AR Internet Security Architecture
White Paper

 Copyright 1997 Algorithmic Research, Ltd. All rights reserved. US Distribution of RSA portion under OEM License Agreement with RSA Data Security, Inc. 

Notice

This document contains information that is proprietary to Algorithmic Research.  No part of this manual may be reproduced in any form whatsoever without prior written approval by Algorithmic Research Ltd.

Algorithmic Research  reserves the right to revise this publication and make any changes without obligation to notify any person of such revisions and changes.

For further information, contact Algorithmic Research at the addresses below, or contact your local distributor.
Trademarks
KeyMaster, PrivateWire, ARCryptoSafe, ARCryptoKit and  ARCryptoServer are trademarks of Algorithmic Research, Ltd. Other names are trademarks or registered trademarks of respective owners and are used solely for identification purposes. Export license required.

Algorithmic Research Ltd., 15 Gush Etzion Street, Givat Shmuel 54030, Israel, Tel. 972-3-5322799, Fax. 972-3-5322650
Algorithmic Research Pte. Ltd., RELC Building #18-30 EB, 30 Orange Grove Rd., Singapore 1025, Tel. 65-738-0958, Fax. 65-735-5601
AR Datensicherungssysteme GmbH, Waldstrasse 92, D-63128 Dietzenbach, Germany Tel. 49-6074-85806, Fax. 49-6074-858608
Algorithmic Research Ltd., 4 Simon Campion Court, High Street, Epping, CM164AU, England Tel. 44-0992-560333, Fax. 44-0992-578222
	AR-ISA: White Paper 6
Pub. Date 07.97
Pub. No. isa.wp.0797	

Contents

Introduction	
AR Internet Security Architecture (AR-ISA)	
The Internet: Opportunities and Risks	
Security Solutions	
AR-ISA Concepts	
Solutions and Applications	
Secure TCP/IP Communications	
Public Key Management	
Hardware Cryptographic Servers	
Application Security	
Secure Electronic Commerce.	
Who Can Benefit from AR-ISA ?	

Introduction
Algorithmic Research (AR) is one of the world’s leading providers of data security solutions.  AR has provided for over a decade the most advanced and comprehensive cryptographic solutions to its customers, fulfilling the security needs of large enterprises around the world, using an integrated suite of comprehensive cryptographic solutions. 
AR solutions were designed to provide not only the most advanced technology and highest level security, but to ensure the long-term viability of its solutions. This requires ability to provide a flexible and scaleable solution for critical applications. Organizations who deploy an AR security solution today, can easily expand and extend the solutions to adapt to future requirements. This flexible architecture ensures the investment in security is protected even when new emerging technologies and the development of new standards in the security arena require rapid changes.

AR is now bringing its expertise to the world of the Internet with a new series of state of the art security solutions. Covering the entire range of data security requirements, these products enable large organizations to adopt the Internet as a safe and dependable business tool. 
AR Internet Security Architecture (AR-ISA)
AR-ISA is AR’s modular approach to data security for the Internet. AR-ISA solutions are meant to allow organizations to securely use the Internet as a business tool. AR-ISA provides a set of products and solutions that can be used as building in building a security solution. These solutions can be deployed in an evolutionary manner within an overall security infrastructure. AR-ISA enables a step-by-step scaleable approach to the implementation of total integrated security in the organization. Security conscious organizations protecting their data with AR-ISA benefit from the most advanced technology, providing the highest level security and a modular cost-effective solution fitted to their needs. 
AR’s long-term experience and expertise in the implementation of large scale critical security projects, ensures solutions allow organizations to take full advantage of the potential of the Internet without incurring the risks involved.

This paper provides a brief overview of the security risks and requirements of organizations using the Internet and describes AR-ISA concepts and solutions. 

