Вы находитесь на странице: 1из 12

Information Paper

How much do you pay for your


Understand the total
PKI solution?
cost of your
PKI solution A closer look into the real costs associated with
building and running your own Public Key
Infrastructure and 3SKey.

This study has been conducted in cooperation with SEALWeb, an independent and trusted
consultancy firm who has proven experience in managing PKI projects in the financial services
and other industry sectors. The case study figures are representative of the average time and
budget that customers of SEALWeb typically spend on PKI implementations.
Total Cost of
Ownership (TCO)

Understanding and
calculating all the
costs related to a
PKI solution

Contents
Introduction............................................ 3 Case studies : ....................................... 6

Public Key Infrastructure (PKI) - 1) Institution with small user base and
What is it and why?................................ 3 limited needs

Cost components of a PKI solution......... 4 2) Institution with medium-sized user base


Common implementation options and and regular needs
3SKey.................................................... 4 3) Institution with large user base and
1) Building and running an in-house extended needs
PKI-infrastructure Conclusion........................................... 10
2) Using a third party PKI provider And you? How much do you pay
3) Using 3SKey for your PKI solution?........................... 10

2
Introduction a financial institution with limited needs Certificates are associated with identities,
up to a large organisation with extended for example with the name of a person or
In the world of electronic banking, proof requirements. a function within the organisation. This is
of identity is often very complex, involving the role of the Registration Authority, also
numerous tokens, passwords and access known as RA. The RA is responsible for
cards for a single transaction. The use Public Key Infrastructure the registration and controlling the identity
of Public Key Infrastructure (PKI) and (PKI) - What is it and why? of its users. Therefore, they will apply their
adoption of electronic signatures are now Know Your Customer policies (KYC) and
considered best-in-class for securing What is PKI?
A Public Key Infrastructure or PKI is a security processes prior to linking the
banking communications. PKI enables identity of the user with a certificate. Users
both financial institutions and their system for the creation, storage and
distribution of digital certificates. PKIs sign their financial instructions, such as a
customers to ensure that instructions are payment by using their private key. The
authentic, unaltered and legally binding. allow organisations and their customers
to verify the authenticity of financial financial institution verifies the signature
Implementing a cutting edge PKI messages they receive. When transferring by using the associated certificate and will
infrastructure is costly and often complex a financial message, the sender has a check the validity of this certificate with
to build and maintain. It requires for you not private encrypted key that needs to match the CA (e.g. whether the certificate has
only to invest in the infrastructure and build the recipient’s public key. Only when the been revoked).
expertise but also to permanently upgrade two match can the recipient verify that the Why use PKI?
the changing technology and evolve with message is authentic (Fig. 1). There are three main advantages and
new security threats. Therefore, enabling differentiators of using a PKI solution over
strong authentication and digital signatures To implement this solution, an individual
generates a private (secret) key locally, any other electronic identity means:
with your customers is not only a question
of ‘keys’ and ‘tokens’. which will be used as a credential for Checking the authenticity of
1. 
signing purposes. For security purposes, the sender: Authentication means
Most ‘financial’ decisions for a PKI such credentials are often stored on verifying the identity of the person
solution are based on a comparison of the external devices, such as USB tokens who sent and signed the data and
most obvious costs, therefore overlooking or smartcards. A public key is created being sure that they are the person
the hidden, and often more expensive and linked to the individual’s private key who they say they are. PKI facilitates
costs. by a trusted party, also known as the remote authentication between
TCO or Total Cost of Ownership allows Certification Authority or CA. The public parties, assuring the receiving entity
you to understand and calculate all the key is used to authenticate the individual. that the information originated from
costs related to a product or service. It Each key is a unique string of numbers. the sender who owns and has
includes not only the direct and most The CA can revoke a specific certificate; protected access to his or her private
visible costs of a solution, but also unveils for instance, if its lifetime has expired or if key.
the often hidden indirect costs for building there is concern with the certificate, such
and maintaining the solution. In the as theft of an associated private key that
world of PKI, the TCO includes the more has been reported.
visible charges such as infrastructure
investments, cost of developing the
applications, product licenses, installation
and training, etc… and the often hidden
recurring charges to run and maintain the
service. The latter is not always easy to
identify and not obvious to calculate. Sender Receiver
SWIFT, together with SEALWeb,
conducted a study comparing the
costs for a financial institution to build
and maintain a proprietary PKI with the
costs of implementing 3SKey. The study
revealed that institutions could reduce
their cost up to 40% when using 3SKey. Encode using Decode using
This information paper describes the Private key of sender Public key of sender
drivers to use PKI solutions, breaks
down the different cost components to
build and maintain such infrastructure,
describes the implementation options for
an organisation and reviews all the costs
in three typical scenarios. This starts with (Fig. 1) Basics of a PKI solution

