Massimo Villari Setting up a security infrastructure at

Massimo Villari Setting up a security infrastructure at the University of Messina: practice and experience Prof. Ing. Massimo Villari Center On information Technologies Development and Their Applications mvillari@unime. it

Massimo Villari Outline • • • Research at UNIME Campus in numbers. Added services with smart card The key role of smartcard Services to cope: Network Infrastructure and Applications Conclusions mvillari@unime. it

Massimo Villari Research at Uni. Me Mobile Distributed Systems a research group next Engineering Faculty at Uni. ME • Mobile, wireless • Grid • Security • Performance evaluation • …. . A research center for innovations and their applications to academy, SME and industrial world. mvillari@unime. it

Massimo Villari Uni. Me in numbers • • • 38. 000 students 2000 employers 1600 teachers 57 departments 11 faculties mvillari@unime. it

Massimo Villari Services with added value at Uni. Me • web‐based (e‐mail, on‐line registration of his/her examinations, chat, forum, faq etc. ). Many web transactions are carried up through https, a secure protocol with mutual‐authentication. This method prevents the phishing phenomena inside the campus. • ad hoc java‐based application specifically developed for students and University employers, in order to supply secure communication: cryptography of e‐mail messages and documents, e‐mail signed in agreement with Italian national directives from CNIPA. These applications guarantee an improvement of all the administrative processes. • user interface for GRID infrastructure; through the strong identification, the user has a transparent access to distributed computing and storage resource. • consolidate service available even at home; the users can consult electronic books, journal, papers, and newspapers along with VPN ipsec. mvillari@unime. it

Massimo Villari Services with added value at Uni. Me • Wired/Wireless access mechanisms to gain access to our 802. 1 x compliant network infrastructure. The environment developed permits to know where the guest is and what is its mac_address, its ip_address and physical lease based on switch port and radio signal AP. Data access log are stored to prevent any fraudulent use of resources. • The use of new technology is widely available thanks to the deployment of Totem and pc‐rooms equipped with all the necessary software and hardware equipments. This guarantees a widespread involvement of students, even belonging to Humanistic Faculties. • real‐time exams recording without any kind of papery document. • Smart Card used as creditcard in shops and public services (all over Italy), or through ATM money dispensers. Furthermore, through the Smart Card our students can access their University data (passed exams, CV, University info, …) thorough more than 5000 ATM machines all over Italy, belonging to the Uni. Credit‐Capitalia group mvillari@unime. it

Massimo Villari The key role of the smartcard: Uni. Me Card BANK SPONSOR: Banco di Sicilia CHIP CARD 32 K of Memory Person Identifier Official Campus recognizing document Asimmetric Key lenght 2048 bit mvillari@unime. it

Massimo Villari The key role of the smartcard: Multifunctionality card Magnetic strip Backside Bank Agreement (creditcard – ATM) As BADGE Employers check‐in/out Three different bands As BADGE Refectory services mvillari@unime. it

Massimo Villari The value of the integration The services are aimed to: Bank Print services Shops Restaurant Copy Office Bars City facilities (Wi. Fi, transport ) …. . Applications Exporting Strong Digital Identity Network access Campus mvillari@unime. it

SCIENZE MM. FF. NN INGEGNERIA FARMACIA LETTERE E FIL VETERINARIA Massimo Villari VILLA PACE 18 KM CIRCA SCIENZE FORMAZIONE SCIENZE STATISTICHE ECONOMIA GIURISPRUDENZA SCIENZE POLITICHE POLICLINOCO UNIVERSITARIO mvillari@unime. it

Massimo Villari Distributed Campus: physical and logical mapping mvillari@unime. it

Massimo Villari Security Infrastructure: Strong and weak Authentication mvillari@unime. it

Massimo Villari Network Infrastructure Is the communication network for data and voice. able to connect each pole as a large campus. Compound by two main parts: • Metropolitan Campus Backbone • MPLS, • Hyper. Lan, • Wi. Fi bridge • Virtual Channels by ISP • LANs interconnection for users, Servers, devices etc. • Network Access Servers (Switch, APs…. ) mvillari@unime. it

Massimo Villari From the devices representation towards poles logical view mvillari@unime. it

Massimo Villari The architecture is composed by • Certification Authority, (Online and Offline). • Radius Servers. • LDAP in Master/slave configuration • DHCP. • NAS (Network Access Server) 802. 1 x with Vlan features • Administration Web Server binding with databases (DB). • Open. CA • Free. Radius Servers. • Open. LDAP • DHCP linux based (binding with LDAP). • NAS (Network Access Server) 802. 1 x with Vlan features • LAMP (Linux, Apache, My. Sql, PHP) As much as possible using Open. Source Software mvillari@unime. it

Massimo Villari The System Managing Control Access and Monitoring Facilities for system administration It verifies the user credential: and monitoring Access rules and user profiles A WWeb portal useful for: are stored into LDAP Master • user profiles to(Students, and distributed LDAP Slave Professors, Employers, devices manages access )Itindetified Users…are by the Digital Identity: • Definition of default profiling Authentication to the. Strong physical • digital • Import of data usercertificate resources (Smart Card, • Monitoring X 509 v 3 of data log • 802. 1 x standard Crypto Token, file) (wireless/wired access, Servers position • Radius ) • Weak Authentication • Login and password mvillari@unime. it

Massimo Villari Managing and Monitoring System The System is aware of Who does what and where mvillari@unime. it

Massimo Villari Data distribution: The paradigm to reduce the faults mvillari@unime. it

Massimo Villari Certification Authority and Digital Identity based on PKI and certificate X 509 v 3 User Information on the Certificate ●First and Last Name ●Codice. Fiscale ●Text ●Contacts(@-mail, . . . ) LDAP Database maintains all information and rules of all users mvillari@unime. it D B

Massimo Villari Application Services related to Digital Identity • Encrypted e‐mail exchanged between students, professors and employers • Publishing of user data on LDAP servers • Muthual authentication with certificate X 509 v 3 • Single Sign On mvillari@unime. it

Massimo Villari Application developed to encourage the use of secure technologies To enable TOTEM and Pc rooms SSO interface LDAP MAIL PIN CODE The System stores login and password on database for each user. The application retrieves login and password encrypted with smartcard. This model is applicable to any type of external services as Google, Yahoo, Jabber that needs weak authentication mvillari@unime. it

Massimo Villari Application developed to encourage the use of secure technologies: Java application PIN interface MAIL reader interface • Sign email • Verify email signed • Cript email (file) • Decrypt email (file) LDAP interface In developing Applet version mvillari@unime. it

Massimo Villari Timeline of the work developed, in progress and designed. mvillari@unime. it

Massimo Villari In conclusion…. The architecture is strongly based on smartcard but: • smartcard: • represents a simple digital access key (a strong mechanism to bind user and ID) not a mandatory device for all the operations. • guarantees a soft migration towards a full system integration (Real Single Sign On) • has the validity of 5 years, to simplify its managment However the system can mantains both authentication methods: Strong and Weak. mvillari@unime. it

A question on wireless network access Massimo Villari An open issue • EDUROAM is working for inter‐operability between the campus networks. • In Italy there at least two main branches: • GARR is proposing his own solution • CRUI is thinking to go on its own way THANK YOU What is it the right approach/solution to adopt? mvillari@unime. it