Public key infrastructure (PKI) supports the distribution and identification of public encryption keys, enabling users and systems to both securely exchange data over networks and verify the identity of the other party.
As tactical network cybersecurity becomes increasingly essential, PKI is gaining widespread acceptance across the Department of Defense as the best approach for keeping a tight lid on all forms of communication. PKI addresses multiple security concerns for tactical networks, including access control and technical nonrepudiation.
“PKI is today’s quintessential information assurance tool,” said retired Col Cedric Leighton, a former deputy director of training for the National Security Agency. “In the cyber age, with such a high risk of enemy hackers gaining access to sensitive tactical networks, it’s essential that the protections that PKI provides be put in place on all networks.”
PKI is making steady inroads throughout the DoD. As part of a cybersecurity review last summer, the Marine Corps directed its IT system administrators to immediately begin implementing PKI. Other service branches are also either deploying or planning to deploy PKI, often with an eye toward protecting highly vulnerable tactical networks.
A four-in-one solution
“The interesting thing about PKI is that it covers four different areas: authentication, data integrity, nonrepudiation and confidentiality,” said Bob Fedorchak, principal information security engineer supporting the Cyber Security and Information Assurance Division of the Army’s Communications-Electronics Research, Development and Engineering Center (CERDEC) Space and Terrestrial Communications Directorate. “There are [other] solutions that cover one or maybe two areas, but not all four at once.”
PKI can be an effective way to ensure that the right people and the right devices get access to essential data. Authentication often relies on usernames and passwords. Weak passwords, phishing, brute force attacks: Password systems can be exploited many ways.
“Humans are terrible at generating and remembering random stuff, and the strong crypto on PKI is virtually impossible to brute force,” said Isaac Potoczny-Jones, research lead, computer security, for Galois, a technology research and development consulting firm with an office in Arlington, Virginia. “On a scale from one to 10, PKI is a 10 for security and password is a two.”
The infrastructure is designed to facilitate authentication quickly, reliably and with a high degree of trustworthiness. “The challenge for a tactical network is that the identity and access management [IdAM] it uses may not be attached to authoritative data sources, so there has to be a mechanism to get that IdAM data to the network securely,” said Leighton. “It must also incorporate the latest updates and be able to send those out in even the most communications-austere environment.”
PKI authenticates a remote system to the end user via server certificates while the end user is being authenticated to the server with client certificates. “This authentication and all of the following transmissions are encrypted over an HTTPS connection, preventing unauthorized user access,” said Mike Babecki, a senior solutions engineer at Akamai Technologies, a cloud networking and security company located in Cambridge, Massachusetts.
When operating a secure tactical network, it’s important to have highly responsive and thorough alerting and review processes in place. A key PKI benefit is that it provides full accountability and ensures traceability of users, devices and actions via a detailed audit trail. “You can always know the date, time and the location of when and where a specific event took place,” said Karen Wendel, president and CEO of IdenTrust, a San Francisco company that offers trusted identity software and services. “It’s there for the viewing.”
A huge potential vulnerability
When properly deployed, PKI provides highly effective network identity and access management for a wide range of end users working in almost any location, under nearly any condition, on an array of fixed and mobile devices. “All reports I’ve seen indicate it’s very easy to use once it’s deployed,” said Leighton, who is currently chairman of Cedric Leighton International Strategies, a strategic risk and leadership management consulting firm. Leighton, however, is concerned that future cyber threats may target digital certificates, leveraging undiscovered vulnerabilities.
According to Leighton, PKI’s reliance on digital certificates — and the certification authorities of those certificates — makes the technology vulnerable to spoofing. “The DoD has basically based its entire communications infrastructure on these digital certificates,” Leighton said. “This is a huge potential vulnerability that we are only beginning to understand.”
Leighton noted that management deficiencies also threaten to hamper PKI deployment. “Logistical support has been a huge issue in the past,” he said, noting that there have been shortfalls in the accounting and distribution of the tokens, token readers and the middleware needed to make PKI function.
A technology drawback to PKI is its considerable overhead requirements, which can make its use on hastily strung together tactical networks problematic. “While there are clear security advantages to a PKI solution, it is resource intensive and consumes a significant amount of Web server CPU cycles,” Akamai Technologies’ Babecki said. “In order to not impact performance, especially during peak traffic times, additional infrastructure must be provisioned to support the extra load.”
PKI deployment plans will continue moving forward over the next several months, according to LTC Ward Roberts, product manager of Warfighter Information Network-Tactical (WIN-T) Increment 3.
“At the Network Integration Evaluation 16.2 in May, WIN-T Increment 3 will be demonstrating the first instantiation of the infrastructure,” he said. “[PKI] is going to exponentially grow, once this infrastructure comes in place at NIE 16.2.”
PKI is likely to become stronger and more usable over the next few years, Roberts predicted. “Companies are working on technologies to enhance the reliability of both the certificate and the certificate reader,” he said. “I think, near term, in the next couple of years, that is where the focus will be.” Such advancements will help further accelerate PKI use on all kinds of tactical networks.
CERDEC, meanwhile, is also working to advance PKI technology and best practices. “From the R&D side, we’re not only looking at the current technologies and helping programs of record try to figure out how to best utilize those, we’re also looking at ... trying to solve some of the gaps and capabilities that have already been identified,” Fedorchak said.
In the future, biometrics and other alternative IdAM technologies could arrive on tactical networks to augment or possibly replace PKI. “We could come up with new whiz-bang technology that makes PKI obsolete tomorrow,” Fedorchak said. “That’s part of what the whole [CERDEC] research and development research effort is for.”
Yet while rival security technologies will likely someday challenge PKI’s primacy on tactical networks, Roberts believes that PKI isn’t likely to go away anytime soon. “The basic public key infrastructure, where you have the private key and the public key and the controlled access and authentication of the user, that infrastructure is pretty consistent and I think it’s going to be there for a while,” he said.