3
Controlling the integrity of the
2.  Common implementation and the existence of an internal security
signed information: Integrity options and 3SKey framework that can be reused.
means ensuring that data cannot
be corrupted or modified, i.e. a Institutions planning to implement or
Bank User
transaction can therefore not be replace a PKI solution have different
altered. With PKI, the content of the options available. Each of the
exchanged data is guaranteed by implementation strategies have different
its electronic signature. If the data costs and benefits and the decision will
CA RA
is modified afterwards, then the likely be driven by factors such as:
signature will no longer be valid. — Number of users CA =Certification
CA= Authority RA
CertificationAuthority RA== Registration
Registration Authority
Authority

Proof of sender: Non repudiation


3.  — Budget allocation
— Need for tailored interfaces and (Fig. 3) In-house PKI
means ensuring that an action cannot
be denied after a given event. With workflows or standard PKI services
— In-house knowledge and expertise The institution manages the acquisition
PKI, the receiver can prove that the of the required hardware and software
data could only have been signed by of PKI
— Customer support needs components to enable the generation
the owner of the private key. This is of digital certificates. Digital signatures
becoming increasingly important for — Secure premises
— Need for multi-bank acceptance and authentication mechanisms need
audit and legal purposes. to be integrated in internal applications.
— Vendor integration of your security
solution A regular audit of the infrastructure has
to be conducted by the organisation
Cost components of a PKI itself. Also, internal and external support
solution Therefore, an institution will have to make has to be planned to assist users with
It is mostly easy to identify the direct costs a choice between using a third party PKI the installation and use of the digital
such as expenses related to software, provider to delegate the certification of certificates, help application software
licenses, hardware, etc… to build and the users, build and run an in-house PKI vendors during the integration, and
run a PKI solution. However, these are infrastructure or use 3SKey. support internal development teams.
only part of the Total Cost of Ownership This choice is often the most expensive
or TCO. To build and maintain a PKI Building and running an in-house implementation option and can only be
solution, there are many different cost PKI-infrastructure selected when a large volume of users
components to consider. If an institution chooses to build and use the PKI solution and the institution
The diagram below (Fig. 2) provides manage its PKI solution itself, it controls has a proven experience with security
an overview of the typical investments the full PKI architecture. The solution can infrastructures and PKI.
needed to run a successful PKI project. be customised to the specific business
Each of the components represents an needs including the identification of an
appropriate security device for its users. Using a third party PKI provider
initial investment to build the solution Instead of building its own solution, an
and later a recurring annual running or The choice to build an in-house system
depends on multiple factors such as institution can also go for a ‘Managed
maintenance cost. PKI’, outsourcing to a specialised PKI
the experience of the organisation with
PKI, the number of customers to serve service provider. In such a scenario, the
technology and infrastructure will be
managed and hosted by a trusted third
party. The PKI provider will certify the end-
Building Costs + Recurring Costs users prior to issuing the digital certificates
towards the customer. The trusted PKI
provider will usually already have in place
PKI Infrastructure + Certificate Management +
a regular audit of the technology and
Project Management

