Trusted Systems Laboratory
Hewlett-Packard Labs, Bristol, UK
Adaptive Identity Management:
Vision and
Technology Development
Overview
Marco Casassa Mont
([email protected])
Pete Bramhall
([email protected])
Identity Management Landscape
Identity Management is a
Core Aspect in many
different Contexts, but …
Different Competing
Aspects and Perspectives:
• enterprise focus vs. consumer focus
• mobility vs. centralisation
• legislation vs. self-regulation
• owners’ control vs. organisations’ control
• privacy vs. free market
•…
No One Size Fits All …
03/10/2015
Enterprise &
Business
E-Commerce Integration
Web
Service
Frameworks
Government
&
Legislation
Privacy,
Trust,
Security
Identity
Management
Policies
Adaptive Identity Management - Technologies Overview
Mobility
Appliances,
Devices
page 2
Identity Aspects [1]
Identity Information
• Multiple Attributes
• Multiple Views
• Multiple Contexts
and Stakeholders
• Distributed Control
• Different degrees
of Awareness
Multiple Identities
Associated to Entities
(people, devices,
services, etc.)
03/10/2015
Adaptive Identity Management - Technologies Overview
page 3
Identity Aspects [2]
C o n tro l
Complexity of Identity Information
U n kn o w n
T h ird
P arties
Iden tity Inform ation
K n ow n
T h ird
P arties
T im e
O w ner
C o n texts
P erso na l/
S o cia l
E n terp rise
E -C o m m erce
G o vern m en t
Identity Information is Subject
to Changes, over time
03/10/2015
Adaptive Identity Management - Technologies Overview
page 4
Current Identity Management
•Identity Management is
Part of a Complex Ecosystem
P olicies
B usiness T asks
R equirem ents
N eeds
T ransactions
Interactions
•Many Technology, Products,
Solutions …
•Lack of Flexibility, Interoperability
and Management Integration
B u sin ess S o lu tion s
S erv ices
Id en tity
M id d lew are
S ecurity
T rust
P rivac y
A p p lication s
C hanges,
E vents,
T hreats
OSs
P latform s
N etw orks
P rovision in g
A ccou n tin g
L ife-cy cle
M an agem en t
IT S tack
M an agem en t an d cu sto m isation
Smart Cards
S in gle S ign O n (S S O )
PKI
Biometrics
A u th en tication
A u th orization
Liberty
IBE
A u d it
SAML
RBAC
C on tro l
Web Services
P3P
Trusted Platforms
M eta -d irecto ries
NGSCB
DBs
D irectory S erv ices
O th er
S torag es
TCPA/TCG
D ata R ep resen tation an d C on solid a tion s
03/10/2015
Adaptive Identity Management - Technologies Overview
EPAL
XML
…
page 5
Emerging Trends and Issues
Trends
• On Demand, Adaptive Infrastructures
• Ubiquitous and Pervasive Computing
• Trusted Platforms and Systems
• Digital Rights Management
•…
Issue
s
• Privacy
• Identity Thefts and
Frauds
• Lack Of Control
• Accountability
• Complexity
03/10/2015
Adaptive Identity Management - Technologies Overview
page 6
Emerging Requirements
• Integration
• Rationalisation
• Flexibility
• Context
Awareness
• Privacy
Management
• Control
Over Identity Flow
• Delegation
Of Control
• Accountability
Management
• Simplicity\Usability
03/10/2015
Adaptive Identity Management - Technologies Overview
page 7
Our Vision
Adaptive
Identity Management
03/10/2015
Adaptive Identity Management - Technologies Overview
page 8
Vision: Adaptive Identity Management (AIM)
Core Properties
• Integrated and
Collaborative
Management of
Identity Management
Tasks
• Policy-Driven
Management
• Context
Awareness
03/10/2015
Adaptive Identity Management - Technologies Overview
page 9
Vision: Adaptive Identity Management (AIM)
• Open API
• Standardisation
• Management Proxies
• Cooperation at different
Levels of Abstraction
• Policy Languages
• Integration of Identity,
Trust, Privacy, Security
Aspects
• Delegation of
Policy Refinement
03/10/2015
Adaptive Identity Management - Technologies Overview
• Scalability Across
Boundaries and
Domains
page 10
Moving Towards AIM: Accountable Identity
and Privacy Management [1]
S cen a rio : M u ltip a rty T ra n sa ctio n
/ In tera ctio n
S ervices
U ser
N eg otiation of
P riv acy P olicy
S ervices
E nterprise
P o lic ies
P rov ision of
Id entity & P rofile
D a ta
•
Privacy Protection via High-Level,
Sticky Policies
•
Accountability Enforcement via TTPs
•
User Control
Iden tity /
P rofile
D isclosu re
D a ta
O b fu scated D ata P ackage
+
S ticky P olicies
S ervices
B row ser
E n terp rise
D isclosu re
M on itorin g/
C on trol
service
E nterprise
L ocal
Id en tity
an d P rofile
In form ation
T racin g, F rau d D etectio n , F o ren sic A n alysis
P lu g-in
P olic y
E n gin e
1
D isclosu re
M on itorin g/
C on trol
C om m .
M od u le
U ser site
•
Leverage IBE to Enforce
Sticky Policies
•
Leverage Tagged OS
•
Leverage HSA
03/10/2015
3
N otification s an d
A u th orization s
Leverage Trusted Platforms
C ustom ers
D atab ase
R eceiver Site(s)
4
•
IB E C ryp to
M od u le
C red en tial
D atab ase
T racin g
A u ditin g
M od u le
IB E
C ryp to
M od u le
Adaptive Identity Management - Technologies Overview
D ecryp tion
K ey
C om m .
