1. Scalability of trust and metadata exchange across federations
Bob Hulsebosch
Mortaza Bargh
Hans Zandbelt (SURFnet) 3
TNC2011 Prague

2. Outline Introduction (problem statement) Current solution
Proposed solution
Conclusions & recommendations
Addressing scalability of metadata exchange

3. Introduction: cross federative identity management
Federation A
Federation B
entities
IdP SP
IdP: Identity Provider
SP: Service Provider
user 3 3

4. Introduction: problem description
scalability =
- # of trust relationships (mainly)
- metadata exchange process ∆
a trust relationship:
- same collaboration framework
- authentic metadata SP
IdP
trust in metadata,
established through federation(s)
requires ??
signed metadata
file (XML) SP
IdP
metadata exchange
partly requires SP
IdP
SAML data exchange
inter-entity trust
requires 4 4

5. Introduction: example
Assume:
20 federations
150 IdPs per federation
2000 SPs per federation
How many trust relationships needed?
5,700,000 relationships (established by the entity or federation)

6. Current solution
Centralized metadata aggregation (so-called “simple metadata aggregation”)
Starting point
Pulling metadata by the central metadata aggregator
Central metadata document
Easy metadata discovery
eduGAIN prototype
Kalmar confederation 6

7. Federation model SP IdP MA federation A trusted metadata federation
central metadata
MA: metadata aggregator 7

8. Current solution ↑ core trust fabric ↓ core trust fabric 8 Central MA
federation E
federation F
federation C
federation D MA MA SP
IdP SP
IdP
IdP SP
IdP SP
IdP SP
IdP SP
federation A
federation B 8

9. Proposed solution core trust fabric 9 meta MA federation E
federation F
federation C
federation D MA MA SP
IdP SP
IdP
IdP SP
IdP SP
IdP SP
IdP SP
federation A
federation B 9

10. Proposed solution 4 4’ 5’ 5 3 6 WAYF 2 1 10 meta MA
pub key and URL of MA-A, …
pub key and
URL of meta-MA 4 4’
MD: pub key and URL of MA-A signed by meta-MA
federation A
fed B 5’ 5
MD of IdP
signed by MA-A MA MA 3 6
MD of IdP signed by MA-B
IdP SP
pub key and URL of MA-B
WAYF 2 1 10

11. Reflection ≈20 ≈5,700,000 11 core trust fabric local trust fabric
requires SP
IdP
trust in meta-metadata,
(e.g., in public keys) MA SP
IdP
meta-metadata
(e.g., public keys)
requires MA
≈5,700,000 SP
IdP
SAML data exchange
inter-entity trust
metadata
exchange
trust in metadata,
established through federations
requires
partly requires MA 11 11

12. Reflection # of trust relationships Metadata distribution process
With a central entity (meta-MA): ≈ 20 relationships
Metadata distribution process
No need for a central entity
Between MAs 12

13. Conclusions/recommendations
Use local MAs for meta-data exchange
More scalable
Use meta-MA for trust establishment between MAs
Lightweight, no SPOF, less trust relations to manage
Implement and test the proposed architecture to gain insight to interoperability, protocols, scalability, …
Design a number of core services
E.g., WAYF service, self-registration service, cross federation group management service, join/departure notification service
Trustful metadata distribution for Virtual Collaborations
to gain insight and experience over interoperability issues, required new functionalities, scalability and performance indicators, strategies for metadata aggregation that optimize the costs associated with metadata update and metadata usage, etc. The testbed can be realized in a national setting (e.g., between SURFnet and Kennisnet) or an international setting (e.g. within eduGAIN). 13

14. Questions?
Addressing scalability of metadata exchange