infrastructure.
User Support + Vendor Applications Integration +
Bank
Web Channels Integration + Host Channels Integration +
User
Tokens + Logistics & Distribution +
PKI Service Provider
Product Documentation + Contractual Agreements +
Multi-Bank Acceptance + Audit + RA CA
CA= Certification Authority RA= Registration Authority
CA = Certification Authority RA = Registration Authority
= Total Cost Ownership
(Fig. 4) PKI Service Provider
4
(Fig. 2) Cost components of a PKI service
The institution needs to select the third Each financial institution will register its To ease and speed-up the integration
party according to its business needs, users independently by applying their of 3SKey for financial institutions, their
the size of its customer base and also own registration and KYC procedures, customers and within third party financial
geographical scope. They will typically and subsequently associate the identity of applications software, 3SKey has
pay a one-time and recurring license fee the user with the 3SKey certificates. For been built using common and widely
for the use of the PKI infrastructure and financial institutions it offers a service that used industry standards (e.g. RSA
also a one-time and recurring fee per responds to their customer demand for 2048 keys, X.509 digital certificates,
user. The digital certificates will need to a multi-bank solution. Thanks to a multi- …). Also, integration toolkits and APIs
be integrated in the proprietary products registration model, financial institutions are are made available to ease the project
and solutions of the institution, often not dependant on each other for checking implementation. SWIFT provides ongoing
with the assistance of the selected third the user identity. Moreover, 3SKey support to financial institutions and the
party. The level of possible adaptation significantly reduces the investments and vendor community during the integration
and customisation is mostly limited. The running expenses to manage an in-house and use of the service, and also provides
technical support for basic user queries PKI infrastructure or contracting with a end-user assistance for the installation
will be handled by the organisation itself third party PKI provider. and activation of the 3SKey digital
whilst the more complex problems will be certificates.
escalated to the PKI provider. User Implementing 3SKey will allow
On top of this, regardless of whether Bank Bank organisations to offer a multi-bank solution
a third party or an in-house solution is to the user, whilst reducing TCO by using
used, other cost elements should not be a cost-effective infrastructure operated by
overseen. These include amongst others SWIFT, a trusted and neutral party.
project management, the organisation RA RA
of regular audits, setup multi-bank CA Comparing the needs and benefits of
acceptance when required, monitor
different PKI implementation options
threats and technology evolution and CACA=
= Certification Authority RA
CertificationAuthority RA==Registration
RegistrationAuthority
Authority
The table below summarises the benefits
migration to a new security infrastructure
of each PKI implementation strategy and
(on average every five years). (Fig. 5) 3SKey how the needs are addressed with each
option (Fig. 6).
Using 3SKey Financial institutions pay a one-time
Instead of building its own PKI or and annual service fee for using the
relying on a third party PKI provider, 3SKey service within their banking group
financial institutions can now also take regardless of the number of users,
advantage of the 3SKey service. 3SKey channels and countries where they use
was designed to respond to a growing the 3SKey certificates. This makes 3SKey
demand from financial institutions and a very flexible and scalable solution,
their corporate clients for an international suitable for small, medium-sized and large
and interoperable digital identity solution. organisations.
With 3SKey, SWIFT takes away the
burden for a financial institution to develop
and maintain the technical infrastructure
PKI
and issues digital certificates, whilst Benefit /Needs In-house 3SKey
Provider
for their customers it allows them to
manage the users and tokens by using Outsource infrastructure
a secured web portal. This model offers
users a single certificate solution, which
Multi-bank acceptance
they can use with many different financial
institutions and over any channel.
Large geographical coverage

Savings in technology renewal

Customisation of interfaces/workflows

Cost-effective scalability

(Fig. 6) PKI Implementation comparison

5
Case Studies: Comparing (Annual service
Cost to build Price
the costs of a common PKI
implementation and 3SKey the PKI + of tokens + running costs)
x 3 years
TCO* =
In order to conduct this study, typical Number of digital
scenarios have been identified. These (*) Cost per user on a 3-year basis certificates
different scenarios address the most
commonly used models of PKI in a variety — Cost to build the PKI = all investments and expenses associated to buy,
of financial institutions. The following develop and build the infrastructure and solution
variables were used to define the different — Price of tokens = the unit price paid for the tokens and associated services
case studies. — Annual service running costs = all recurring and maintenance fees associated
with running and supporting the service
— Using a third party PKI versus building
— Three years = the typical life cycle of a digital certificate and hardware security
an in-house PKI infrastructure
device before it must be renewed
— Size of the institution in terms of
— Number of digital certificates = the institution’s number of users equipped
number of users
with a digital certificate
— Limited usage versus adoption of PKI
across all platforms (Fig. 7) Total Cost of Ownership (TCO) formula
— Need for multi-bank acceptance
— Number of user applications requiring For each case study, the average To calculate the Total Cost of Ownership
integration time and budget spent for all the cost (TCO) of a self-managed PKI solution and
components to build and run the service compare with the costs of the 3SKey
Three main scenarios have been chosen (as described in the section Cost service, the formula in Fig. 7 was used
to compare typical configurations in components of a PKI infrastructure) were providing a total cost per user.
financial institutions. In the respective case calculated based on experience and real
studies, the building and running costs costs of PKI implementation projects of a
The following section presents the three
were compared with 3SKey (Fig. 8). similar nature.
selected cases studies, a quantification
The cost for a similar implementation of all the cost components and a
with 3SKey was then calculated taking comparison of the TCO per user with
into account the service and token fees, 3SKey.
as well as the project and running costs
for the components still managed by the
institution itself.