The Internet: Opportunities and Risks
The Internet offers tremendous advantages to the enterprise as well as private users: lower costs of communications (access is possible at cost of a local call to service provider) and world-wide accessibility allows organizations to use the Internet as a low-cost communication infrastructure. Access to huge amounts of information as well as to new customers and markets enables offering of new products and services. These and other advantages allow huge productivity gains to any organization. 

At the same time, the Internet has also created major security threats, multiplied by the sheer size of the network and the huge number of users. Since Internet use is not controlled, the enterprise network and system are essentially open and available to any Internet user. Information that is sent on public lines may be easily tapped, and pirate users may listen to or tamper with messages easily accessible anywhere on the network. 
These security threats are currently deterring many organizations from taking full advantage of the potential of the Internet. Security should therefore, not only be considered a necessity for organizations, but also an enabling technology which allows the implementation of improved services to clients and employees and provides opportunity for cost saving.

To answer the security requirements of large organizations, security solution providers must tackle a range of security requirements:
•	Authentication to check and verify the identities of users
•	Access control so that only authorized users can access approved resources
•	Secrecy/confidentiality of communications through encryption
•	Data integrity and non-repudiation of messages, enabling secure transactions, and to ensure the validity and authenticity of the message and originator.
However, in addition to the above requirements Internet security solutions pose critical administrative and implementation requirements in order to make such solutions viable to users. 
Solutions must be totally transparent, not affecting the users and applications. Ultimately, the security must be part of the networking infrastructure. 

Security solutions must be easily implemented and managed. The solution must be minimally affected by network configuration and platforms. Support for managing multi-site and multi-user environments must be provided. Full logging auditing facilities must provide security/system managers with the necessary alerts and reports to ensure the capability to monitor the security.

The solution must be scaleable, enabling the use and management of the security in large systems, with hundreds of thousands of users, within the most demanding applications. This requires the ability to provide easy migration solutions from small-scale applications to, industrial strength systems allowing for necessary performance and reliability. 

Solutions must provide highest levels of security not only in terms of the algorithms supported but also the design and implementation of the cryptographic protocols. Poor design and implementation of such solutions create easy opportunities for potential attackers. Hardware support as option for enhanced security both for users as well as host machines provides a necessary add-on for highly-sensitive applications.
Solutions must be standard-based to enable interoperability with other standard solutions, and avoid dependency on specific vendors. 
Most importantly security solutions must provide an answer to the present needs of users, but be flexible to be easily adapted to answer future needs and any technological changes. 

Flexible solutions must allow organizations to adapt and change the security and customize the solution to answer specific needs.  Modular solutions allow users to easily adapt and upgrade solutions as needs develop.

The above demands must all be answered within a single integrative framework that provides organizations the necessary tools, technologies and products that can be mixed and matched to the present needs, however ensuring new needs can be easily provided for.

Security Solutions
The need for data security has created a large number of security solutions from a variety of providers. However current security products are insufficient for most organizations, specifically those that require high level security.

In many cases, available products provide a partial answer to the demanding security requirements posed by the Internet.  Products attack a certain requirement but leave others unanswered, this requires organizations to take on several independent products to cover the security requirements. The result in a non-integrative approach,  making security a difficult and costly operation to manage and control.

In addition, many products are offered by vendors who are not security specialists. Security features are add-ons to the main-line products and not designed nor implemented by cryptographic experts As a result products are specific to a certain platform (such as hardware or software specific solutions) of the vendor and are therefore limited to these platforms and cannot inteoperate with other products. Lack of expertise result in low-level security, poor design and implementation failing to answer the demanding requirements of high-level security for the Internet.
 
