PGP Use Cases The following section presents the set of use cases relevant to working within a PGP ecosystem of products. Registration of a new Managed User This use case covers the registration of an internal user, that is one managed by the enterprise and whose key should be actively managed and maintained by the key management system. Description / User Story Khaled works with his company-issued MacBook Pro laptop every day for email, web surfing and other activities. His company decides to begin securing their email with PGP keys. to Khaled about how to download and install Khaled’s company’s IT staff sends out directions software on to his laptop to meet this requirement. Khaled follows the IT the software and installing it. Upon first staff’s instructions, downloading running the software, he is prompted to enter his company credentials. The software, in conjunction with the KMIP server, verifies those credentials and then issues Khaled a PGP key. That key is escrowed on the server and the private portion is held on the client as well. Khaled almost never manages this key directly; he just realizes his email is now being secured at certain times by various notifications he gets as he uses his normal email program. Goal or Desired Outcome A key must be created for Khaled containing his proper credentials (email addresses, user names, photo, etc.). The key must be signed by the correct organization key. The key must be stored on both the server and the client, both public and private portions, such that they may be used by both server and client for encryption and signing. Environment Categories Covered: Applicable Deployment and Service Models: Desktop-based enrollment On premises Actors: Systems: Khaled a normal knowledge Client Software Management Server a – – worker with little to no server that administrators use to establish the cryptographic experience security policy for the Client Software. (This server could be, and often is, the same as the Client Software software – KMIP server below.) designed to integrate with laptop / desktop endpoints and provide KMIP Server a server managing the key – security for email messages material for an enterprise Directory server Active Directory or another –
PGP Use Cases The following section presents the set of use cases relevant to working within a PGP ecosystem of products. Registration of a new Managed User This use case covers the registration of an internal user, that is one managed by the enterprise and whose key should be actively managed and maintained by the key management system. Description / User Story Khaled works with his company-issued MacBook Pro laptop every day for email, web surfing and other activities. His company decides to begin securing their email with PGP keys. Khaled’s company’s IT staff sends out directions to Khaled about how to download and install software on to his laptop to meet this requirement. Khaled follows the IT staff’s instructions, downloading the software and installing it. Upon first running the software, he is prompted to enter his company credentials. The software, in conjunction with the KMIP server, verifies those credentials and then issues Khaled a PGP key. That key is escrowed on the server and the private portion is held on the client as well. Khaled almost never manages this key directly; he just realizes his email is now being secured at certain times by various notifications he gets as he uses his normal email program. Goal or Desired Outcome A key must be created for Khaled containing his proper credentials (email addresses, user names, photo, etc.). The key must be signed by the correct organization key. The key must be stored on both the server and the client, both public and private portions, such that they may be used by both server and client for encryption and signing. Environment Categories Covered: Desktop-based enrollment Applicable Deployment and Service Models: On premises Actors: Khaled – a normal knowledge worker with little to no cryptographic experience Client Software – software designed to integrate with laptop / desktop endpoints and provide security for email messages Systems: Client Software Management Server – a server that administrators use to establish the security policy for the Client Software. (This server could be, and often is, the same as the KMIP server below.) KMIP Server – a server managing the key material for an enterprise Directory server – Active Directory or another
PGP-Use-Cases.docx