This paper describes the design and implementation of an Attribute Provider (AP), compatible with the protocol defined in the STORK 2.0 electronic identity European infrastructure that provides ...cross-border authentication and attribute management in web-based services. Currently, this infrastructure is used as basis in some European countries to implement the recently adopted eIDAS Regulation on electronic identification and trust services for electronic transactions in the internal market. For example, in the e-SENS project the existing nodes of the STORK 2.0 infrastructure are linked to new nodes implementing the eIDAS technical specification, to create a unique interoperability platform. In our work, we considered several key aspects that have been underlined by the National Strategy for Trusted Identities in Cyberspace in USA, e.g. the possibility to incorporate attribute services in identity architectures, the principle of data minimization (provide the minimum set of attributes required so the AP should not overshare as default), and the problem of user consent. We provide also a solution to integrate the proposed AP with an existing database. We believe our work is useful for various identity, attribute and service providers that would connect in the future to the eIDAS interoperability framework.
Federated services are becoming widely implemented at many sites in multiple domain networks for cloud computing across many industry segments. New technology is required not only for federated ...authentication, but also for services operating distributed attributes, which are both static and dynamic. In addition to the technology, the sites that provide services across multiple domain networks are required to store every log as audit trails. This paper focuses on SAML and ID-WSF, which are the technology and the architecture for identity management and secure web services, discusses deployments and problems in the real world, then proposes a fast and safe technology that extends the ID-WSF for services and logs. To verify the effectiveness of the proposed technology and architecture, the latencies of SAML SSO that exchange SOAP messages are measured and considered in a cloud computing environment.
Claims-based enterprise-wide access control Chandersekaran, Coimbatore; Simpson, William R
World Congress on Engineering 2012. July 4-6, 2012. London, UK,
07/2012
Journal Article
Access control is a primary consideration when standing up a high-assurance, internet-scale, and web-service based enterprise system for information sharing,. A generalized standards-based solution ...is presented. Central to this system is a process for access control that provides the fine-grained authorities for use by enterprise services. In all cases, the access control, rights and privileges are done by the web service itself, through its own Access Control Lists (ACLs), and are preceded by a bi-lateral authentication in both normal and federated service requests. The enterprise system relies on a unified naming and credentialing system for identity management which is not dealt with in this paper due to size constraints. This document provides the process by which access control and entities' claims are developed at the enterprise level. The claims are computed using enterprise attributes, use cases, policy statements and other data together with an Attribute Based Access Control (ABAC)/Policy Based Access Control (PBAC) engine described in this paper. These claims are then placed in a Security Assertion Markup Language (SAML) token to be used by the web service. The SAML is signed for integrity and encrypted for confidentiality. This is the first enterprise level scale-up that has provided a consistent enterprise solution to access control that has not used a centralized Access Control Service and relies solely on the provider service for access control and authority determination.
In identity federations, users assigned to identity providers (IDPs) can access applications operated by service providers (SPs) without SP-specific credentials for authentication and authorization. ...While OpenID Connect and SAML are the two most widely adopted federation standards, using them inherently results in a trade-off between data quality guarantees and scalability, given how they handle the Metadata about the involved IDPs and SPs. This paper presents a novel approach for federation membership and federation Metadata management based on Distributed Ledger Technology. It applies the core idea of Certificate Transparency, as known from Global-PKI certificate authorities for X.509v3 server certificates, to SAML federation Metadata; therefore, it achieves OpenID Connect's federation building flexibility without losing the significant advantages of traditional SAML federations. An implementation based on Hyperledger Fabric is used to evaluate typical use cases by measuring impacts on Metadata distribution latency and Metadata size, and to discuss the feasibility of the presented approach.
Cloud Computing is becoming one of the most important topics in the IT world. Several challenges are being raised from the adoption of this computational paradigm including security, privacy, and ...federation. This paper aims to introduce new concepts in cloud computing and security, focusing on heterogeneous and federated scenarios. We present a reference architecture able to address the Identity Management (IdM) problem in the InterCloud context and show how it can be successfully applied to manage the authentication needed among clouds for the federation establishment.
This work addresses potentially occurring unintended flows of personally identifiable information (PII) within two fields of research, i.e., enterprise identity management and online social networks. ...For that, we investigate which pieces of PII can how often be gathered, correlated, or even be inferred by third parties that are not intended to get access to the specific pieces of PII. Furthermore, we introduce technical measures and concepts to avoid unintended flows of PII.
Single sign-on (SSO) is a mechanism that uses a single action of authentication to permit an authorized user to access all related, but independent software systems or applications without being ...prompted to log in again at each of them during a particular session. It reduces the risk for the administrators to manage users centrally, increases user productivity by allowing mobility and allows users to access multiple services or applications after being authenticated just once. This doesn’t mean that the SSO system unifies account information for all services, applications and systems, rather it hides such a multiplicity of account information into a single account that the user needs to login. Once the user login, the SSO system generates authentication information accepted by the various applications and systems. The concept of SSO can be used within an Intranet, Extranet or Internet. This report explores various methods of SSO and the advantages by adopting it. It also discusses on implementing various types of SSO and the protocols that are being used.
Identity Federations are increasingly being used to establish convenient and secure attribute-based authentication and authorization systems. Whilst this process began mainly in the academic sector, ...it is assumed that over the next few years more and more commercial Service Providers will join Identity Federations in order to offer their services and products to federated customers. However, the introduction of commercial Service Providers demands a solution for payment, which has not been deployed during the early years of Identity Federations. Thus, Service Providers have to implement not only the federation application, but also additional payment solutions; a problem, by which the federation may appear unattractive for Service Providers, especially semi-commercial or those requiring micropayments. Even for large commercial providers entering a federation, the lack of payment support is a major disadvantage that may lead to either customer or profit loss. Thus, although a combination of electronic Payment solutions and Identity Federation approaches would provide several benefits to its participants, there has not been much investigation of such combinations. Therefore, this paper analyses electronic payment approaches as well as Identity Federation mechanisms and focuses on a solution to bridge these two aspects. Besides early stages of identity-based payments, final full integrated SAML-based payment approaches, which merge payments and Identity Federation into a powerful business solution, are also highlighted. However, since security is a major concern when focusing on payment solutions, several approaches have been investigated, including security and privacy evaluations, and, within this survey, only those solutions providing a sufficient level of security and privacy have been taken into consideration.
The cloud computing paradigm is set to become the next explosive revolution on the Internet, but its adoption is still hindered by security problems. One of the fundamental issues is the need for ...better access control and identity management systems. In this context, Federated Identity Management (FIM) is identified by researchers and experts as an important security enabler, since it will play a vital role in allowing the global scalability that is required for the successful implantation of cloud technologies. However, current FIM frameworks are limited by the complexity of the underlying trust models that need to be put in place before inter-domain cooperation. Thus, the establishment of dynamic federations between the different cloud actors is still a major research challenge that remains unsolved. Here we show that risk evaluation must be considered as a key enabler in evidence-based trust management to foster collaboration between cloud providers that belong to unknown administrative domains in a secure manner. In this paper, we analyze the Federated Identity Management process and propose a taxonomy that helps in the classification of the involved risks in order to mitigate vulnerabilities and threats when decisions about collaboration are made. Moreover, a set of new metrics is defined to allow a novel form of risk quantification in these environments. Other contributions of the paper include the definition of a generic hierarchical risk aggregation system, and a descriptive use-case where the risk computation framework is applied to enhance cloud-based service provisioning.
PDF