The following examples provide a view of the limitations of certain technologies and the issues that arise when implementing these solutions:
•	Firewalls, provide the access control and protect the internal network of an organization, however firewalls do not cover confidentiality or data integrity using cryptography. Although access to information is controlled, the same information is sent non-encrypted over the Internet allowing any non-authorized user access. Firewall also limit the capability of an organization to provide secure access to authorized users and act as walls separating the organization from the external environment.
•	Secure Socket Layer (SSL) provides a specific solution for HTTP and WWW applications while totally ignoring other standard applications such as FTP, Telnet, or specific Client/Server applications. In this case organizations that implement various applications requiring security will need to apply a different solution for each application.
•	VPN solutions cover configurations of large organizations and their branches but usually lack a sufficient solution to answer the needs of stand-alone of users working from dial-in home PCs.
In most cases solutions are limited to software applications and do not provide enhanced security with hardware support.
It is therefore clear that an ideal solution must offer a combination of various technologies, tools and products to cover a full set of requirements, in addition to an integrative framework. This allows organizations to implement a totally secure and manage large-scale critical applications.

AR-ISA Concepts
AR addresses the issue of security for the Internet first in the form of a comprehensive strategic security infrastructure called AR-Internet Security Architecture (AR-ISA).

Within the AR architecture the Internet is viewed as an open, business environment for organizations and users. The need is to provide not only solutions which "separate" the organization from the external "threatening" network, but solutions that allow external users and customers to access the information in a secure manner.

The AR-ISA provides a combination of advanced technology, security solutions and products integrated together to allow secure use the Internet as a business tool, both for communications (as a communication infrastructure for the organization) and commercial purposes (such as electronic commerce). Solutions are designed and implemented based on AR’s extensive experience and expertise in providing solutions to large-scale critical applications. Commitment to offering the most advanced technologies combined with the highest level of security ensures long term viability of the AR solutions.

The added value of  AR-ISA as the strategic enterprise security infrastructure ensures that solutions are implemented as part of a general-purpose flexible and modular set of solutions. Both software and hardware solutions are seamlessly integrated, and ensure that a long-term security approach is provided. AR-ISA offers off-the-shelf solutions, as well as allowing organizations to custom tailor security in accordance to their specific requirements. 

Modular architecture provides the technological infrastructure and centralized security management capabilities. Organizations may choose solutions based on present needs, with the ability to answer additional requirements as they evolve. Past investments are preserved through the integration of the solutions within the architecture. Step-by-step implementation in building a total solution ensures the investment in security is gradual and protected.

The AR solutions are developed based on the security industry standards (e.g. X.509 certification, RSA, DES), ensuring interoperability with other systems complying with the relevant standards. The solutions are configured to be easily adaptable should new and superior standards and technologies emerge.

Hardware add-ons are a major part of this architecture as an optional solution. Users will be able to use secure hardware tokens such as smartcards and cryptographic processors within all the AR-ISA solution set. Hardware servers for hosts and large scale networks enhance security as well as performance. Hardware solutions as an optional add-on can be easily integrated within any application and by any user. Users may choose the amount of risk vs. investment undertaken according to each individual profile.

While other products are targeted to solve a specific aspect of security  they cannot be integrated into a single security system or interoperate with other products. AR-ISA uses of standard technologies and a common technological and system infrastructure that will ensure such integration is provided:
•	The technological infrastructure will be common within all the various applications. Similar algorithms and implementation of protocols is maintained over the various solutions and the same format (following standards when possible) is assured. In addition software and hardware media are supported in all applications and solutions transparently. The user has a single media for all applications accessible with a single password.
•	The system infrastructure will allow the organization to have a unified and integrated management and administration capability. Central management of public keys and Certification Authority allow a single centralized public key system for large-scale applications.	
At the same time such centralized management allows the organization to better secure the most sensitive information. Important information may be safely stored in a location and can be further protected by various sophisticated logical and physical protection devices.

