October 2008 - ogsa-authz-wg

Use of IDList in Use of WS-TRUST and SAML to access a Credential Validation Service
by David Chadwick 04 Oct '08

04 Oct '08

Dear WG at our last meeting in Singapore, on a suggestion from Tom Scavo, we discussed changing from the GFD.66 SubjectAttributeReferenceAdvice element to the SAML IDList element and I made the edits to our profile. We have now been implementing this to see how it works in practice, and we have encountered the following problem, namely that IDList only lists attribute authorities and does not associate the attribute types that they issue with these attribute authorities. GFD.66 SubjectAttributeReferenceAdvice on the other hand does associate AAs with the attributes they issue. The meeting suggested that the implementation can pick up the attribute list from meta information of the AA, which indeed it can. However, this does not allow a user to specify which attributes he wants to use ie. provide the user with least privileges. Consider a VOMS server in which a user has multiple attributes. The meta information for the VOMS server will tell the CVS which attribute types are supported by the VOMS AA. But it will not help the CVS to decide which ones to ask for this user session, since the user is no able to tell the CVS which ones he wants. With SubjectAttributeReferenceAdvice the user was able to tell the CVS (indirectly via the PEP) which attributes he wished to be picked up from where for this session. With IDList the user is unable to tell the CVS. I am therefore proposing that we revert back to the SubjectAttributeReferenceAdvice element since it provides the user with the least privileges control that he needs. On the user's grid job request he adds the parameter "please pick up my attribute X from AA Y", which the PEP can then transfer to the CVS in the SubjectAttributeReferenceAdvice element. The CVS can perform the third party query mode request to the AA for the specified attribute (using the Use of SAML to retrieve Authorization Credentials profile), and if the user does have attribute X, this can be validated by the CVS and fed into the PDP. regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 2

comments re Use of SAML to retrieve Authorization Credentials
by Tom Scavo 03 Oct '08

03 Oct '08

Attached is a comprehensive set of comments re the OGF document "Use of SAML to retrieve Authorization Credentials" currently under Public Review. The attached document "Comments_OGF_SAMLAttributeExchange.pdf" contains all the issues I've raised previously plus one new issue (Issue 2b). The attached document "Attribute PullProfilev1.4-trs.doc" is a marked up copy of the source document under Public Review (included here for the first time). Overall, the document under Public Review, and the OASIS specification on which it depends, need a lot of work. I'm sorry I didn't realize this earlier, but as I've said, it couldn't be helped. Much has happened since the last version of "Use of SAML to retrieve Authorization Credentials" was published last March. Related to this, the OASIS "SAML V2.0 Holder-of-Key Assertion Profile" is progressing through committee at this time. Another document "SAML V2.0 Holder-of-Key Assertion Request Profile" has been drafted, but has not yet been submitted to the OASIS SSTC. With these two documents in hand, a new "SAML V2.0 Attribute Self-Query Profile" will be written, which the SSTC has agreed (in principle) to consider in due time: http://wiki.oasis-open.org/security/CfPi2008 I can't predict with any accuracy how long it will take these documents to wind their way through the OASIS process, but it could be some number of months before the specs stabilize. Tom Scavo NCSA

1 0

CFP: Special Issue on Security and Trust Management for Dynamic Coalitions (Wiley SCN Journal)
by theo.dimitrakos＠bt.com 02 Oct '08

02 Oct '08

I think that the enclosed call for papers is of particular interest for this list. Please note that Bruce Schneier has joined Fabio and myself for this special issue. Regards, Theo. ________________________________ CALL FOR PAPERS Security and Communication Networks Journal (Wiley) Special Issue on Security and Trust Management for Dynamic Coalitions Scope There is an increasing interest and deployment of technologies that allow cooperation among entities that may act collectively. These entities may form dynamic coalitions where entities may leave and join, may show mobility aspects (either logical or physical), and may act in a collective manner. Examples of these coalitions can be found in the digital world, including: a) Crowds of users walking on the streets with advanced context aware converged telecommunication devices; b) A group of robots, manned and unmanned vehicles equipped with processors, sensors, smart-phones, etc. interacting with each other, with their environment, and with a command or a control node, such as the command and control site of a defence coalition or a civil traffic control; c) A set of organizations (possibly virtual) sharing some resource for service provisions, or so called Virtual Organisations; d) Collaborative processes that use resources and services offered by partners in a Virtual Organisation; and e) Web 2.0 mash-ups and composite Web Services that are composed of services and applications offered by different service providers over a public network. These dynamic coalitions involve several technologies as peer to peer systems (P2P), mobile ad hoc networks (MANETs), and service oriented architectures such as those realised in GRID computing and Web Services Frameworks. There are several research areas identified as follows: a) Security in dynamic coalitions; b) trust in dynamic coalitions; c) security and trust interplay; and 4) secure processes and service composition. Topics of interest This special issue is proposed to cover research results and innovation case studies on security and trust management on dynamic coalitions. Topics of interest include but are not limited to: * Semantics and computational models for security and trust in dynamic coalitions * Context-based security and trust management architectures, mechanisms and policies * Privacy and anonymity issues in trust negotiation * Enforcing cooperation in dynamic coalitions * Reputation and recommendation models and architectures for dynamic coalitions * Usage control models, languages and architectures in dynamic coalitions * Cryptographic models and mechanisms for dynamic coalitions * Security protocols for group management * Security for Service Oriented Architectures and Infrastructures * Collaboration and Virtual Organization life-cycle management in dynamic coalitions * Federated Identity Management in dynamic coalitions * Distributed Access Control and administrative delegation in dynamic coalitions * Policy verification and validation in order to predict the impact of changes to an infrastructure in order to support the life-cycle of a dynamic coalition * QoS monitoring, evaluation and reporting in dynamic coalitions * Auditing in dynamic coalitions * Trust and security in ICT Governance and service management for dynamic coalitions * Security frameworks for dynamic service composition * Security frameworks for Web 2.0 service and application mash-ups * Security and trust adaptation in dynamic coalitions * Information management in dynamic coalitions including research in techniques for self-protecting information sets * Trust and security aspects of Operational Support Systems (OSS) for the converged telecommunications infrastructure that underpins dynamic coalitions Submission Papers must represent high-quality and previously unpublished work. Original research papers are solicited in all areas on security and trust management on dynamic coalitions. All submissions will be peer reviewed by at least three experts working in the areas. The guidelines for prospective authors can be found at http://www.interscience.wiley.com/journal/security <https://mail.bt.com/exchweb/bin/redir.asp?URL=https://mail.bt.com/Exchweb/b…> ). Prospective authors should submit their papers online at http://mc.manuscriptcentral.com/scn <https://mail.bt.com/exchweb/bin/redir.asp?URL=https://mail.bt.com/Exchweb/b…> . When submitting the papers, the authors should make sure to choose the Manuscript type as "Special Issue", and enter "Running Head" and "Special Issue title" as "SCN-SI-008" and "Dynamic Coalitions", respectively. Important Dates Manuscript due November 30, 2008 First Review Phase Results March 1, 2009 Final Acceptance Notification July 1, 2009 Camera Ready Manuscript due July 31, 2009 Publication TBD Guest Editors Theo Dimitrakos Head of Security Architectures, Centre for Information & Security Systems Research, BT Group CTO, British Telecommunications plc, UK Fabio Martinelli Institute of Informatics and Telematics, National Research Council, Italy Bruce Schneier Chief Security Technology Officer, British Telecommunications plc, USA

1 0