Dartmouth computer scientists to help develop a more secure Internet

Posted 10/11/00

The Dartmouth computing community will play a role in making the Internet more secure, reliable and easier to use through a new project sponsored by the Internet2 consortium.

Dartmouth, along with the University of Wisconsin-Madison, has been named by Internet2 as one of only two sites to host a Public Key Infrastructure (PKI) Lab. Internet2 is a group of more than 170 U.S. universities working in partnership with industry and the government to advance the capabilities of the Internet for research and higher education. Initial funding for the project will come from AT&T.

Public-key cryptography is a system for protecting electronically transmitted data. In traditional cryptography, the "keys" used to encode and decode a message are the same. However, in public-key cryptography, the codes are different on each end, creating a more sophisticated and flexible system for sharing information. These two codes, together described as a "key pair," include a private key that only the owner knows, as well as a public key for use by people sending information to or receiving information from that person.

E-commerce already makes wide use of public keys to encrypt credit card numbers and other sensitive data. The keys can also be used to affix an electronic "signature" to a document, thus making it possible for the receiver to verify its origin and integrity. This use of public keys could make electronic transmission of contracts and other legal documents more typical in the future.

Although public keys are already in use, protocols and standards governing their use are lacking, said Sean Smith, Assistant Professor in the Computer Science Department.

For example, there are currently several different entities that distribute public keys for different purposes. One of the puzzles to be worked through is who should be allowed to certify key pairs and what that certification will mean.

"The basic components of PKI exist, but the broader infrastructure is still missing–and this infrastructure is critical to securing our transactions in the internetworked communities of today and tomorrow," said Smith.

Once developed and tested, a PKI system could allow business customers to better control access to information and services over the Internet. Furthermore, these shared components would be more reliable, scalable and secure.

Dartmouth's Institute for Security Technology Studies (ISTS), which includes network security issues as part of its research agenda, will work closely with the PKI lab.

"We're excited about the forthcoming PKI Lab work," said David Nicol, Professor and Chair of the Department of Computer Science and Technical Coordinator of the cybersecurity program at ISTS. "It synergistically brings together ISTS, the Computer Science Department and the Computing Services group. We'll be focusing on problems that arise when it's necessary to share identity and authorization information over the Internet."

Since the advent of the World Wide Web, browsing software such as Netscape Navigator and Microsoft's Internet Explorer has become an almost universal means of accessing electronic services. However, current browsers don't take full advantage of PKI's potential to authenticate and secure information. Smith and his collaborators hope to create a browser that will not only make better use of PKI technology so Web transactions are safer, but will be user friendly as well.

With society moving toward an era of ubiquitous computing, personal information increasingly will be available from a wide variety of locations. However, the relative security of transmitting information varies from computer to computer, since different security techniques might be in place. PKI technology could make it possible to create "intelligent" applications that evaluate the relative security of a particular machine and allow access to information accordingly. For example, while a physician might have full access to his medical records from his office computer, he might only have partial access to information from a less secure machine on the network.

The work done in the PKI Lab also will include study of the legal and ethical ramifications of public keys, especially with regard to privacy, and development of technology that can protect against insider attack. For example, police and other law enforcement officials could at times require access to public keys when they're investigating illegal activity. However, much like telephone wiretapping, this sort of access needs to be closely regulated so it is not abused, said Smith.

"Any such system needs to balance the needs of law enforcement against constitutional rights; acceptable systems must be secure against law breakers on both sides of the law," he said.

Dartmouth was selected as a PKI site for a number of reasons, Smith believes. First, the College already has a history of successfully developing computer services for a networked environment. Also, as a highly wired campus, the Dartmouth community provides a manageably sized real-world environment in which to implement and test new projects.

Dartmouth's PKI lab

Internet2