Scalability of trust and metadata exchange across federations Bob Hulsebosch Mortaza Bargh Hans Zandbelt (SURFnet) 3 TNC2011 Prague

Outline Introduction (problem statement) Current solution Proposed solution Conclusions & recommendations Addressing scalability of metadata exchange

Introduction: cross federative identity management Federation A Federation B entities IdP SP IdP: Identity Provider SP: Service Provider user 3 3

Introduction: problem description scalability = - # of trust relationships (mainly) - metadata exchange process ∆ a trust relationship: - same collaboration framework - authentic metadata SP IdP trust in metadata, established through federation(s) requires ?? signed metadata file (XML) SP IdP metadata exchange partly requires SP IdP SAML data exchange inter-entity trust requires 4 4

Introduction: example Assume: 20 federations 150 IdPs per federation 2000 SPs per federation How many trust relationships needed? 5,700,000 relationships (established by the entity or federation)

Current solution Centralized metadata aggregation (so-called “simple metadata aggregation”) Starting point Pulling metadata by the central metadata aggregator Central metadata document Easy metadata discovery eduGAIN prototype Kalmar confederation 6

Federation model SP IdP MA federation A trusted metadata federation central metadata MA: metadata aggregator 7

Current solution ↑ core trust fabric ↓ core trust fabric 8 Central MA federation E federation F federation C federation D MA MA SP IdP SP IdP IdP SP IdP SP IdP SP IdP SP federation A federation B 8

Proposed solution core trust fabric 9 meta MA federation E federation F federation C federation D MA MA SP IdP SP IdP IdP SP IdP SP IdP SP IdP SP federation A federation B 9

Proposed solution 4 4’ 5’ 5 3 6 WAYF 2 1 10 meta MA pub key and URL of MA-A, … pub key and URL of meta-MA 4 4’ MD: pub key and URL of MA-A signed by meta-MA federation A fed B 5’ 5 MD of IdP signed by MA-A MA MA 3 6 MD of IdP signed by MA-B IdP SP pub key and URL of MA-B WAYF 2 1 10

Reflection ≈20 ≈5,700,000 11 core trust fabric local trust fabric requires SP IdP trust in meta-metadata, (e.g., in public keys) MA SP IdP meta-metadata (e.g., public keys) requires MA ≈5,700,000 SP IdP SAML data exchange inter-entity trust metadata exchange trust in metadata, established through federations requires partly requires MA 11 11

Reflection # of trust relationships Metadata distribution process With a central entity (meta-MA): ≈ 20 relationships Metadata distribution process No need for a central entity Between MAs 12

Conclusions/recommendations Use local MAs for meta-data exchange More scalable Use meta-MA for trust establishment between MAs Lightweight, no SPOF, less trust relations to manage Implement and test the proposed architecture to gain insight to interoperability, protocols, scalability, … Design a number of core services E.g., WAYF service, self-registration service, cross federation group management service, join/departure notification service Trustful metadata distribution for Virtual Collaborations to gain insight and experience over interoperability issues, required new functionalities, scalability and performance indicators, strategies for metadata aggregation that optimize the costs associated with metadata update and metadata usage, etc. The testbed can be realized in a national setting (e.g., between SURFnet and Kennisnet) or an international setting (e.g. within eduGAIN). 13

Questions? Addressing scalability of metadata exchange