Defense hones Novell ID management

The Defense Department's Washington Headquarters Services is rolling out an authentication service on its network that meets the requirements for new standard federal ID cards.Novell Certificate Login was developed with DOD's help in order to use Common Access Cards in a way that complies with Homeland Security Presidential Directive 12. It allows a single smart card to be used to access resources on a variety of platforms across the network.Novell Inc. of Waltham, Mass., was originally developing the software under contract as a DOD-specific tool, but along the way the project grew and HSPD-12 changed the federal identity management landscape.'The original concept for that software was a different product called Card-Based Network Logon,' said Carl Vercio, security IT director for Washington Headquarters Services.WHS is a field agency that has been split out of the Office of the Secretary of Defense, supporting the Pentagon and other Washington-area facilities.'DOD doesn't want to do software development,' preferring to buy off-the-shelf products, Vercio said. 'When they said they wanted to develop a COTS product, we said, 'How soon?' 'The result was NCL 2.0, which is being implemented on 15,000 seats in conjunction with a major network migration of the WHS and OSD backbones.Novell began work on the Card-Based Network Logon program in late 2003. The goal was not to build a new product from scratch, but to create a solution from existing technology components in the Novell identity management suite. Those components were:'We already had the basis of the product,' said Alan Kraft, Novell vice president of federal sales. 'The hard part was the methodology,' which would allow it to integrate with existing DOD networks without upgrading or replacing elements.'It was 90 percent a matter of taking working code and bringing it together,' said Ivan Hurtt, Novell's director of federal solutions product management. 'We removed some of the complexity of the product and simplified it to get the functionality we were looking for.'By mid-2004 the first version of Certificate Login had been cobbled together.'We found there were some deficiencies,' Kraft said. 'They said what we needed was a COTS product.'Work began on a streamlined commercial version of the new tool that would more smoothly integrate its components, with help from DOD.'They came out to our Provo facility and helped us build this product,' Kraft said.The DOD goal was a tool that would work smoothly across multiple platforms.'The Microsoft solution for smart-card sign-on can be made to work, but then you are tied to a strictly Microsoft network,' Vercio said.Although DOD is largely standardized on Microsoft, there remain islands of Unix and Macintosh.'You're never going to get your graphics guys to give up their Macs,' Vercio said. 'So the Microsoft solution does not solve the problem. You can't be tied to one vendor.'While the development work was going on, President Bush released HSPD-12, creating a new set of requirements for federal authentication. HSPD-12 requires development of a single set of standards for a new card that will go to all federal employees and contractors. The card will be used for access to physical facilities and selected IT systems. Agencies will continue to issue their own ID cards, but interoperability would mean that one card could be accepted across multiple agencies.The new standards will be embodied in a new Federal Information Processing Standard, to be finalized by the end of this year.Agencies must have programs in place to bring their IDs into conformance with FIPS-201 within four months of the standard's approval.Applications to be protected by the card must be identified within six months of the standard's approval, and those applications must be in compliance with the standard two months after that.DOD announced it would make its Common Access Card, the government's most widely deployed smart card, comply with HSPD-12. This led to a new round of tweaks in the Novell Certificate Login.'We took something that was unique and made it interoperable with other people's environments,' Hurtt said.Certificate Login uses digital certificates housed on smart cards with public-key infrastructures to authenticate network users and authorize access to resources.'We can handle any PKI,' said Kraft. 'We can support any kind of certificate server.'Along with software, Novell is also providing consulting services for federal customers to help them meet the HSPD-12 deadlines.WHS began the implementation of the original version of Certificate Login on its network early this year.'I use it myself every morning to log in,' Vercio said.Then Novell announced that its commercial release would be available in June 2005.'We asked ourselves if we wanted to continue to implement this, or put a hold on it and use the commercial product when it comes out,' Vercio said. 'Our network is a little older and you have to go around and touch every workstation' when implementing software such as this. 'Nobody wants to touch every workstation and then do it again two months later. We put the project on hold and decided to wait for the commercial product.'WHS and the OSD enterprise network control center are migrating to Windows 2003. Certificate Login is being installed along with the new operating system.'I got converted yesterday, and it works very well,' Vercio said. 'We hope to have it done by the end of October.'