Www.egi.eu EGI-InSPIRE RI-261323 EGI (IGTF Liaison Function) www.egi.eu EGI-InSPIRE RI-261323 Towards Differentiated Identity Assurance as a collaborative.

Slides:



Advertisements
Similar presentations
EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks MyProxy and EGEE Ludek Matyska and Daniel.
Advertisements

EGI-InSPIRE RI EGI-InSPIRE EGI-InSPIRE RI AAI in EGI Status and Evolution Peter Solagna Senior Operations Manager
EGI-InSPIRE RI EGI (IGTF Liaison Function) EGI-InSPIRE RI The IGTF IOTA Profile towards differentiated assurance levels.
David Groep Nikhef Amsterdam PDP & Grid Evolving Assurance – IGTF LoA generalisation David Groep Interoperable Global Trust Federation IGTF Documents at.
EGI-InSPIRE RI EGI-InSPIRE EGI-InSPIRE RI EGI - Identity Management Steven Newhouse Director, EGI.eu Federated Identity.
INFSO-RI Enabling Grids for E-sciencE Portals and Authentication Issues and Solution Directions from a CA and IGTF Perspective David.
INFSO-RI Enabling Grids for E-sciencE JRA3 2 nd EU Review Input David Groep NIKHEF.
David Groep EUGridPMA The International Grid Trust Federation enabling an interoperable global trust fabric also supported by EGI.eu EGI-InSPIRE RI ,
WLCG Security TEG, risks and Identity Management David Kelsey GridPP28, Manchester 18 Apr 2012.
David Groep Nikhef Amsterdam PDP & Grid Differentiated and Collaborative Assurance profiling the identity management landscape for diversifying e-Infrastructure.
AARC Overview Licia Florio, David Groep 21 Jan 2015 presented by David Groep, Nikhef.
IOTA Questions for RPs Sept 9, 2013 Bucharest, Romania.
LiveAP Towards Differentiated Identity Assurance David Groep, Nikhef supported by the Netherlands e-Infrastructure SURFsara, and EGI.eu O-E-15 and EGI-InSPIRE.
Federated Identity Management for HEP David Kelsey WLCG GDB 9 May 2012.
Security Update WLCG GDB CERN, 12 June 2013 David Kelsey STFC/RAL.
March 27, 2006TAGPMA - Rio de Janeiro1 Short Lived Credential Services Profile Tony J. Genovese The Americas Grid PMA DOEGridsATF/ESnet/LBNL.
Ning Zhang, the University of Manchester, UK David Groep, National Institute for Nuclear and High Energy Physics, NL Blair Dillaway, OGF Security Area.
Updates from the EUGridPMA David Groep, July 16 st, 2007.
David Groep Nikhef Amsterdam PDP & Grid Evolving Assurance – going where? Collaborative, distributed, and generalized assurance beyond just identity authentication.
Identity Management in Open Science Grid Identity Management in Open Science Grid Challenges, Needs, and Future Directions Mine Altunay OSG Security Officer.
AAI WG EMI Christoph Witzig on behalf of EMI AAI WG.
EGEE-III INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks David Kelsey RAL/STFC,
EResearchers Requirements the IGTF model of interoperable global trust and with a view towards FIM4R AAI Workshop Presenter: David Groep, Nikhef.
IOTA Questions for RPs Sept 9, 2013 Bucharest, Romania.
Summary of AAAA Information David Kelsey Infrastructure Policy Group, Singapore, 15 Sep 2008.
Authentication and Authorisation for Research and Collaboration Licia Florio AARC Workshop The AARC Project Brussels, 26 October.
Security Policy Update David Kelsey UK HEP Sysman, RAL 1 Jul 2011.
Authentication and Authorisation for Research and Collaboration Peter Solagna Milano, AARC General meeting Current status and plans.
Identity Management in DEISA/PRACE Vincent RIBAILLIER, Federated Identity Workshop, CERN, June 9 th, 2011.
