OCTOBER TUTOR ¢

DIGITAL CERTIFICATES

GET IT
certified
Digital certificates go way beyond traditional password security. For the US electric power supply
industry, they opened the doors to a more streamlined and competitive way of business. In this
PC Tutor, we use a real world scenario to demonstrate how digital certificates work so you can find
out how it can work for you.

raditional username and pass- ment and forms processing, directory ser- tain any secrets. Associated with your pub-

T word security is one of the last

vestiges of the non-In-
t e rnet economy.
vices such as the Lightweight Directory
Access Protocol (LDAP), plus secure
electronic mail (S/MIME), the Se-
lic key is a private key, however, which
you must keep secret. The most important
property of these keys is that when your
This method of security cure Sockets Layer (SSL) proto- private key is applied to data (via a com-
m ay b e ad eq uat e f or col, single sign-on and the plex cryptographic operation), the data is
some applications, but Windows 2000 Encrypting unrecoverable except by application of
digital certificates File System (EFS). your public key. Conversely, if someone
pave the way for applies your public key to data, the only
m o r e s e n si t iv e WHAT IS A DIGITAL way to get back the information is to ap-
transactions be- CERTIFICATE? ply your private key.
tween consumers Digital certificates are You can authenticate yourself by ap-
and businesses, based on a type of secu- plying your private key to data you send.
b e t w e e n b us i - rity known as public key If the recipient can successfully extract
nesses, and with- cryptography. Public key the data using your public key, you must
in corporations. cryptography introduces be who you say you are, because only
Digital certifi- two keys: a public key you have access to the private key. You
c at e s p la y a and a private key. could apply your private key to a con-
significant role A dig ital c ertificate tract, for example, thereby digitally sign-
in several tech- holds your public key ing the document and indicating your
nologies, includ- and other identifying in- agreement just as if you had signed a pa-
ing Virtual Private formation about you. Any- per version. Digital signatures provide the
Networks (VPNs), one can have your digital important property of non-repudiation for
e l e c t ronic docu- certificate—it doesn’t con- electronic transactions—the ability to cre-

84 October 2000 www.DITnet.co.ae ■ www.PCmag-mideast.com

 ¢ OCTOBER TUTOR
DIGITAL CERTIFICATES

ate a binding agreement electronically. If

someone wants to send you private (en-
crypted) information, they simply apply
your public key. Only you have the pri-
vate key associated with that public key,
so only you can decrypt the message.
Digital certificates commonly used in
business conform to the ITU-T Recom-
mendation X.509 specification. X.509 dig-
ital certificates are themselves digitally
signed by a Certificate Authority (CA). A
CA is responsible for validating that the
public key contained inside the certificate
truly belongs to the individual identified
within it. A CA may ask you questions and
request documentation before issuing you
a digital certificate that others will rely
upon. Companies using digital certificates
internally may choose to run their own
CA. Commercial CAs, such as Digital Sig-
nature Trust or VeriSign, are also avail-
able.
Let’s look at how digital certificates have
proven their worth in the real world.

A BUSINESS-TO-BUSINESS EXAMPLE
As a result of US Federal Energy Regula-
tory Commission (FERC) Order No. 889,
electric power transmission providers in
the US were required to provide an In-
ternet-accessible Open Access Same-Time
I n f o rmation System (OASIS) for online
electric power trading no later than Jan-
uary 3, 1997. OASIS is a transmission reser-
vation system where utilities check for the
availability of transmission power.
Before this, electric utilities operated as
monopolies and were authorised by fed-
eral and state regulatory authorities to be
the sole proprietors of electricity service
to consumers who lived within a specific
service territory. The FERC order effec-
tively introduced competition into the
wholesale market for electricity and, as a
result, electric utilities and others could now
sell electric power to one another across
state lines on a competitive basis. Electricity
marketers check on the price and avail-
ability of a utility’s power grid and then
schedule and reserve transmission ca-
pacity for the transfer of wholesale elec-
tricity. Thus, a company could buy elec-
tricity wherever it’s cheapest and move it
on the lines that lie between the power
source and the customer.
The Joint Transmission Services Infor-
mation Network (JTSIN), a task force rep-
resenting over 200 electric utility compa-
nies, responded to the FERC mandate by
hiring companies to create and maintain
the JTSIN OASIS. In defining the OASIS re-
quirements, the task force found that a
strong, digital certificate-based security
solution was needed so that valid users

