Overview Configuration Feature Operation System

'KSignPKI (Public Key Infrastructure) is a critical security foundation that provides trusted user authentication service to enable safe data transaction on the Internet through confirming identity between sender and receiver 'KSignPKI' constructs X.509v3 based certificate administration system.



As a PKI solution, 'KSignPKI (Public Key Infrastructure) provides trusted user authentication service to enable safe data transaction on the Internet through authenticating identities between sender and receiver.
KSignPKI is a user authentication system that uses PKI cryptography to transform user's handwriting signature or seal into electronic format of digital signature.
Users of 'KSignPKI' will be provided with various security essential components(e.g authentication, confidentiality, integrity, non-repudiation, access control) that are strongly requested for Internet security.It is obvious that if any application services on Internet cannot provide absolutely secure and trusted environment for users, such application service will experience difficulties to lively develop or distribute over the World Wide Web.
'KSignPKI' will be the best suit to establish firm trusted security fundamentals for Internet application services.
'KSignPKI' enables safe data transactions with firm trust between service users and content providers and it is already in use for Internet Banking, groupware, digital payment, issue various types of digital certificate, online shopping, digital payment system, etc.




KSignPKI Components
CA (Certification Authority)
RA (Registration Authority)
Directory Server (Storage)
CGI Prog : (Proceeds users request through web)
OCSP (Online Certificate Status Protocol)
KRA (Key Recovery Authority)

The components of 'KSignPKI' can be independently constructed to deploy unique security system for the special need or requirement.


(1) KSignPKI CA / KSignPKI CA Admin :  The system to issue and administrate digital certificate.
Support various PKI algorithm: RSA, KCDSA, ECDSA, etc
Support digital signature, key distribution, S/MIME, SSL, VPL, and Issue X.509v3 certificate,
Support administrative functions: reissue, update, revoke, suspend and recover X.509v3 certificate
Support interoperation between CAs (Cross-Certification, Certificate Trust List, etc)
Support setup management according to certificate profile policies defined at RFC2459/3280

(2) KSignPKI RA / KSignPKI RA Admin / KSignPKI LRA : The system to register and administrate user information.
Register and administrate subscriber information
Prevent threats of alteration/forgery/deletion of RA system
Approve issuance of certificate after verifying subscriber's identity by interviewing them in face to face.
Provide 'Role Based Access Control' for RA administrators
Support digital certificate based 'Two-Factor Authentication' to authenticate RA administrators

(3) KSignPKI KGS
: the system to generate keys for CA system administrator and certificate request form
CA system and administrator key generation, and certificate request form generation system
Generate digital signature key pair: RSA, ECDSA, KCDSA, etc
Generate certificate issuance request form: PKCS#10, RFC2511
Setup policies for generate key pair and certificate issuance request form
Provide 'Role Based Access Control' by policy manager, generation manager and audit manager
Support 'Two-Factor Authentication' to authenticate key generation system administrator

(4) KSignPKI CIS : the smartcard issuance system

Setup smartcard's map
Setup or modify smartcard's PIN value
View or modify data stored in smartcard
Unlock smartcard

(5) KSignPKI OCSP : Online Certificate Status Protocol
Support both CA dependent type/independent type OCSP
Can be configured with OCSP server/ OCSP Client/ OCSP Admin
Real-time certificate status verification (RFC2560)

(6) KSignPKI TSA : Time Stamp System
Issue time stamp token
Handle time stamp confirmation request
Support time stamp server administration module
Support administration on data of issued time stamp token
Provide security and signature libraries

(7) KSignPKI Client

Support End to End(E2E) security communication channel using PKCS#7, SSL, etc
Support RFC2510 CMP protocol to issue and administrate certificate
Support various types of private key and certificate storage format (PKCS#12) to
accommodate mobility and flexibility
Able of choosing various of storage types (HDD, Floppy Diskette, Smart Card, USB Key, etc)
Support digital signature algorithms confirm to PKCS#1 : RSA, ECDSA, KCDSA, etc



(1) Ensure international product interoperability
Provide global security service with ensuring international product interoperability
Support IETF, ISO, PKCS Series and other major international standards
Passed NIST Interoperability Test to ensure interoperability with overseas CA solution or CA service

(2) Trust and Reliability
Satisfied all 273 security essential subjects of Public Licensed CA under Digital Signature Act of Korea

(3) Easy of applying into various applications services and E-Commerce
Able to add certification service onto web, mail, EDI, XML, VPN and wireless Internet
security products.
Provide sufficient development environment for users through supporting various
domestic/international security algorithm and APIs

(4) Support effective certificate verification mechanism
Support selective certificate verification mechanism for corresponding service environment and purpose
Support CRL(Certificate Revocation List) verification mechanism
Provide various and distinctive certificate verification mechanism such as CRL DP, Delta CRL, etc

(5) Easy of use for CA service administrative function and enhanced security
Provide easy interface to facilitate administrator to manage user and certificate information
Support role based access control for administrator by using hardware tokens such as smartcard, USB key, etc

(6) Variability and mobility of user information management
Provide mobility and security through supporting various types of storage methods
(smartcard, USB key, HDD, floppy diskette, etc)

KSignPKI IN USE

'KSignPKI' is deployed in five Korean Public Licensed CAs Korea Electronic Certification Authority, National Computerization Agency, Korea Financial Telecommunications & Clearings Institute, Korea Securities Computer Corp and Korea Information Certificate Authority, and successfully operating and providing trusted and reliable security for these CAs.
KSIGN is the leader of PKI solution provider for government, military, educational institutions, public institutions to construct CAs since 'KSignPKI' is also deployed in Headquarter of Korean Army, National Pension EDI, Korean Telecom, Korea Power Exchange, Ministry of Finance and Economy, Ulsan University, Supreme Public Prosecutor's Office and other more.
PKI security based certification service has large application areas where verifying user identity means the critical importance such as in Internet banking, online stock trading, enterprise groupware, eCommerce, digital payment, ticket reservation, and various certification issuances.
'KSignPKI' is capable of interoperating with the Data Validation and Certificate Server (DVCS), Key Management Infrastructure(KMI), Extranet Access Management(EAM), PKI-based Conditional Access System(CAS), Data Encryption Solution(SWAT), Application Security Toolkit (KSignCASE) and other several PKI products.



Server
  - Operating System: Minimum Sun Solaris 2.5/2.6
- System: Minimum Ultra10 (Recommended)
- Memory: Minimum 512 MB (Recommended)
- HDD: Minimum 20M (Requested)
- Smart card reader and smart card: CA server use
Client
  - Operating System: MS Windows9X/NT/2000
- System: Minimum Intel Pentium 200MHz (Recommended)
- Memory: Minimum 32 MB (Recommended)
- HDD: Minimum 10MB
- Video: Minimum SVGA (Recommended)
- Smart card reader and smart card: for PC
Installation Requirement
  - Following software must be installed in advance before installing KSignWPKI 2.0
- WEB Server: Apache web server 1.2/1.3
- Netscape browser: Minimum 4.6/4.7
- Directory Server: Netscape directroy server or Aphlion directory server
- Data Base: Minimum Oracle 8.1.6




Untitled Document