Download - REFEDS. Rome, October 2009 Attribute space: LoAs, aggregation and reputation

REFEDS. Rome, October 2009

Attribute space: LoAs, aggregation and reputation


Setting the Landscape


LoLoAs (not an erratum)

• The LoA concept has originally been associated to quality of credentials Two-factor authentication vs username/password… SAML AuthN Context emphasized this NIST (and NIST-like) classifications did as well

• Attributes constitute the core of an identity• LoA on asserted attributes are key to take

informed decisions• And that brings us to different Levels of Levels of

Assurance


The Axes


Attribute Authorities• Entities providing additional attributes about users

Not available at their home IdP Mostly because of management reasons

• Key for the VO promise• Explosion of authoritative AttAuts is a concern• And they may pose additional privacy challenges• Several implementations currently available

VOMS (originally X.509-based, now with SAML gateway) SWITCH VO management system (Shib-based) FEIDE VO PoC (OAuth) RedIRIS AA (SAML-based) GN3 JRA3T2 (starting) …


Attribute Aggregators

• User-controlled sources of attributes• Collecting them from AttAuts• The SHINTAU project

Shib-based Demo available at

http://issrg-beta.cs.kent.ac.uk:8080/loademo.html• The Kantara UMA Working Group

Mostly influenced by the OAuth community Attribute access can be considered a particular case No implementation yet http://kantarainitiative.org/confluence/display/uma/


Reputation Systems

• AttAggs that offer additional interfaces to update attribute values

• Social trust and beliefs Social does not mean necessarily “massive”

• The next step in IdM?• Object of a work-item in TF-EMC2• Few (if any) implementations

The ARETUSA model for BitTorrent Plans to extend the RedIRIS AA


The Possible Next Steps

• Attribute source discovery Open AttAut, AttAgg, Reputation sources? Are they total or partial members of federations?

• Representation for attribute sources and LoAs Meta-attributes?

• Evaluation procedures for trust on attributes Attribute algebra? LoA set operations?

• Keeping all this in the appropriate practical limits Avoid to make this an academic issue

Download - REFEDS. Rome, October 2009 Attribute space: LoAs, aggregation and reputation

Top Related