Modelling a PKI-based network system using multi-agents systems engineering

In the current networked world, it is clear that security has become a "sine qua non" condition for several public and private commercial, administrative and technical activities carried out by means of network applications. Recent developments have made it possible to interoperate complex business applications at much lower costs. To stay competitive in this scenario, it is crucial for organizations to have the flexibility to changing security factors, such as authentication, authorization, access control, new technologies, and cost of policy deployment. Such information security changes often encourage the creation of new security schemas or security improvements. Accommodating frequent systems information changes requires a PKI-based network security system be more flexible than currently prevalent systems. Consequently, there has recently been an increasing interest in flexible PKI-based network security and policy deployment systems. This article deals with the deployment of a secure IT infrastructure on a company-wide basis. This means to be able to provide secure PKI-based network services to the users, independent of their physical location: on-site (via LAN) or off-site (via WAN or an external ISP). The security solution is based on the usage of X.509 certificates to perform authentication both of the users and the network's nodes/services. The corresponding private key can be stored either on a smart-card (for mobile users) or on a secure workstation (for users that always access the services from the same workstation). The system will support security at two main levels: application-level, via SSL channels or S/MIME messages, and network level, via IPsec. Moreover, the infrastructure is conceived with flexibility as a primary goal.