HP 5120 EI Series, Руководство по настройке

Страница: 199 / 304

189

VPN
A virtual private network (VPN) is a private data communication network built on the public
communication infrastructure. A VPN can leverage network layer security protocols—for example, IPsec—
in conjunction with PKI-based encryption and digital signature technologies for confidentiality.

Secure email
Emails require confidentiality, integrity, authentication, and non-repudiation. PKI can address these needs.
The secure email protocol that is developing rapidly is Secure/Multipurpose Internet Mail Extensions
(S/MIME), which is based on PKI and allows for transfer of encrypted mails with signature.

Web security
For web security, two peers can establish an SSL connection first for transparent and secure
communications at the application layer. With PKI, SSL enables encrypted communications between a
browser and a server. Both of the communication parties can verify each other’s identity through digital
certificates.
How does PKI work
In a PKI-enabled network, an entity can request a local certificate from the CA and the device can check
the validity of certificates. Here is how it works:
1.
An entity submits a certificate request to the RA.
2.
The RA reviews the identity of the entity and then sends the identity information and the public key
with a digital signature to the CA.
3.
The CA verifies the digital signature, approves the application, and issues a certificate.
4.
The RA receives the certificate from the CA, sends it to the LDAP server to provide directory
navigation service, and notifies the entity that the certificate is successfully issued.
5.
The entity retrieves the certificate. With the certificate, the entity can communicate with other entities
safely through encryption and digital signature.
6.
The entity makes a request to the CA when it needs to revoke its certificate, and the CA approves
the request, updates the CRLs and publishes the CRLs on the LDAP server.
PKI configuration task list
Complete the following tasks to configure PKI:
Task Remarks
Configuring an entity DN Required
Configuring a PKI domain Required
Submitting a PKI certificate request
Submitting a certificate request in
auto mode
Required
Use either approach
Submitting a certificate request in
manual mode
Retrieving a certificate manually Optional
Configuring PKI certificate verification Optional
Destroying a local RSA key pair Optional
Deleting a certificate Optional