IOTA AP Towards Differentiated Identity Assurance David Groep, Nikhef supported by the Netherlands e-Infrastructure and SURFsara.
JRA1.4 Models for implementing Attribute Providers and Token Translation Services Andrea Biancini.
Authentication and Authorisation for Research and Collaboration David Groep AARC All Hands meeting Milano Policy and Best Practice.
Identity Federations: Here and Now David L. Wasley Thomas Lenggenhager Peter Alterman John Krienke.
Security Policy Update WLCG GDB CERN, 14 May 2008 David Kelsey STFC/RAL
EGI-InSPIRE RI EGI EGI-InSPIRE RI Service Operations Security Policy the new generalised site operations security policy.
EGI-InSPIRE RI EGI-InSPIRE EGI-InSPIRE RI EGI SPG future work EGI Technical Forum Lyon, 21 Sep 2011 David Kelsey, STFC/RAL.
EGI-InSPIRE RI EGI EGI-InSPIRE RI Establishing Identity in EGI the authentication trust fabric of the IGTF and EUGridPMA.
WLCG Authentication & Authorisation LHCOPN/LHCONE Rome, 29 April 2014 David Kelsey STFC/RAL.
EGI-InSPIRE RI EGI-InSPIRE EGI-InSPIRE RI Evolution of AAI for e- infrastructures Peter Solagna Senior Operations Manager.
JSPG Update David Kelsey MWSG, Zurich 31 Mar 2009.
EGI-InSPIRE RI EGI (IGTF Liaison Function) EGI-InSPIRE RI IGTF EUGridPMA status update SHA-2, OCSP, and more David.
EGI-InSPIRE RI EGI-InSPIRE EGI-InSPIRE RI Plans for PY2 Steven Newhouse Project Director, EGI.eu 30/05/2011 Future.
European Grid Initiative AAI in EGI Status and Evolution Peter Solagna Senior Operations Manager
David Groep Nikhef Amsterdam PDP & Grid AARC Authentication and Authorisation for Research and Collaboration an impression of the road ahead.
Summary of Poznan EUGridPMA32 September EUGridPMA Poznan 2014 meeting – 2 David Groep – Welcome back at PSNC.
EGI-InSPIRE RI EGI-InSPIRE EGI-InSPIRE RI Enabling SSO capabilities in the EGI Cloud services Peter Solagna – EGI.eu.
EGI-InSPIRE RI EGI-InSPIRE EGI-InSPIRE RI Questionnaires to Cloud technology providers and sites Linda Cornwall, STFC,
EGI-InSPIRE RI EGI (IGTF Liaison Function) EGI-InSPIRE RI IGTF & EUGridPMA status update SHA-2 – and more (David Groep,
News from EUGridPMA EGI OMB, 22 Jan 2013 David Kelsey (STFC) Using notes from David Groep 22/01/20131EUGridPMA News.
PRACE user authentication and vetting Vincent RIBAILLIER, 29 th EUGridPMA meeting, Bucharest, September 9 th, 2013.
IGTF in 10 years enabling the interoperable global trust federation Nikhef, Amsterdam supported the Dutch national e-Infrastructure funded and coordinated.
EGI-InSPIRE RI EGI (IGTF Liaison Function) EGI-InSPIRE RI The IGTF IOTA Profile towards differentiated assurance levels.
Building Trust for Research and Collaboration
WLCG Update Hannah Short, CERN Computer Security.
AAI Alignment Nicolas Liampotis (based on the work of Mikael Linden)
Boosting AAI for research and collaboration
Frameworks for harmonized policies and practices
Policy in harmony: our best practice
Assessing Combined Assurance
Assessing Combined Assurance
Evolving the EGI trust fabric using distributed responsibility
Policy and Best Practice … in practice
Update - Security Policies
AARC Blueprint Architecture and Pilots
Supporting communities with harmonized policy
OIDC Federation for Infrastructures
Community AAI with Check-In
Appropriate Access InCommon Identity Assurance Profiles
Baseline Expectations for Trust in Federation
Combined Assurance Model
Presentation transcript:

EGI-InSPIRE RI EGI (IGTF Liaison Function) EGI-InSPIRE RI Towards Differentiated Identity Assurance as a collaborative effort David Groep, Nikhef and NL-NGI for EGI global task O-E-15 This work is supported by EGI-InSPIRE under NA2 orcid.org/

EGI-InSPIRE RI Outline Aims of a global trust fabric –Elements of trust: technical, vetting, auditing –Participants in the trust fabric Assurance levels –IGTF ‘common criteria’ –Current APs Towards collaborative differentiated LoA –Distributing elements of trust decision –Light-weight Identity Vetting Environment: towards LoA 1+ –Limitations of a ‘LIVE AP’ and new LoA levels Federated MICS and SLCS authorities today Towards differentiated collaborative LoA

EGI-InSPIRE RI Overlapping Communities – Common Trust Towards differentiated collaborative LoA Goals allow multiple sources of authority: User, Institute, Community acknowledge both long- and short-term community structures enable access to services and resources and at the same time enable security incident response &c to provide basis for access control decisions by resources providers (both generic and community based) Reduce over-all policy burden by adhering to common criteria

EGI-InSPIRE RI Participants Towards differentiated collaborative LoA Many participants contribute to access control with trustworthy identity and attributes decision rests with the resource … service, site, &c …

EGI-InSPIRE RI Requirements to fulfil Towards differentiated collaborative LoA Incident Response long-term* traceable independent from short-lived community must be revocable correlate with other information sources banning and containment handle Privacy and data protection important ‘unalienable right’ for research correlation of PII among service providers could allow profiling exchange of PII often fraught with issues Measurement and Accounting publication metrics usage metering, billing auditing and compliance monitoring identity lives in a policy ecosystem to protect all participants commensurate to their risk level Access Control Attribute handle unique binding never re-assigned Regulatory compliance need to know who you let in beforehand

EGI-InSPIRE RI Redistributing responsibilities Towards differentiated collaborative LoA Subject (ID) based Effective LoA is retained For given actions, resources, and acceptable residual risk, required ID assurance is a given can shift ‘line’ in identity trust level Action (app) based More constraint actions can lower need for identity LoA (J)SPG VO Portal policy did just that: 4 levels of actions Resource (value) based e.g. access to wireless network does not pose huge risks, so can live with a lower identity LoA (eduroam)

EGI-InSPIRE RI Trust Element Distribution Towards differentiated collaborative LoA Technical elements integrity of the roots of trust integrity of issuance process process incident response revocation capabilities key management credential management incident response Identity elements identifier management re-binding and revocation binding to entities traceability of entities emergency communications regular communications ‘rich’ attribute assertions correlating identifiers access control Verifiability & Response, mitigation, recovery IGTF Classic elements RP, Community elements

EGI-InSPIRE RI IGTF Assurance Process Towards differentiated collaborative LoA Type and sensitivity of e-Infrastructure services drives the level of assurance required Security and assurance level set to be commensurate –not overly high for ‘commodity’ resources –not too low, as resource owners/providers otherwise start implementing additional controls on top of and over the common criteria –defined in collaboration with resource providers –using transparency and a peer review processes –leveraging our own community organisation mechanisms

EGI-InSPIRE RI Assurance levels Trust in the assertions by resource and service providers is key Until now, our e-Infrastructure used a single ‘level’ –there are also well-known ‘government’ standards for LoA (US: OMB M & NIST SP800-63, Kantara) –but 95/46/EC and 1999/93/EC are not of much use to us and the Nice treaty states that identity is a national matter … –there is rough but not 1:1 correspondence between balanced needs of the providers and users and the Kantara LoA levels Towards differentiated collaborative LoA For your interest: Kantara Assurance Levels

EGI-InSPIRE RI IGTF Trust Structure Towards differentiated collaborative LoA Common criteria and model –globally unique and persistent identifier provisioning –not fully normative, but based on minimum requirements Trust is technology agnostic –technology and assurance ‘profiles’ in the same trust fabric –‘classic’traditional public key infrastructure with near-realtime identity betting –‘MICS’dynamic ID provisioning leveraging federations –‘SLCS’on-demand short-lived token generation a basis for ‘arbitrary token’ services –+ experimental, or even new profiles … if there is interest inside IGTF scope! For your interest: IGTF Authentication Profiles

EGI-InSPIRE RI From IGTF to RP IGTF Distribution is not monolithic –Authorities comes in ‘bundles’ for each profile –RPs select one or more ‘profiles’ as sufficient and may add their own authorities as well –e.g: “EGI policy on trusted authorities” accepts Classic, MICS and SLCS And there is no ‘IGTF all’ distribution – on purpose! With more diverse profiles (and LoAs) RPs will make more diverse choices Towards differentiated collaborative LoA For your interest: EGI SPG policy on Approval of Certification Authorities,