1. Institution with small user base 2. Institution with medium user base 3. Institution with large user base
and limited needs and regular needs and extended needs

— PKI outsourced to a third party — PKI outsourced to a third party — In-house PKI infrastructure
— 1K - 10K users — 10K - 50K users — 20K - 100K users
— File signing only — File signing and web-banking — File signing and web-banking
— No need for multi-bank acceptance — Limited multi-bank acceptance — Multi-bank acceptance
— 5 vendor applications — 10 vendor applications — 10 vendor applications

(Fig. 8) Three case studies

6
Case Study 1 – Institution
small user base and TCO per user (3 year basis)
limited needs
This scenario looks at an institution with 400 €

a small user base ranging between 1,000


and 10,000 users that has limited needs 356 € -30%
300 €
and outsources the solution to a PKI
service provider. The organisation uses
digital certificates only for its application- 256 €
200 €
to-application file exchanges, no web
banking integration is necessary. Also,  ost of annual service
C
the organisation has no need for multi- 100 €
running
acceptance of its digital certificates with  ost of initial service building
C
other financial institutions. and integration

The organisation has limited or no 0€ Price of token


experience with PKI. The PKI is designed, Bank PKI 3SKey
built and hosted by the PKI service solution solution
provider in its secured data centre and
there is limited interface customisation
to avoid costly development. Also, the (Fig. 10) 30% cost savings for institution with small user base and limited needs
tokens are chosen and qualified by the
service provider. In this scenario, the cost The user registration is performed face-to- The result of the analysis demonstrates
of the tokens represents only 6% of the face at the local branches. The technical that with 3SKey the TCO per user over
total costs (Fig. 9) aspects for registering the users are three years can be reduced by 30%
performed by registration operators in compared with a third party PKI service
3-year TCO the central back-office; with an average provider (Fig. 10). This represents
Cost component
per user of one operator available for 1,000 users. potential savings ranging from 200K EUR
The helpdesk tools are limited and the first to 700K EUR depending on the number
Annual maintenance
69% line support for users is performed by the of users. On top of the cost savings, this
and support
institution itself, whereas more complex kind of institution will also minimise its
Initial build and and technical cases are escalated to the project risks, have a transparent view
25% PKI service provider. on the total project budget and benefit
integration
from additional services at no extra cost.
The customer base in this scenario
Examples are multi-bank acceptance,
Token 6% uses on average five common financial
assured 3SKey support with a growing
software applications. The institution
number of financial application vendors
ensures optimal integration of its digital
(Fig. 9) Cost break-down using a third and a possible leverage of the 3SKey
certificates with the vendors of these
party with 3,000 users and digital certificates for on-line web banking
applications, a set of APIs are made
limited needs services.
available by the PKI service provider.
Typically the effort to support integration
with five vendors is estimated to be 30
man-days (3-year basis).
The institution does not subscribe to an
insurance plan for its PKI. The PKI service
provider is audited once a year, therefore
the institution will rely on the audit controls
of its PKI provider.

