1. © SafeNet Confidential and Proprietary KMIP Entity Object and Client Registration Alan Frindell Contributors: Robert Haas, Indra Fitzgerald SafeNet, Inc 11/17/2010

2. 2 © SafeNet Confidential and Proprietary What can you do with an entity? Require subjects passed in TLS and/or Credential to be registered entities Register or generate data that can be used during authentication, possibly to a third party system Restrict operations that create objects, including other entities Register Attributes that can be searched and retrieved Possible policy relevant attributes like FIPS Level, hardware capabilities, server to client operation support Register extended data that can be logged by the server Supply connection details for Server to Client messages Ask server to notify entity when one or more objects change

3. 3 © SafeNet Confidential and Proprietary How are entities created?  Manually entered by server administrator  Imported from a third-party directory by a server administrator  Explicitly registered by a KMIP client with appropriate permissions Some server implementations may require administrator approval before the entity is registered May require asynchronous polling by clients to be effective  Implicitly registered by a KMIP client by sending a new Credential object in a request

4. 4 © SafeNet Confidential and Proprietary Credential Redefinition (original proposal) Username and Password Credential Value still supported for backwards compatibility ObjectEncodingREQUIRED CredentialStructure Credential TypeEnumerationYes Authentication Information Type EnumerationNo Credential ValueStructureYes ObjectEncodingREQUIRED Credential ValueStructure Subject ValueVaries according to Credential Type Yes Subject Authentication Information Varies according to Authentication Information Type No

5. 5 © SafeNet Confidential and Proprietary Credential Redefinition (new proposal) Much cleaner Username and Password Credential Value no longer supported ObjectEncodingREQUIRED CredentialStructure Subject TypeEnumerationYes Subject ValueVaries according to Subject Type No Subject Authentication Information Type EnumerationYes Subject Authentication Information Value Varies according to SAI type No

6. 6 © SafeNet Confidential and Proprietary Credential/Subject Types Credential/Subject TypeValue Username and Password (KMIP v1)00000001 Username00000002 Device00000003 World Wide Name00000004 Distinguished Name00000005 SAML Subject00000006 Open ID00000007 Authentication Information TypeValue Password00000001 X.509 Certificate00000002 Kerberos Ticket00000003 Extensions8XXXXXXX

7. 7 © SafeNet Confidential and Proprietary Entity Definition  Entity Attributes: UUID, Name, Object Type, Operation Policy, Initial Date, Destroy Date, App Specific Info, Contact Info, Last Change Date, Custom Attributes New: Up for discussion: Archive Date, Object Group, Entity Operation Policy  Entity Operations: Register, Locate, Get, Get Attributes, Get Attributes List, Add Attribute, Modify Attribute, Delete Attribute, Destroy ObjectEncodingREQUIRED EntityStructure CredentialStructureYes, May be repeated

8. 8 © SafeNet Confidential and Proprietary New: Default Operation Policy for Entity Objects (for operations on the Entity object) OperationObject TypePolicy LocateEntityAllowed to all GetEntityAllowed to owner only Get AttributeEntityAllowed to all Get Attribute ListEntityAllowed to all Add/Mod/Del AttributeEntityAllowed to owner only DestroyEntityAllowed to owner only Operation Policy = what operations are allowed on the Entity

9. 9 © SafeNet Confidential and Proprietary Default Entity Operation Policy OperationObject TypePolicy CreateSymmetric KeyAllowed to all Create Key PairPublic Key, Private KeyAllowed to all RegisterAll, except EntityAllowed to all CertifyPublic KeyAllowed to all Re-certifyCertificateAllowed to all ValidateCertificateAllowed to all QueryN/AAllowed to all CancelN/AAllowed to all PollN/AAllowed to all Entity Operation Policy = what operations the Entity is allowed to perform

10. 10 © SafeNet Confidential and Proprietary Entity / Creator Relationship  KMIP v1 loosely defines Creator as ‘identity of the client’  With Entity, it is possible to define Creator explicitly as: The UUID of the Entity who created the object The Subject of the Entity who create the object In this case, a given Entity will have access to different objects depending on how he authenticated  Creator of an Entity may be different than the Entity itself, which may be confusing  Can an Entity have more than one Credential/Subject of a given type? Ex: More than one username?