The above architecture ensures several important advantages for the users:
•	Total Integrated Solution. AR provides organizations a complete set of solutions under a single framework.  This will enable the organization to select the required solutions according to present needs, and integrate future solutions  within the total architecture. The AR architecture provides a family of complementary products and services based on the same basic technology and architecture and will therefore integrate into the security infrastructure of the organization.
•	Flexibility. Solutions are designed to allow organizations to tailor the solution to fit within the specific needs of the organization if required.
•	Modular Implementation. Solutions may be used modularly, allowing organizations the choose the most cost-effective solution at each time while preserving the overall integrative architecture under which all products work.
•	Interoperability. Standard based solution ensure interoperability with 3rd party solutions where applicable (e.g., standard API’s, certificates).
•	Scalability. AR solutions offer organizations a fully scalable architecture from small-scale to full industrial-strength applications. Ability to centrally manage and control the security applications ensures system managers may easily monitor any suspicious activity even within complex and large configurations.
•	Investment Protection. Solutions may be gradually adopted and implemented on a mix-and-match basis and therefore no high up front investment is needed. Past investments are protected through the ability to integrate previous solutions and upgrade existing solutions.  
•	Transparent Security Infrastructure. AR solutions are built to provide a security infrastructure within all the organizational systems and platforms. Total transparency and highly-portable solutions ensure any application and platform can be secured. Users productivity is not affected. Application-specific considerations are not required. 
•	
Performance.  AR offers the most efficient implementation of cryptographic algorithms and protocols, ensuring high performance is maintained within the most demanding applications (e.g. 1024-bit RSA digital signature on a pentium PC in under 0.025 second).
•	Strongest Level of Security. AR's implementation ensures the highest level of security and most advanced technologies supporting full strength DES, Triple-DES and RSA (up to 1024-bit keys supported). Open architecture ensures new technologies are easily added. Optional hardware allows to enahnce any solutions
•	Security Expertise. AR is a leading provider of data security, employing several leading cryptographic experts. AR solutions have been implemented in hundreds of projects and critical applications. AR is committed to providing the solutions to its clients and responsible for the outcome of its solutions. AR has proven to be able to provide solutions both off-the-shelf and tailored to offer the highest level of security.

Solutions and Applications
AR-ISA consists of  a family of products and solutions which will encompass all the major application and communication security needs for the Internet environment. These products will seamlessly integrate within the total which provides the technological (e.g, algorithms, cryptographic protocols) and system (e.g., common public key database and centralized management) basis for the Internet security solutions.

Secure TCP/IP Communications	
This enables an organization to transparently secure all the TCP/IP communications between itself and other users/systems. 
The solution consists of a client and server application available with hardware or software. The solution provides complete security for all TCP/IP applications (e.g., WWW, FTP, Telnet, TCP/IP application) without requiring any application specific changes or updates. 
In addition the client application is integrated within the standard communication interface and is therefore available on any platform and can be used with any standard browser (Netscape, Microsoft, IBM) or TCP/IP application.

The solution provides both dynamic packet filtering and cryptographic session security. Therefore firewall capabilities can be enhanced through user authentication and encrypted communications, as well as specific application security, such as digital signatures on transactions. 
In this way organizations are able to provide secure services such as remote banking in a secure manner using the Internet as the communication medium. Authentication and encryption is transparently provided, and digital signatures on specific transactions easily implemented. 

Secure communications between servers may also enable to create a Virtual Private Network over the Internet.
Central management and control allows system managers to full monitor and track any sensitive or suspicious actions. This is possible from remote stations in a secure manner allowing the easy management of distributed systems.

Public Key Management 
Internet solutions are usually associated with large scale applications, these require ability to efficiently manage large scale public key databases. 

In order to support such systems and ensure the integrity of the system certification is an important part of the solution. AR also supplies the basis for creating a public-key infrastructure for organizations and trusted-third-party operations. This solution is based on the X.509 certification standard and provides a complete solution for certification and public key management. Hardware-based implementations ensure a high-level of security and integrity of the system. The solution allows complete flexibility enabling the implementation of specific policies. Support for various formats ensures interoperability with 3rd party solutions.

