refeds. rome, october 2009 attribute space: loas, aggregation and reputation
DESCRIPTION
REFEDS. Rome, October 2009 LoLoAs (not an erratum) The LoA concept has originally been associated to quality of credentials Two-factor authentication vs username/password… SAML AuthN Context emphasized this NIST (and NIST-like) classifications did as well Attributes constitute the core of an identity LoA on asserted attributes are key to take informed decisions And that brings us to different Levels of Levels of AssuranceTRANSCRIPT
REFEDS. Rome, October 2009
Attribute space: LoAs, aggregation and reputation
REFEDS. Rome, October 2009
Setting the Landscape
REFEDS. Rome, October 2009
LoLoAs (not an erratum)
• The LoA concept has originally been associated to quality of credentials Two-factor authentication vs username/password… SAML AuthN Context emphasized this NIST (and NIST-like) classifications did as well
• Attributes constitute the core of an identity• LoA on asserted attributes are key to take
informed decisions• And that brings us to different Levels of Levels of
Assurance
REFEDS. Rome, October 2009
The Axes
REFEDS. Rome, October 2009
Attribute Authorities• Entities providing additional attributes about users
Not available at their home IdP Mostly because of management reasons
• Key for the VO promise• Explosion of authoritative AttAuts is a concern• And they may pose additional privacy challenges• Several implementations currently available
VOMS (originally X.509-based, now with SAML gateway) SWITCH VO management system (Shib-based) FEIDE VO PoC (OAuth) RedIRIS AA (SAML-based) GN3 JRA3T2 (starting) …
REFEDS. Rome, October 2009
Attribute Aggregators
• User-controlled sources of attributes• Collecting them from AttAuts• The SHINTAU project
Shib-based Demo available at
http://issrg-beta.cs.kent.ac.uk:8080/loademo.html• The Kantara UMA Working Group
Mostly influenced by the OAuth community Attribute access can be considered a particular case No implementation yet http://kantarainitiative.org/confluence/display/uma/
REFEDS. Rome, October 2009
Reputation Systems
• AttAggs that offer additional interfaces to update attribute values
• Social trust and beliefs Social does not mean necessarily “massive”
• The next step in IdM?• Object of a work-item in TF-EMC2• Few (if any) implementations
The ARETUSA model for BitTorrent Plans to extend the RedIRIS AA
REFEDS. Rome, October 2009
The Possible Next Steps
• Attribute source discovery Open AttAut, AttAgg, Reputation sources? Are they total or partial members of federations?
• Representation for attribute sources and LoAs Meta-attributes?
• Evaluation procedures for trust on attributes Attribute algebra? LoA set operations?
• Keeping all this in the appropriate practical limits Avoid to make this an academic issue