7
Case Study 2 – Institution with
medium-sized user base and
regular needs TCO per user (3 year basis)

This scenario reviews an institution with a 200 €

medium-sized user base ranging between -25%


10,000 and 50,000 users. It has regular 197 €
150 €
needs and already uses a PKI solution
outsourced to a PKI service provider. 144 €
The organisation uses digital certificates 100 €
for authentication and digital signatures
on its bank web portal, as well as for its  ost of annual service
C
application-to-application file exchanges. 50 € running
The organisation requires its digital Cost of initial service building
certificates to be accepted by two other and integration
0€ Price of token
financial institutions. Typically the effort for
Bank PKI 3SKey
multi-bank acceptance is estimated to be solution solution
30 man-days per additional bank (3-year
basis).
The institution already uses PKI and
therefore has acquired experience with (Fig. 12) 2
 5% cost savings for institution with medium-sized user base and regular needs
such technology. The PKI is designed, built
and hosted by the PKI service provider in The initial registration of the company The result of the analysis demonstrates
its secured data centre. In this scenario, administrator is performed face-to-face that with 3SKey, the TCO per user over
the institution has customised the PKI at the local branches; afterwards the three years can be reduced by 25%
interfaces to let customers manage their company administrator registers and compared with a third party PKI service
own company administrators and users. manages their users. The technical aspects provider (Fig. 12). This represents
Also, workflows are developed to automate for registering the users are performed potential savings ranging from 700K EUR
the issuance of new certificates and the by registration operators located at each to 1,800K EUR depending on the number
renewal process. The tokens are chosen of the 20 regional back offices of the of users. On top of the cost savings,
and qualified by the service provider. institution. Helpdesk tools are developed to institutions with multi-bank acceptance
In this scenario, the cost of the tokens ease user deployment and limit calls to the requirements will benefit from extended
represents only 9% of the total costs support centre. First line support for users interoperability with more financial
(Fig. 11). is performed by the institution itself, more institutions as 3SKey is being further
complex and technical cases are escalated adopted in all markets. They will also take
3-year TCO to the PKI service provider. advantage of keeping the solution up-to-
Cost component
per user
date as technology evolves and they do
The customer base in this scenario uses
not have to manage the integration and
Annual maintenance on average 10 common financial software
74% evolution with existing and new financial
and support applications. The institution ensures
application software vendors.
optimal integration of its digital certificates
Initial build and with the vendors of these applications, a
17%
integration set of APIs are made available by the PKI
service provider.
Token 9% The institution does not subscribe to an
insurance plan for its PKI. The PKI service
(Fig. 11) Cost break-down using a third provider is audited once a year, therefore
party with 15,000 users and the institution will rely on the audit controls
regular needs of its PKI provider.

8
Case Study 3 – Institution
with large user base and TCO per user (3 year basis)
extended needs 250 €
This scenario analyses an institution
200 €
with a large user base ranging between
20,000 and 100,000 users, who has 209 € -40%
150 €
extended needs and runs an in-house
100 €
PKI infrastructure. The organisation uses
PKI authentication and digital signatures 50 € 129 €
on its web banking portal and also for its
application-to-application file exchanges. 0€ Cost of annual service running
The organisation requires its digital Cost of initial service building
and integration
certificates to be accepted by five other Price of token
financial institutions.
Bank PKI 3SKey
The institution has decided to create an solution solution
in-house PKI and design and host it in its
secured data centre. The organisation has
already very good expertise on PKI and an
experienced team in such technology. The (Fig. 14) 40% cost savings for institution with large user base and extended needs
physical data centre and logical security
frameworks are not specific for this project
The initial registration of the company In this case, the institution subscribes
but shared with other existing critical bank
administrator is performed face-to- to an insurance plan for its PKI. The PKI
infrastructures. They buy and configure
face at the local branches; afterwards platform is audited by an external auditor
the necessary software and hardware
the company administrator registers once a year.
themselves. The tokens are chosen by the
and manages their users. Five CA
institution itself and are already supported The result of the analysis demonstrates
administrators are trained to maintain and
by the PKI software. In this scenario, the that with 3SKey, the TCO per user
monitor the solution and 30 registration
cost of the tokens represents only 7% of over three years can be reduced by
operators manage the end-users.
the total costs (Fig. 13). 40% compared with an in-house PKI
Helpdesk tools are developed and the
infrastructure deployment (Fig. 14). This
existing customers’ portal is adapted to
3-year TCO represents potential savings ranging from
Cost component support the deployment of PKI certificates
per user 2,200K EUR to 4,600K EUR depending
with its customers. All user support is
on the number of users. As the number
Annual maintenance performed by the institution itself, only
77% of users grow in such a scenario, the cost
and support complex issues are submitted to the PKI
benefits of using 3SKey increases further
software editor for resolution. Typically the
for the financial institution. On top of the
Initial build and customer support costs represent 30%
16% cost savings, an organisation avoids
integration of the annual running costs of the PKI
auditing its PKI infrastructure on a regular
service.
basis and limits the recurring investments
Token 7% The customer base in this scenario uses linked with technology renewals as
on average 10 common financial software security paradigms change.
(Fig. 13) Cost break-down using an in- applications. The institution ensures
house PKI with 30,000 users optimal integration of its digital certificates
and extended needs with the vendors of these applications. A
set of APIs developed by the PKI software
vendor and configured for the institution’s
specific PKI are made available to the
vendors.

