Secure Messaging Challenge Technical Demonstration

(1)

Secure Messaging Challenge

Technical Demonstration

The Open Group EMA Forum

(2)

Boeing’s Messaging Needs

n

Provide access to strongly encrypted

e

-

mail outside the enterprise

n

Reduce complexity of deploying secure

e

-

mail

n

Present a single solution which can span

the enterprise

n

Provide broadly acceptable solution to

customers, partners, suppliers

(3)

Technical Requirements

n

n Use X.509 v3 CA ServicesUse X.509 v3 CA Services

n

n SelfSelf-signed or purchased commercial certificates-signed or purchased commercial certificates

n

n RSA algorithm with minimum 1024-RSA algorithm with minimum 1024-bit key lengthbit key length

n

n Provide standardsProvide standards--based directory services accessible via based directory services accessible via the public Internet

the public Internet

n

n Certificate stored in standard Certificate stored in standard userCertificateuserCertificate attributeattribute

n

n Provide S/MIME compliant messaging client capable of Provide S/MIME compliant messaging client capable of requesting certificates from the directory

requesting certificates from the directory

n

n Provide S/MIME compliant email systemProvide S/MIME compliant email system

n

n Follow current standards regarding S/MIME, X.509 v3 Follow current standards regarding S/MIME, X.509 v3 and LDAP v3

and LDAP v3

COTS or open source products only

(4)

Scope

Public Network Desktop PC Desktop PC LDAP Server

with User Entries & Certificates Internal LDAP Proxy S/MIME Compliant Email Server External LDAP Proxy Organization 1 Intranet Organization 2 Intranet Exchange Server Messaging Backbone Services Network Firewall Network Firewall

Normal Message Route Normal Message Route

LDAP Server or Proxy

Request to LDAP proxy with recipient's address

x509 v3 Public Key

Challenge Boundary

(5)

Deliverables

n

Toolkit

n

n PKI OverviewPKI Overview

n

n Certificate practices, guidelines and recommendationsCertificate practices, guidelines and recommendations

n

n Lessons LearnedLessons Learned

n

n Example architecturesExample architectures

n

Comprehensive testing results

n

Peer reviewed report of findings and

recommendations

(6)

Jan Feb Dec Nov Oct Sep Jul

Reporting and Demonstration Testing and Validation

Initial Architecture Scope

Recruiting

Mar Apr

2001 2002

EMA Challenge Timeline

(7)

Lynx Systems

–

_–

Lotus Notes and

_{Lotus Notes and}

Microsoft Exchange

n

n Test Solution A: Test Solution A:

Server:

Server: Lotus Notes 5.0.8Lotus Notes 5.0.8 Client:

Client: Lotus Notes 5.0.8Lotus Notes 5.0.8 LDAP:

LDAP: Lotus Notes 5.0.8Lotus Notes 5.0.8

n

n Test Solution B:Test Solution B:

Server:

Server: Microsoft Exchange 2000Microsoft Exchange 2000 Client:

Client: Microsoft Outlook 2000 SR1 and Security PatchMicrosoft Outlook 2000 SR1 and Security Patch LDAP: Linux with Open LDAP

LDAP: Linux with Open LDAP

n

n PKIPKI

Self

Self-Signed Root Certificate Authority on -Signed Root Certificate Authority on

Microsoft Windows 2000 CA Server, Standalone Microsoft Windows 2000 CA Server, Standalone

(8)

DMZ B Linux Server + Open LDAP Firewall Internet Intranet MS Windows 2000 PKI Notebook Work Station Notebook Mobile User Email Server Exchange Email Server Lotus Notes DMZ A Firewall

(9)

Boeing Demo Environment

n

Messaging Environment

n

n Server:Server: Microsoft Exchange 2000, and Key Microsoft Exchange 2000, and Key Management Server

Management Server

n

n Client:Client: Outlook 2000 SP2Outlook 2000 SP2

n

Directory Environment

n

n Windows 2000 Active DirectoryWindows 2000 Active Directory

n

PKI Environment

n

n Boeing SelfBoeing Self--signed Rootsigned Root

n

n Microsoft Windows 2000 Standalone Subordinate CA Microsoft Windows 2000 Standalone Subordinate CA Server

Server

n

LDAP presence

–

Internal and External LDAP

Proxy Servers

n

(10)

Boeing Demo Environment

Internet Microsoft Windows 2000 Test Standalone Subordinate Certificate Authority Microsoft Windows 2000 Active Directory Microsoft Exchange 2000 Key Management Server

Microsoft Exchange 2000 Boeing Test Self-Sign Root

Certificate Authority

External LDAP Proxy Maxware Virtual Directory

Internal LDAP Proxy Maxware Virtual Directory Firewall Workstation With Microsoft Outlook 2000 SP2

(11)

SMTP/Vendor Certificate

Architecture

n

Messaging Environment

n

n Server:Server: SendmailSendmail 8.11.0 and POP3 daemon on Linux8.11.0 and POP3 daemon on Linux

n

n Client:Client: Outlook 2000 SP2Outlook 2000 SP2

n

Directory Environment

n

n Directory.Directory.verisignverisign.com .com –– Directory server for Directory server for VerisignVerisign issued certificates

issued certificates

n

PKI Environment

n

(12)

SMTP/Vendor Certificate

Architecture

Internet Linux with Sendmail 8.11 & POP3 daemon Workstation with

Microsoft Outlook 2000 SP2

Purchased user certificates from

(13)

Demonstration

n

Scenario 1

–

Boeing Exchange to Lynx Exchange

n

n Directory lookupDirectory lookup

n

n Send/Receive encrypted messageSend/Receive encrypted message

n

Scenario 2

–

Lynx Notes to

Smtptestbed

.com

n

Scenario 3

–

Smtptestbed

.com to Boeing Exchange

n

Scenario 4

–

Lynx Exchange to Lynx Notes

n

(14)

Demonstration Environment

DMZ B Linux Server + Open LDAP Internet Intranet MS Windows 2000 PKI Notebook Notebook Mobile User Email Server Exchange Email Server Lotus Notes

DMZ A

Firewall

Linux with Sendmail 8.11 & POP3 Daemon Workstation with

Microsoft

Outlook 2000 SP2 Purchased user certificatescan be found at directory.verisign.com

Microsoft Windows 2000 Test Standalone Subordinate

Certificate Authority Microsoft Windows 2000 Active Directory Microsoft Exchange 2000 Key Management Server

Microsoft Exchange 2000 Boeing Test Self-Sign Root

Certificate Authority

External LDAP Proxy Maxware Virtual Directory

Internal LDAP Proxy Maxware Virtual Directory Firewall Workstation With Microsoft Outlook 2000 SP2 Boeing Test Environment