An Authentication and Authorization Infrastructure: the PAPI System

Index An approximation to the solution PAPI Architecture JAVA – JWS Possible Scenarios Future works

Approximation: Working with E-Certificates Web browser Authentication data Web Server S1 Web page Authentication Server Temporal E-certificates E-certificate S1 E-certificate S2 E-certificate S3 HTTP request + E-certificate S1 Web Server S2 HTTP request + E-certificate S2 Web page Problems:   Not transparent   Password in browser DB   Choose the right certified   Web servers not adapted for this technology   Allow copy of valid certifies Advantages:   Temporal access to authorized services   Allow mobile users   Authentication adapted to user organizations   Technology implemented in main web servers

Approximation: Partial Solutions No transparent -> encrypted cookies Web browser Authentication data Web Server S1 Web page Authentication Server Temporal Encrypt-cookies Encry-cookie S1 Encry-cookie S2 Encry-cookie S3 HTTP request + Encry-cookie S1 Point of Access HTTP request Web page z zWeb servers not adapted -> Points of Access Problems:   Domain problems in cookies   Allow copy of valid cookies Advantages:   Temporal access to authorized services   Allow mobile users   Authentication adapted to user organizations   Control access adapted to web servers of information providers   Transparent for the user

Approximation: Partial Solutions Domain problems in cookies -> Cookies served by PAs Web browser Authentication data Authentication Server Encry-cookie S1 Encry-cookie S2 Encry-cookie S3 Point of Access Point of Access Temporal Signed-URLs Signed-URL Encry-cookie

Approximation: Partial Solutions Web Browser 1 Encry-cookie S1 Point of Access z zCopy of valid cookies -> Data base of cookies Short time expiration Web Browser 2 Encry-cookie S1 HTTP request + Encry-cookie S1 Web Server S1 HTTP request Web page DB of Enc-cookie Web page + New Enc-cook S1 New Enc-cook S1 HTTP request + Encry-cookie S1 Colision

Architecture of PAPI system Web browser Authentication data Authentication Server Encry-cookies Temporal Signed-URLs Web page + New Hcook+Lcook HTTP request + Hcook+Lcook Point of Access Web Server S1 HTTP request Web page DB of Hcook   URL: K_priv SA (user code + server + path + Exp. Time + sign time)   Hcook1: K1_PA (user code + server + path + Exp. Time + Random Block)   Lcook: K2_PA (server + path + creation time)

JWS – JAVA compatibility Web browser User Credentials Authentication Server Encry-cookie S1 Encry-cookie S2 Access point Signed URLs Signed URL cookieLoader.jnlp Encry-cookie Access Point Signed URL HTTPClass Encry-cookie

Scenarios Web browser Web Server Authentication Server Point of Access Web Server Point of Access Authentication Server Point of Access Point of Access Authentication Server Authentication Server Point of Access Web Server Point of Access

Future works Enhance PAPI compatibility with other technologies  A-Select  Shibboleth  Athens Include new type of clients  WIFI access  Kerberos  VPNs Improve the administration tools