Date: Wed, 05 Jul 2000 14:55:20 -0800 Subject: FW: UA's proposed PKI lab From: David Bantz To: Message-ID: In-Reply-To: <00d301bfe6b2$3e510ed0$700be589@sons.alaska.edu> Mime-version: 1.0 Content-type: multipart/mixed; boundary="MS_Mac_OE_3045653721_14705892_MIME_Part" content-length: 17939 Status: OR Fr: "David Bantz To: Internet2 PKI Lab RFP Fr: University of Alaska Re: Alaska's Proposal for PKI Lab Background and strategic goal: The University of Alaska system is comprised of 3 major campuses (including the land, sea, and space grant research institution, University of Alaska Fairbanks), 10 community campuses throughout the state, and a long-standing program of correspondence and distance learning. To better serve the needs of its diverse population and to be the economic combustion chamber of the state's economic engine, the University aims to provide its resources to all its constituents as a coherent entity; that goal has recently been reinforced and articulated by our President. The University's directory and secure infrastructure project is a key tactical component for achieving that strategic goal. We aim to provide secure network communication to citizens in every part of the state (Alaska already has a greater proportion of its citizens connected to the Internet than any other state). A single directory (though with distributed management responsibilities) will provide students and employees with services throughout the state (or indeed the world) utilizing single-sign-on, secure authentication, virtual private networks, and policy-driven authorized access to resources (both University-owned and licensed). We need this degree of flexibility because the populations we serve are both highly mobile and widely dispersed. We will succeed because (1) the University has committed to and promised its citizens this degree of integration, and (2) key data on every student and employee, and every course offered, is already maintained centrally. Existing experience & expertise: We currently maintain administrative data centrally (human resource information on all employees, student information, and financial records). System administration IT staff have well-developed procedures for maintaining unique identifiers and synchronizing data state-wide. With years of development and maintenance expertise, our staff understand the structure of these data, and are able to (and have authority to) extract any needed data tables, including joins and intersects across HR, financial, and student information. Without minimizing the resources needed for sound planning, design, and automation of data extraction to populate our directory, we will not have to re-invent procedures for data collection or define data elements from scratch. The Arctic Regions Supercomputing Center, a DOD-funded entity, has long-standing expertise in computing and network security. ARSC maintains multiple layers of network and operating system security; because of its status with DOD, ARSC will implement PKI on multiple platforms. While not directly a component of the University directory and secure infrastructure project, ARSC staff work side by side with the key staff of this project (literally as well as figuratively) and have indicated their strong interest in collaborating on this project. The core project staff of four all have IT experience both at the campus level and as part of central administrative IT management. These staff have an approximate average of 20 years' experience in network and computing systems development and management in research, academic, and administrative settings. We have collaborated extensively in past projects and are collectively and individually committed to implementing a central directory-based authentication and authorization: David Bantz, Senior Research Associate for Academic Technologies, has led dozens of IT projects in instructional computing, network services, and infrastructure development. He has a Ph.D. in the Conceptual Foundations of Science, and has held fellowships from the American Council of Learned Societies, National Endowment for the Humanities, and the University of Illinois Center for Advanced Study. He has been an active participant in EDUCAUSE and its predecessors. Richard Machida, Network Manager, has broad expertise in network engineering. He was key in designing and deploying University of Alaska Fairbanks's ATM campus network. Currently he leads the deployment of IP-based video and innovative technologies for Internet access statewide. Machida also teaches networking technology (including secure networking) for the University. Tim Larrabee, Manager of User Services at University of Alaska Fairbanks, previously managed wide-area networks and computing services for the Fairbanks North Star Borough School District (covering a region the size of Massachusetts, Rhode Island, and Connecticut combined). He has industry certification for a number of networking technologies. Chirk Chu is, de facto, the University's network security officer. He has for years been the University's foremost advocate and practitioner of secure operating systems and networks. Areas of PKI Research Interest: Interoperability: we aim to implement an infrastructure that will support secure sign-on, VPNs, encryption, and digital signatures, as well as authentication. Our environment must support multiple client and service operating systems. Currently, single sign on using Kerberos is used for many services within the system administration IT group, while PGP is used for digital signatures, and yet other (shared secret) technologies are used for encryption and VPNs; the infrastructures are unrelated. We know that spread use beyond IT staff, we will need to integrate these functions in a coherent infrastructure with a simplified user interface. Distributed management: while our data is centralized, we need to maintain the authority of campuses to register students, employ staff, and make authoritative changes (including revocations) in records. Attending to privacy concerns: we are sensitive to the demands of our users for a reasonable expectation of privacy, and reasonable protection of that privacy. Automated certificate generation & applications: operational success will require automated procedures for generating certificates. With state-wide library services and multiple licensed databases also delivered state-wide, we need to use PKI rather than ad hoc schemes of distributed "passwords" or IP filtering to authenticate users. David Bantz - U. Alaska, Fairbanks, AK 99775-5320: 907.474.1543 - Office, 209E Butrovich, 910 Yukon Dr. 907.474.6309 - Information Technology 907.474.7343 - Philosophy 907.474.7127 - fax http://www.uaf.edu/dcc/personal/David David Bantz - personal, Fairbanks, AK 99775-0139: 907.451.1152 603.643.1960 (NH)