www.DITnet.co.ae ■ www.PCmag-mideast.com October 2000 85

OCTOBER TUTOR ■
could be recognised at any server and so
user privileges would be based on busi-
ness agreements between transmission
providers and transmission customers.
The JTSIN contracted with TradeWave,
a developer of secure business systems,
to deploy the OASIS digital certificate so-
lution. This included the hardware, soft-
ware, policies and expertise to authenti-
cate users and to issue and manage their
digital certificates. TradeWave provided
all of the necessary components, includ-
ing integration and consulting services,
client and server security software, out-
sourced CA services and customer sup-
port services.
A DIGITAL CERTIFICATE SOLUTION
The TradeWave digital certificate solution
for OASIS offers an interoperable and stan-
dards-based solution. The diagram sum-
marises its primary components. Let’s look
at the relationships among these compo-
nents.
The TradeAgent client secures the user’s
Web browser and is required for viewing
information on OASIS Web servers. The
client secures transmissions by encrypting
and digitally signing messages, providing
privacy and authentication.
The TradeAgent server secures the Web
s e r v e r. Only authenticated Tr a d e A g e n t
client users can view secured Web pages.
The client and server exchange encrypt-
ed and digitally signed messages.
The TradeAccess control server works
with the TradeAgent server and the un-
derlying Web server to ensure that Web re-
sources are available only to authorised
users. The collection of all access control
definitions for a resource is called an Ac-
cess Control List (ACL). After a user is au-
thenticated, ACLs for resources request-
ed by the user are checked for any re-
strictions to ensure that the individual is
authorised to access the resources. ACLs
can be based on business agreements be-
tween transmission providers (sellers) and
transmission customers (buyers).
TradeAuthority certificate authority (CA)
is responsible for registering new users,
distributing, revoking and updating cer-
tificates, and maintaining audit trails for
administrative changes to the system. The
CA interfaces with an LDAP-compliant di-
rectory server for storage and retrieval of
certificates.
CHALLENGES AND LESSONS
Deployment of the digital certificate in-
f r a s t r u c t u re in 1997 posed many chal-
lenges. Computer security in general was
gaining visibility, but its importance was
not well understood by most users. Dig-
86 October 2000
DIGITAL CERTIFICATES
ital certificates were and still are a relatively
new technology, from the perspective of
large scale deployment. Challenges to the
deployment included:
Development of digital certificate
policies and pr ocedures. Even the most
advanced security hardware and software
can’t protect important corporate data
without a set of clear cut security policies
and procedures. Because digital certifi-
cate technology was in its relative in-
fancy, there were no existing poli-
cies and procedures to follow.
The management and legal
counsel of both JTSIN OA-
SIS and TradeWave doc-
umented the security
needs of the utility
companies and de-
tailed each party’s
obligations and legal
limitations. General
corporate policies
that clarified expec-
ta t i o ns f o r e m -
pl o y e e p e rf o r -
mance, behaviour
and accountability
were developed, as
w e re more specific
technical policies that
addressed how much
security each trans-
action and data type would need. Net-
work access security levels were deter-
mined for each employee, customer and
partner.
Educating users on Internet and dig-
ital certificate technologies. This new
technology was being deployed to users
with a wide range of computer experi-
ence. Users were accustomed to doing
business using traditional power trading
methods, such as making personal con-
tacts, sending faxes and making phone
calls. With the deployment of OASIS, users
had to get connectivity to the Internet, in-
stall the TradeAgent software, get digital
certificates and perform everything on-
line. This was a major change for users who
were not accustomed to doing business on
their computers every day.
Educating the users to the point of mak-
ing them comfortable with the new tech-
nologies was key in successfully deploy-
ing the TradeWave solution for the OASIS
community.
Having the right kind of online docu-
mentation was also important. The initial
documentation focused on the system ar-
chitecture and provided too much infor-
mation about the technology. This over-
whelmed some users to the point that they
wanted to give up before they even start-
www.DITnet.co.ae
ed. After the initial beta rollout, the on-
line documentation was edited to focus on
simple, step-by-step processes for regis-
tration and installation. This change in fo-
cus made things easier for users to fol-
low, especially if they needed to consult
with another person in their organisation
to perform a step. The support Web site
was also reworked to provide high level
troubleshooting information.
Dependence on other pr o d u c t s .
TradeWave software works close-
ly with Netscape and Microsoft
b rowsers and servers. The
t e st i n g c y c l es of t h e
TradeAgent client had to
be carefully co-ordinat-
ed, because the prod-
uct was supported on
Windows 3.1, Windows
95, Windows 98, Win-
dows NT, Sun Solaris,
IBM AIX and H P - U X.
A lso , M ic ro so ft and
Netscape fre q u e n t l y
released updates to
their software. Even
with careful co-ordi-
nation, trying to test the
latest versions of these
p r o d u ct s w i t h t h e
Tr a d e Wave software
was often problematic.
In one case, the TradeAgent client went
through a full testing cycle with a beta
version of Microsoft Internet Explorer and
was then released to customers. When the
commercial version of Explorer was fi-
nally released, it included a major change
that caused the TradeAgent Client soft-
ware to malfunction. A patch release of the
TradeAgent software had to be made avail-
able to users. Determining when users
would upgrade to the latest browser soft-
ware and providing easy methods for in-
stalling a patch release made it easier for
customers to deal with a browser com-
patibility problem.
JTSIN OASIS TODAY
US Power companies have traded more
than $30 billion in electric power using the
TradeWave digital certificate-based solu-
tion. JTSIN OASIS has more than 3,000
digital certificate-enabled users and 500 par-
ticipating companies. Power companies
have expanded their use of TradeWave
by writing their own applications that use
existing TradeWave software and certifi-
cates. OASIS is a thriving and extremely
successful example of how business-to-
business e-commerce can be enhanced
and streamlined through the use of digi-
tal certificates.
■ www.PCmag-mideast.com