records
  6. Complete and accurate transfer of metadata

21

PKI records metadata

Operational

  1. Augment event log data with series title, retention period, vital record status
  2. For each unique event:
    • Common name
    • Certificate number
    • Date of event
    • Distinguished name
  3. Restrict changes in metadata to authorized persons

Recordkeeping

  1. Minimum attributes specified in operational requirements
  2. For CP and CPS use registered Object ID
  3. View/print complete metadata
  4. Computer generated unique id for each record
  5. Record location of electronic and paper records
  6. Human readable bar code for all paper records
  7. Restrict changes to authorized persons

22

Recommendations

23

Summary

24

Questions?

25

Thank You!

Charles Dollar
thecdollar@cs.com
Tel.: (253) 853-6346

26


Digital Technology Standards: What to Look Out For

ECURE Conference
October 11, 2002

Charles Dollar
thecdollar@cs.com

1

What are Standards?

“Standards are documented agreements containing technical specifications or other precise criteria to be used consistently as rules, guidelines, or definitions or other characteristics to ensure that materials, products, processes, and services are fit for their purpose.” International Standards Organization

2

Standard Principles

3

Types of Standards

4

What Makes A Standard Succeed?

5

Strengths and Weaknesses of Standards

Stengths

  • Stability
  • Interoperability
  • Interconnectivity
  • Portability
  • Supports migration

Weaknesses

  • Lag behind technology
  • Not necessarily the best technical solution
  • Vendor compliance
  • Change over time
  • Unending migration

6

Standards and Migration

[Standard Changes over time diagram]

7

Selected Standards that Affect long-Term Access to Electronic Records

8