Scenario:
Students have been tasked with collaborating as a team to design, document, build and test a reliable and secure document storage and transmission system.
Algonquin Bank has requested that the system is capable of authenticating and storing confidential banking documents such as payroll and deposit files it receives from its clients. The bank requires a high degree of assurance that the documents it receives from its customers have not been tampered with and originate from trusted sources. The
client for its part, needs the assurance that it is uploading documents to a trusted web server.
 
Objective:
Our objective is to design, build, and test a secure document storage and transmission system that meets a set of specific requirements. The system must use approved NIST algorithms and implement the system components illustrated in the Topology Diagram and described in the System Components Overview. Throughout the document's lifecycle, it must safeguard confidentiality, integrity, and authenticity while ensuring non-repudiation with the digital signature applied to the document.
There are specific requirements for document transmission, creation, reception, and storage that we must meet. The transmission of the document from the client's web browser to the bank's web server must use HTTPS with the client browser having fully authenticated the bank's web server against a trusted root CA. We must use asymmetric encryption for symmetric key negotiation that implements forward secrecy, approved NIST algorithm, and key sizes. The web browser must report/display that the connection to the web server is secure.
For document creation, the client must digitally sign documents with the bank's CA issued certificates. We must ensure that the web server correctly handles documents signed with expired, revoked, and certificates not issued by the bank's CA. When receiving documents, the web server must verify the signature of the documents it receives. The upload script must verify the document signature, validate that the signer's certificate is issued by the trusted bank's CA, verify the signer's certificate validity, and verify that the signer's certificate is not revoked.
For document storage, the document must be digitally signed by the client for non-repudiation purposes. The signing key must have a certificate issued by the bank's trusted root CA and be authorized for performing signing operations. The digital signature must remain with the document throughout the document's lifecycle whether in transit or at rest. Whenever the file is opened on the client or server, its digital signature must be verified. We also need to propose a cloud server solution that stores the documents encrypted, and we want to encrypt/MAC the files to add that extra layer of protection.
We will use a PKI system where the bank is the Certificate Authority under which it issues the user signing and web server certificates. Certificates must be created with the proper key usage extensions, and different signing certificates are issued by the bank's CA: valid, revoked, and expired. We also need to include a certificate not issued by the bank's CA. The client's web browser must include the bank's CA in its list of Trusted Root Certification Authorities. Finally, we will use different OS for the client, web server, and PKI components.
Topology:
Deliverables:
The project deliverables consist of two main components. Firstly, a fully tested and compliant system that is in working order, and secondly, a comprehensive test plan that outlines a set of test cases. These cases describe the details on how to verify compliance with the documented requirements. The system will be demonstrated to showcase its functionality, ensuring it meets all necessary standards. The test plan is designed to provide a clear and detailed outline for testing the system, ensuring its compliance with the requirements is thoroughly verified.
Results/Proof:
1. Test Case id: Web Server, Client and PKI server are on separate systems.
Web server ifconfig:
Client ipconfig:
PKI ipconfig:
2. Test Case id: Signer Certificate addition to script verification.
3. Test Case id: Trusted Certificate Anchor from step 2’s command is the Bank’s CA confirmation.
PKI server fingerprint:
Web server fingerprint:
 
4. Test Case id: Hash/Signing algorithms approved by NIST.
Certificate proving SHA256 implimentation.
NIST standard:
 
5 – 9. Test Case id: Submit signed documents for each of the user certificate test cases from the client and confirm the results are as expected.
5. Document signed with valid certificate Issued by Bank PKI:
6. Document signed with revoked certificate Issued by Bank PKI:
 
7. Document signed with expired certificate Issued by Bank PKI:
8. Document signed with certificate issued from non-bank trusted issuer:
 
9. Document signature tampered:
10. Test Case id: PKI component is separate from Web Server and Client:
PKI ipconfig:
Web server ifconfig:
Client ipconfig:
11. Test Case id: CRL published location:
12. Test Case id: CRL issues a command that validates certificates against CRL published @ distribution point.
 
13. Test Case id: Confirm three user certificates were issued by Bank CA with proper extensions and distribution point.
Certification files show extensions and CRL distribution point. CN, O and OU attributes are assigned values:
Key usage extensions are correct:
14. Test Case id: Web server certificate verification.
The web server certificate issued by the Bank CA has the proper extensions and CRL distribution point:
15. Test Case id: Client is separate from PKI and Web server.
Client ipconfig:
PKI ipconfig:
Web server ifconfig:
16. Test Case id: Web server hostname validation:
17. Test Case id: Bank CA added to correct issuers:
18. Test Case id: Secure Data Transmission Uses NIST approved algorithms.
AES:
SHA:
19. Test Case id: TLS verification:
20. Test Case id: TLS testing.
TLS version expected by the server:
TLS version not expected by the server:
Conclusion:
In conclusion, we have successfully designed, built, and tested a secure document storage and transmission system that meets a specific set of requirements. Our system uses approved NIST algorithms, asymmetric encryption for symmetric key negotiation, and a PKI system where the bank is the Certificate Authority. The system components have been illustrated in the Topology Diagram and described in the System Components Overview. We have ensured confidentiality, integrity, and authenticity throughout the document's lifecycle and added non-repudiation with the digital signature applied to the document. We have also taken into account different operating systems for the client, web server, and PKI components.
One potential enhancement or addition to the current data storage solution could be implementing a redundant cloud server storage system for securely storing documents. This system would include encryption of the data and utilize MAC (Message Authentication Code) to provide an additional layer of protection.