What is PKI?
Public Key Infrastructure (PKI) is a combination of software, encryption technologies, and services, which enables enterprises to protect the security of their communications and business transactions on the Internet.

PKIs integrate digital certificates, public key cryptography, and certificate authorities into a total enterprise-wide network security architecture. A typical enterprises’ PKI encompasses the issuance of digital certificates to individual users and servers, end-user enrollment software; integration with corporate certificate directories; tools for managing, renewing and revoking certificates; and related services and support.

How it all works?
The PKI uses asymmetric algorithm and requires two different keys. A party may have two keys, one for encryption and another for decryption. He can make one key publicly available, which can be used by the customer, the supplier or anyone, for the purpose of encrypting a sensitive communication to be sent to him or her. Therefore, it is called the public key. Once such encrypted message is received from outside, the person can use his second key called the private key for decrypting the message. The second key is kept under security.

The PKI can operate on a number of algorithms of which RSA is popular. However, only the person holding the corresponding key can decrypt the encrypted message by using a public key. This is so because the two keys are mathematically inter-related. Here, the level of security also depends on the length of the key.

Why is PKI needed?
PKI protects your information assets in several essential ways:

l Authenticate identity: Digital certificates issued as part of your PKI allow individual users, organizations, and web site operators to confidently validate the identity of each party in an Internet transaction

l Verify integrity: A digital certificate ensures that the message or document the certificate ‘signs’ has not been changed or corrupted in transit online

l Ensure privacy: Digital certificates protect information from interception during Internet transmission

l Authorize access: PKI digital certificates replace easily guessed and frequently lost user IDs and passwords to streamline intranet log-in security and reduce the MIS overhead

l Authorize transactions: With PKI solutions, your enterprise can control access privileges for specified online transactions

l Support for non-repudiation: Digital certificates validate their users’ identities, making it nearly impossible to repudiate a digitally ‘signed’ transaction later, such as a purchase made on a website.

What does the PKI security solution comprises of?
PKI is a vital element of e-commerce, as it ensures the security of electronic transactions and the exchange of sensitive information between parties that do not have a prior established business relationship through digital certificates. As the stage is set for large scale PKI implementation in India, it is important to analyze what pportunities and challenges lie ahead for PKI solution providers, especially in the context of distribution of digital certificates.

A complete PKI security solution comprises the following components, elements and functions that are vital to achieve the final state of robust security.

l Security Policy: A security policy is essential, as it defines the organization’s direction on information security and the principles involved in cryptography.

l Certificate Authority: A Certificate Authority (CA) forms a very integral part of a PKI as it manages the entire life cycle for public certificates. Some of its functions are issuing certificates to the user and binding the user’s identity with a digital signature, time stamping the certificate with an expiry date, storing and retrieving certificates using a directory service, etc.

l Registration Authority: A registration authority performs a critical function and is dedicated to user registration and accepting requests for certificates. The RA can be a function of the CA or a separate identity.

l Applications: PKI-enabled applications include e-mail and messaging, Web browsers and servers, secure electronic transactions (SET), electronic data interchange (EDI), etc.

What can you do with a PKI?
A PKI lets your enterprise take advantage of the speed and immediacy of the Internet while protecting business-critical information from interception, tampering, and unauthorized access.

PKI provides the following capabilities:

l Communicate securely with employees around the world: PKI offers users controlled access to your Intranet for all your corporate information, such as HR data, secure e-mail, and applications

l Exchange confidential data with business partners: PKI lets you create secure extranets and virtual private networks that give selected partners easy access to business-critical information stored on your internal network

l Safely, seamlessly integrate your supply chain: PKI provides a protected environment for safe information exchange at every stage of your manufacturing processes

l Take advantage of secure e-commerce: PKI lets you offer customers the confidence to purchase your goods and services on the web

Swapan Johri, head (security) HCL Comnet