AR applications under the AR-ISA provide the necessary tools to access and use the CA system, and all applications support the required key and certification formats. 
Hardware Cryptographic Servers 
The use of open platforms in software and hardware expose users to various security attacks that may only be answered with hardware based security solutions that enhance the level of the security.
This family of solutions consists of  several products for end-users and host systems:

End-user solutions are either RSA-based smartcard and readers, intelligent smartcard readers or stand-alone processors. These solutions are meant to provide the highest levels of security unavailable within standard software solutions at very low costs.

For network environment where both security and performance are of an issue AR offers high-performance cryptographic servers, that are both physically and logically secured. These servers can be used for providing functionality for secure electronic commerce services and other business applications.

The AR hardware solutions can be integrated seamlessly within the applications based on the needs of the customer. Users may optionally adopt hardware without requiring changes in the application. This ensures a flexible and cost-effective solution, as well as the highest level of security. Future solutions will allow integration of new hardware and additional tokens in a transparent manner.
Application Security 
In order to enable organizations and 3rd party developers to take advantage of the AR technology and apply high level security for different types of applications tailored to specific requirements AR is providing a high-level cryptographic toolkit. This provides a high-level interface for solution providers that are not necessarily cryptographic experts, who can easily integrate the security features into applications. 
AR’s toolkit and API are fully compatible with other products within the AR architecture thus ensuring fully integrated solutions can be developed. 

AR products are developed with the toolkit serving as the basic technological basis for the AR-ISA. This enables easy changes to adapt solutions to new technologies without affecting applications. The common development platform also enables interoperability between AR products, such as sharing of passwords, user identification and keys. 
The AR toolkit supplies all the required functionality to implement security solutions of the highest level using standard tools and algorithms such as: DES, RSA, and support for X.509 certification. Support for the hardware add-ons provides a transparent layer for mixed hardware and software solutions. 

Within the toolkit environment AR also provides high-level functions which implement more complex cryptographic protocols used in applications such as Secure E-Mail, EDI and Messaging. Standard protocols which AR can provide interfaces are: PGP, PEM, S/MIME. These higher level interfaces  allow solution providers to implement secure messaging solutions based on accepted industry standards.
Secure Electronic Commerce. 
Solutions for end-user and merchants based on the SET standard provide the most advanced technologies for electronic commerce over the Internet. The ability to use AR hardware add-ons supporting SET ensure an additional higher level of security can be achieved at an affordable cost to the end-users.
Who Can Benefit from AR-ISA ?
AR-ISA solutions allow organizations to fully benefit from the usage of the Internet while minimizing the risks incurred with such applications. Examples of organizations and applications industries that could benefit from implementing the AR-ISA solutions include:
•	Financial Institutions: Banks, which offer online banking to their clients. Stock exchanges, brokers, and investment firms that allow their members to remotely view information and trade securely. 
•	Government and Health Authorities: Health and local authorities that transfer sensitive data between offices or to citizens.  Emergency services, such as the police department, which communicate between various stations and a central office.
•	Internet Commerce: Corporations, whose business depends on commerce over the Internet, will need to protect their applications against unauthorized entry, data integrity and confidentiality.   
•	
Multiple Location Organizations (with national or international Scope): Retail chains offering electronic POS (Point Of Sale) data collation, inventory control, mail or any other communication links to their branches. Multi-national corporations with a wide geographical spread wishing to exchange data between their offices. Insurance companies offering agents access to their centralized quoting system. Legal institutions wising to securely exchange business agreements and contracts and confirm their integrity.
•	Telecommuting: (Organizations With Mobile or Remote Users) - Corporations, high technology companies, and consulting firms will require a constant communication link to support employees visiting on-site installations. Traveling executives and sales staff may need to make inquiries, request authorizations, and receive and send information.
•	Manufacturing: Manufacturers wishing to establish secure data transfer with their suppliers for inventory control, ordering new materials and general data transfer.