Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
365
Figure 3. Federation Topology at the NU/NR Level
C. Public key operations and infrastructure
In the Web-based federation solutions, asymmetric cryptography techniques
are used to underpin trustful identity and access data flows. This implies the use
of public-key operations. In sensitive, classified, policy-driven environments, like
the NATO organization, the requirement to utilize public-key operations has to
be translated into the requirement to deploy a Public Key infrastructure (PKI).
In NATO, it means a use of the NATO Public Key Infrastructure (NPKI), providing
an assured foundation on top of which the NATO federation trust topology
can be built. Without integrating with the existing NPKI, the federation services
in NATO environment may not be considered as a valid solution.
Currently, NATO is planning to deploy NPKI on two separate PKI branches,
one on NS domain and the other one in support of NU/NR services. This structure
reflects directly the NATO Security Policy identified sensitiveness levels of information
assets as well as, in a sense, the current NATO network topology logic.
From the federation services point of view, there are a number of challenges
the NPKI needs to meet:
• the management and distribution of certificates and private keys, which
will be solved by the NPKI itself;
• the validation of certificates. There are a number of approaches to this
problem, e.g.: