International Telecommunication Union Geneva, 9(pm)-10 February 2009 Identification Services as provided by directories (X.500 incl. X509) Erik Andersen, Consultant, Andersen’s L-Service Q.11/17 Rapporteur ITU-T Workshop on “New challenges for Telecommunication Security Standardizations" Geneva, 9(pm)-10 February 2009

International Telecommunication Union Geneva, 9(pm)-10 February Why listen to this presentation? How identification services relates to security How directories relate to identification services Why X.500 (and LDAP) is an obvious answer to identification services

International Telecommunication Union Geneva, 9(pm)-10 February About the X.500 directory specification First edition in 1988 Been under continuous expansion since to meet new requirements Developed in collaboration with ISO/IEC JTC1/SC6 Within ISO/IEC known as the ISO/IEC 9594 multipart standard Many highly skilled people have participated during the years

International Telecommunication Union Geneva, 9(pm)-10 February About the X.500 directory specification (cont.) Six editions so far – the seventh edition on its way Consists of 10 parts (incl. X.509) Defines a naming structure that allows unique naming of all entities Support for distribution and replication Lightweight Directory Access Protocol (LDAP) is a dear child of X.500 (uses the X.500 model)

International Telecommunication Union Geneva, 9(pm)-10 February Identity and security IT Security comprises many things: Physical attacks Hacker attacks Spam Denial of service Fraud by employees Identity related security issues

International Telecommunication Union Geneva, 9(pm)-10 February Identity Related Security Issues Related to: Information about people and other entities Access to systems and Services Accounts Authorisation Software code

International Telecommunication Union Geneva, 9(pm)-10 February Identity Management (IdM) Identity Management (IdM) includes Identification Services It is much in focus within ITU-T Study Group 17 and other committees Considered an important aspect of Next Generation Network (NGN) Not a new issue

International Telecommunication Union Geneva, 9(pm)-10 February X500 is (part of) IdM We have been in the Identity Management (IdM) Business since 1984 We got a head start!

International Telecommunication Union Geneva, 9(pm)-10 February Butler group report X.500/LDAP basis for most current IdM implementations - In the industry often called Identity and Access Management (IAM)

International Telecommunication Union Geneva, 9(pm)-10 February Butler Group list Aladdin BMC Bull Evidian CA Entrust IBM Microsoft Novell Oracle RSA Sun They all uses LDAP as major component in their IdM solutions X.509 also plays a major role for authentication

International Telecommunication Union Geneva, 9(pm)-10 February Other vendors Isode Siemens eB2Bcom Critical Path Etc.

International Telecommunication Union Geneva, 9(pm)-10 February The requirement for authentication Before giving access to services and information, the identity of the accessing entity must be established Different levels of authentication The required level depends on Sensitivity of service or information Whether interrogation or update

International Telecommunication Union Geneva, 9(pm)-10 February Scope of X.500 identity services Storage of identity information Protection of the information in the directory Use of X.509 capabilities outside directories (e.g. required by SSL, used my SAML2, etc.

International Telecommunication Union Geneva, 9(pm)-10 February cn=Ole Jensen Root c=DK c=GB o=Fallit A/S ou=Salg o=Broke Ltd ou= Udvikling Name = { cn=Ole Jensen, ou=Salg, o=Fallit A/S, c=DK } Entry representing an object o=ALS cn=Per Yde cn=Ole Jensen Storing identity information in the Directory Information Tree

International Telecommunication Union Geneva, 9(pm)-10 February Protecting Directory Identity Information

International Telecommunication Union Geneva, 9(pm)-10 February Levels of authentication None Directory Name Directory Name and Password Simple Authentication and Security Layer (SASL) (Also used by LDAP) SPKM - Simple Public-Key Mechanism Strong authentication (use of X.509) X.500 allows the following means of authentication:

International Telecommunication Union Geneva, 9(pm)-10 February Use of Password Password is widely used for identity authentication If transmitted over encrypted connection (e.g. SSL) and stored encrypted in the directory, it gives a reasonable protec- tion in many situations Work on Password management and policy is in progress within X.500 to be also ported to LDAP

International Telecommunication Union Geneva, 9(pm)-10 February Strong authentication Based on electronic signatures Requires the presence of a Public Key Infrastructure (PKI) ITU-T X.509 is here the key specification

International Telecommunication Union Geneva, 9(pm)-10 February Access Control for Directory information Who may do what or not do what based on the level of authentication Who: Owner of information Specific user user group all users Subtree (specific name structure) What: All information about an entity Fragments LDAP has no access control

International Telecommunication Union Geneva, 9(pm)-10 February Levels of protection Anything goes Protection of individual entries based on right-to-know (traditional access control) Protection of individual entries based on right-to-know and need-to-know (service view) Protection against information trawlingProtection against devious searches

International Telecommunication Union Geneva, 9(pm)-10 February Protection by X.509

International Telecommunication Union Geneva, 9(pm)-10 February Basic X.509 Concepts Public-key concept Public-Key Infrastructure (PKI) Privilege Management Infrastructure (PMI) Certificates Public-key certificates (part of PKI) Attribute certificates (part of PMI) Digital Signatures

International Telecommunication Union Geneva, 9(pm)-10 February Public Key concept AB A B A B Encryption using private key A Decryption using public key A Encryption using public key B Decrypt using private key B

International Telecommunication Union Geneva, 9(pm)-10 February Digital signature Verifies sender Ensures integrity of message Signing of Messages Software code Documents Etc DATA Signature Algo- rithms Hashing plus encryption with private key

International Telecommunication Union Geneva, 9(pm)-10 February Certifying the identity using public-key certificates Certification Authority

International Telecommunication Union Geneva, 9(pm)-10 February Checking the credentials A passport is a type of certificate binding a picture to an ID Has to be issued by a trustworthy authority A passport may be false It is checked by the “service provider”, also called the relying party A certificate is issued by a Certification Authority (CA)

International Telecommunication Union Geneva, 9(pm)-10 February X.509 at work - 1

International Telecommunication Union Geneva, 9(pm)-10 February X.509 at work - 2

International Telecommunication Union Geneva, 9(pm)-10 February Establishing the infrastructure To validate a certificate a Public-Key Infrastructure (PKI) is required: To establish a trust anchor To establish a repository for revoked certificates The X.509 provides a framework for PKI Supplementary specifications required

International Telecommunication Union Geneva, 9(pm)-10 February PKI forums and peer groups Electronic Signatures and Infrastructures (ESI) by ETSI Certification Authority/Browser Forum Public-Key Infrastructure (X.509) (PKIX) within IETF

International Telecommunication Union Geneva, 9(pm)-10 February Privilege Management Attribute certificates are used for assigning privileges to the holder of the certificate The holder is identified, e.g., by a pointer to a public-key certificate An attribute certificate is issued by an Attribute Authority (AA) A special Privilege Management Infrastructure (PMI) may be established Recent work allows privileges established in one domain to be applied in other domains

International Telecommunication Union Geneva, 9(pm)-10 February The challenges Extending X.500 support to meet new identity management requirements Make the community aware of the X.500 capabilities Get new blood into the process At times up against the NIH syndrome NIH – Not Invented Here

International Telecommunication Union Geneva, 9(pm)-10 February Where to go The central source for information on the X.500 Directory Standard. Identity Management X.500