LWN Resources LWN Resources

Cyber COE Resources Cyber COE Resources

Additional Resources Additional Resources

iApp

The Intermediary Application (iApp) is a software-only solution that provides Army users the capability to plan crypto nets, securely manage and distribute key material/cryptographic products and interface with the Key Management Infrastructure (KMI) in support of KMI services. Authorized users and devices employ iApp to securely manage cryptographic material and obtain key products in support of mission requirements. Specifically, iApp provides enhanced Local Element (LE) management services by Key Management (KMI) Operating Accounts (KOAs) through controlled management and services including crypto product distribution planning, networked product retrieval by the LE, and the completion of mandated accounting processes and associated procedures. iApp provides mission support for a range of cryptographic products including cryptographic key, both symmetric and asymmetric, certificates, Certificate Revocation Lists (CRLs), etc. and supports both legacy devices and KMI-Aware devices. iApp does not perform Red (unencrypted) key processing.

iApp provides utilities/capabilities to augment and support the fully networked delivery of cryptographic products and services. The Army baseline implementation of iApp focuses on networked Encrypted Key Distribution (EKD) employed in a server client architecture where the KOA Manager (KOAM) posts encrypted products on a local server for retrieval and receipt by the LE (end user/consumer) via web browser to support subsequent delivery via fill device to the target ECU.

Optionally, on any authorized platform, iApp can be employed as a KMI-Aware device to support the download of Over-The-Network Keying (OTNK) packages directly from the KMI Storefront (KMI network infrastructure) by authorized users for subsequent lower-level delivery via fill device. iApp acting as a device can be registered within the KMI and possess an identity/certificate provisioned the KMI. Detailed planning via a Device Distribution Profile (DDP) by the KOAM or Product Manager is required to ensure availability of the key package at the KMI Storefront Product Availability List (PAL) for download by the KMI-Aware iApp. iApp receives the Cryptographic Messaging Syntax (CMS) wrapped packages and unwraps the packages to support/manage distribution.

iApp may also be employed as a Delivery Only Client (DOC) that facilitates a real time interface between authorized users, (KMI Operating Account Agents (KOAAs)), with connectivity to the KMI Storefront Product Delivery Enclave (PDE) for retrieval of product for KMI-Aware devices only. This implementation will have limited impact for legacy ECU operations but will expand as KMI-Aware devices proliferate. The KOAM plans the DDP, and the CMS wrapped packages are downloaded by the authorized recipient. This implementation negates the user requirement to directly receive product from the KOAM.