9
Conclusion – Outsource On top of the financial savings, 3SKey will
infrastructure, reduce costs and provide you with additional competitive
keep control with 3SKey advantages, including:

Implementing a PKI solution is indeed not — Response to a growing demand from


only a question of ‘keys’ and ‘tokens’. your customers for a single solution for
Many of the running and maintenance all their banking transactions
costs are not immediately visible when — Out-of-the-box multi-bank acceptance
comparing different solutions. That’s why — Retain control of the identity and KYC
a Total Cost of Ownership (TCO) review of your customers
helps you to make a complete assessment — No need to rely on identity
of the real costs whether you are a small, management or PKI of other
medium-sized or large organisation with institutions
specific requirements. — No complex contracts between
financial institutions
Taking into account all cost components
to build and maintain the service, 3SKey
proves to be a cost-effective alternative
TCO per user (3 year basis)
to replace traditional and expensive PKI
implementations (Fig. 15). -30%
If you are an institution with less than € 356
10,000 users and limited needs, the total
cost per user could easily go down by 30% € 256 -25% -40%
when implementing 3SKey. Additionally,
€ 197 € 209
3SKey will offer a scalable solution without
extra investments as the size of your € 144
€ 129
institution increases, the user base grows
or you plan to expand the use of digital
certificates to other channels such as on-
Institution with small user Institution with medium-sized Institution with large user
line banking services. base and limited needs user base andregular needs base and extended needs

If you are an organisation with up to


50,000 users and regular needs, the Bank PKI
savings with 3SKey are at least 25%. With 3SKey
3SKey, you will also benefit from a solution
which evolves as new technologies
become available or new security threats
are identified. Moreover, SWIFT works (Fig. 15) 3SKey enables cost savings between 25% and 40% for your institution
together with the industry to ensure
smooth integration in the most commonly
used financial software applications used
by you and your customers. The use of
industry standards facilitates customisation
and integration with your applications.
And you? How much do you pay for your
If you are an institution with many users PKI solution?
and tailored needs, you could even reduce
your costs by 40%. As your customer
base grows, so will the average cost per Get started now with 3SKey.
user be further reduced. By using 3SKey,
you benefit from a proven and trusted PKI If you are interested in knowing more about this cost study or you would like to tailor
infrastructure powered by SWIFT, saving the analysis for your specific organisation and business needs, please contact your
you from having to invest in and maintain SWIFT representative or send us an e-mail
your own identity management technology. to 3skey@swift.com.

10
For more information about 3SKey
visit www.3skey.com

Legal Notices
S.W.I.F.T. SCRL (“SWIFT”),
Avenue Adèle 1, 1310 La Hulpe, Belgium. RPM Nivelles – VAT BE 0413330856
Copyright
SWIFT © 2012. All rights reserved.
You may copy this publication within your organisation. Any such copy must include these legal notices.
Disclaimer
This publication is for general guidance only. The information in it is therefore general, and should not be considered or relied on as
definitive advice. The information in this publication may also change from time to time. Please always refer to the latest available
version on www.swift.com.
Trademarks
SWIFT is the tradename of S.W.I.F.T. SCRL. The following are registered trademarks of SWIFT: SWIFT, the SWIFT logo, the
Standards Forum logo, 3SKey, Innotribe, Sibos, SWIFTNet, SWIFTReady, and Accord. Other product, service or company names
mentioned in this publication are trade names, trademarks, or registered trademarks of their respective owners.
56183 - SEP2012

SWIFT © 2012

Вам также может понравиться