REFEDS. Rome, October 2009 Attribute space: LoAs, aggregation and reputation

REFEDS. Rome, October 2009 Setting the Landscape

REFEDS. Rome, October 2009 LoLoAs (not an erratum) The LoA concept has originally been associated to quality of credentials  Two-factor authentication vs username/password…  SAML AuthN Context emphasized this  NIST (and NIST-like) classifications did as well Attributes constitute the core of an identity LoA on asserted attributes are key to take informed decisions And that brings us to different Levels of Levels of Assurance

REFEDS. Rome, October 2009 The Axes

REFEDS. Rome, October 2009 Attribute Authorities Entities providing additional attributes about users  Not available at their home IdP  Mostly because of management reasons Key for the VO promise Explosion of authoritative AttAuts is a concern And they may pose additional privacy challenges Several implementations currently available  VOMS (originally X.509-based, now with SAML gateway)  SWITCH VO management system (Shib-based)  FEIDE VO PoC (OAuth)  RedIRIS AA (SAML-based)  GN3 JRA3T2 (starting)  …

REFEDS. Rome, October 2009 Attribute Aggregators User-controlled sources of attributes Collecting them from AttAuts The SHINTAU project  Shib-based  Demo available at The Kantara UMA Working Group  Mostly influenced by the OAuth community  Attribute access can be considered a particular case  No implementation yet 

REFEDS. Rome, October 2009 Reputation Systems AttAggs that offer additional interfaces to update attribute values Social trust and beliefs  Social does not mean necessarily “massive” The next step in IdM? Object of a work-item in TF-EMC2 Few (if any) implementations  The ARETUSA model for BitTorrent  Plans to extend the RedIRIS AA

REFEDS. Rome, October 2009 The Possible Next Steps Attribute source discovery  Open AttAut, AttAgg, Reputation sources?  Are they total or partial members of federations? Representation for attribute sources and LoAs  Meta-attributes? Evaluation procedures for trust on attributes  Attribute algebra?  LoA set operations? Keeping all this in the appropriate practical limits  Avoid to make this an academic issue