EGI-InSPIRE RI Collaborative assurance PRACE T1 (“DEISA”) centres –Users run applications across the infrastructure –All originate from a home site inside the infrastructure where they are fully known personally and have gone through a thorough vetting process –Home site distributes this knowledge actively towards the other centres (through a central LDAP) So some of the identity elements of trust already done XSEDE is likely be similar even wLCG is somewhat similar … through CERN HR Towards differentiated collaborative LoA I’m hopefully not misrepresenting Jules Wolfrat for PRACE here … redistribution of responsibilities: a new profile

EGI-InSPIRE RI An IGTF Profile to match ‘Light-weight Identity Vetting Environment’ as seen from the IdP/authority side complemented by the RP to profile full vetting Towards differentiated collaborative LoA Vetting LoA scale LoA 0: ‘like conventional unsigned ’ * somewhat my personal view … sorry for bias 1 2 …3,4

EGI-InSPIRE RI LiveAP and its Caveats Live AP assurance level is different, and rest must be taken up by somebody else But e.g. in EGI –many communities rely on names to enrol people –communities do not keep much of auditable records –users are a-priori unknown to the resource owners –RPs support loosely organised communities –RPs thus need independent authoritative real names Towards differentiated collaborative LoA Identity elements identifier management re-binding and revocation binding to entities traceability of entities emergency communications regular communications ‘rich’ attribute assertions correlating identifiers access control

EGI-InSPIRE RI Technical trust remains loosing technical trust would make any authentication infrastructure useless so integrity of the issuer has to be retained –just like for the AA Operations Guidelines –similar to the classic, mics and slcs profiles –both issuing system and ID management secure –retention of records for incident response When contracting back-end (university) IdPs the requirements must apply to them as well Towards differentiated collaborative LoA

EGI-InSPIRE RI EGI (IGTF Liaison Function) EGI-InSPIRE RI Light-weight Identity Vetting Environment The Profile Towards differentiated collaborative LoA

EGI-InSPIRE RI Disclaimer LIVE AP is not ready, and IGTF will make significant changes Needs global consensus Target date: ~ Q Input, specifically from RPs, very welcome! Towards differentiated collaborative LoA

EGI-InSPIRE RI DRAFT LIVE AP Identity Persistency of name binding –any single subject name in a credential must be linked with one and only one entity for the whole lifetime of the service Naming –name elements […] sufficient to uniquely identify individual –sourced from ‘reasonable’ systems –real name or pseudonym with compensatory controls: –only in conjunction w/verified name element allowing contact to subject -- and the pseudonymity should be ‘obvious’ Re-issuance, renewal and re-keying –authority should keep enough data to re-vet use of name Tracability requirements –at issuance time the authority should identify user, and that relationship should be documented and verifiable Towards differentiated collaborative LoA

EGI-InSPIRE RI DRAFT LIVE AP Technical We expect a secure, on-line CA system –Long-term commitment, security controls and trained personnel –With FIPS140-2 level 3 or equivalent HDM controlling key –2+ tier system on monitored controlled network revocation capable –so at least better than ssh ;-) Documented, transparent, policy and practices –Including provisions for auditing by peers Some requirements propagate back to upstream IdPs! Credentials in common recognisable formats –Initially X.509v3 certificates, but profile is mostly generic! Towards differentiated collaborative LoA

EGI-InSPIRE RI DRAFT will change

EGI-InSPIRE RI What Happens Next together with the cross-national RPs and national members (proxying national RPs) ‘LIVE AP’ will be developed to full AP guideline –this will introduce a truly new LoA for the first time –LoA higher than Kantara LoA 1, but much lower than 2 (and also lower than classic and MICS, and even <SLCS) –contributions welcome through your RP or national authority membr once reasonable consensus is achieved … –RPs may decide to accept authorities under this profile for (some) of their services. Or not. –don‘t automatically expect all RPs to treat it as equivalent to MICS … unless the RP does its own vetting already Towards differentiated collaborative LoA

EGI-InSPIRE RI Today’s Federated e-Science ID Promo… Towards differentiated collaborative LoA Map colour coding Green: classic accredited authority Blue: federated (+classic) authority Yellow: pending classic accreditation Also in USA: CILogon based on InCommon in Japan: new SLCS by NII Federated ‘translating’ authorities: integrity requirements propagate to all data sources e.g. TERENA Certificate Service eScience MICS, the DFN-AAI SLCS, SWITCHaai SLCS

EGI-InSPIRE RI Towards differentiated collaborative LoA ?