Guralp Systems CD1.1 - Manual (Page 67)

Operator's Guide
10 Authentication Management
Both the subframe generator (gdi2cd11) and the sender (data-
out-cd11) support authenticated operation. In this mode of
operation, a hardware cryptography engine signs a hash of a
channel subframe or a CD1.1 frame and this signature is
appended to the data for transmission. A receiver can then
verify the signature against the engine's public key to ensure
the data originated on a specific digitiser.
Güralp currently support the Spyrus Lynks PCMCIA card as the
hardware cryptography engine.
10.1 Process Overview
To begin, the cryptographic engine is used to generate a
keypair. The private key is held in hardware and can never be
retrieved (i.e. it will never be visible in the filesystem of the
digitiser).
The public key is also held in hardware but can be retrieved at
will, and is used to make a certificate signing request (CSR).
The next step in the process is to generate a CSR, which is then
sent to the certificate authority (CA) to be signed, forming a
certificate.
The certificate can then be used by standard cryptographic
tools to verify data signed by the corresponding private key.
This process also yields an authentication key ID, which
identifies the private key used to sign a given frame or
subframe, and can be used to locate a corresponding
certificate.
Once a keypair has been generated, gdi2cd11 and data-out-
cd11 are signalled to sign subframes and frames using the
newly-generated private key and authentication key ID. This
signalling usually occurs after the corresponding certificate has
been installed in the receiver.
The digitiser provides both command line and web interface
tools to perform these tasks. The command line tools include a
wrapper script which automates the keypair generation and
activation aspects of the process, making unmanned station
operation possible.
June 2010 67