M od u le
T am p er R esistan t
S torage
2
R equ est for D ecryp tion K ey:
< D isclosu re P olicies
(S ticky P olicies)
and cred en tials>
D isclosu re
M on itorin g/
C on trol
P olic y
E n gin e
T rust A uthority(s)
[T racing and A uditing
A uthorities]
page 11
Moving Towards AIM: Accountable Identity
and Privacy Management [2]
Integration of Multiple Constraints
at Different Levels of Abstraction
S tick y P olicy A u th orin g
via Sticky Policies
U ser’s D ata
P1
P 1 .1
P2
P 1 .2
P3
P 2 .1
P 1 .1 .1
P 3 .1
P 2 .1 .1
P 3 .2
A ttribu te1 V a lu e1
P 3 .2 .1
R efin em en t In stru ction s
P olicy T em plate s
P olicy W iz ard
Q u estion s
U ser
D ata package
(S tick y P o licies +
O bfu scated D ata)
G
U
I
P olic y A uthorin g
E ngin e
C onte xt
D ata P ackaging
IB E C rypto M odules
Authoring of Sticky Policies based
on Templates and Policy Wizard
03/10/2015
Adaptive Identity Management - Technologies Overview
page 12
Technology Development
Overview
03/10/2015
Adaptive Identity Management - Technologies Overview
page 13
Hardware Security Appliance (HSA) Concept
Systems can
be subverted
HSA
App
Control
Other
Processes
Worm
Virus
Hacker
App
Process
policy
HSA Service
API
System
Server
03/10/2015
Adaptive Identity Management - Technologies Overview
Administrator
page 14
HSA – Trust Domains
IT Infrastructure
HSA Based Service
Service API
Service
(Key use, Authentication,
Authorisation, Audit....
Management Policies
Service Identity
Management Interface
(Constrained by Policy)
Signed Chain of
Management events
System
Administrators
Domain
03/10/2015
Networ
k
Service Administrator
Adaptive Identity Management - Technologies Overview
page 15
TCPA/TCG - Implementation Status
•
Trusted Platform Modules (TPM) based on 1.1b specification
available
–
–
–
•
National Infineon Atmel
Compliant PC platforms shipping now
–
–
•
Atmel
Infineon
National Semiconductor
HP-Protect Tools Embedded Security available on D530 business
desktops
IBM ThinkPad notebooks and NetVista desktops
Increasing application support
–
RSA Secure ID, Checkpoint VPN, Verisign PTA
Note: Modules shown are for test & debug.
Actual system implementation may vary.
03/10/2015
Adaptive Identity Management - Technologies Overview
page 16
Secure Data Tagging
Data comes with tags that reflect policies
All data is tagged; the tag specifies how to handle
data whether it is private, confidential, sensitive etc
Works with standard applications
Transparent and automatic
application of policy to data
No action is needed by users or
applications for this to happen and
there need be no change application
or user behaviour
03/10/2015
Policy is enforced by the OS kernel
irrespective of application behaviour
Even a compromised application can’t
leak your confidential data - a virus might
send emails on your behalf, but it can’t
send any confidential data in them (it’ll
be encrypted or never sent, depending on
policy)
Adaptive Identity Management - Technologies Overview
page 17
Policy distribution and enforcement
Policy Creation and
Translation System
policies
created
in dflow
In the ideal business
environment,
standard policies
are published from
a central location
and dynamically
propagated to
policy aware
devices
03/10/2015
Policy
File in
Internal
compiler
Every taggingaware device to be
governed by a
data usage policy
Format
Control Enforcement
Tagged Data
Flow causing
operation
Adaptive Identity Management - Technologies Overview
Policy
evaluation
engine
Decision
yes, no,
more checks
page 18
What is Identifier-based Encryption (IBE)?
• It
is an Emerging Cryptography Technology
 HP Approach based on Elliptic-Curve Crypography
• Based
on a Three-Player Model: Sender, Receiver, Trust
Authority (Trusted Third Party)
• Same
Strength as RSA
• Usage:
for Encryption/Decryption, Signatures,
Role-based Applications, Policy Enforcement, etc.
03/10/2015
Adaptive Identity Management - Technologies Overview
page 19
IBE Core Properties
•
1st Property: Any Kind of “String” (or Sequence of Bytes) Can Be
Used as an IBE Encryption Key: for example a Role, Terms and
Conditions, an e-Mail Address, a Picture, a Disclosure Time
•
2nd Property: The Generation of IBE Decryption Keys Can Be
Postponed in Time, even Long Time After the Generation of the
Correspondent IBE Encryption Key
•
3rd Property: Reliance on at Least a Trust Authority (Trusted Third
Party) for the Generation of IBE Decryption Key
03/10/2015
Adaptive Identity Management - Technologies Overview
page 20
IBE Three-Player Model
Alice
2
4
3
2. Alice knows the Trust Authority's
published value of Public Detail N
It is well known or available from
reliable source
3. Alice chooses an appropriate Encryption
Key. She encrypts the message:
Encrypted message
= {E(msg, N, encryption key)}
4. Alice Sends the encrypted Message
to Bob, along with the Encryption Key
Bob
5
5. Bob requests the Decryption
Key associated to the
Encryption Key to the relevant
6 Trust Authority.
6. The Trust Authority issues
an IBE Decryption Key
Trust 1
corresponding to the supplied
Authority
Encryption Key only if it is
happy with Bob’s
1. Trust Authority
entitlement to the Decryption Key.
- Generates and
It needs the Secret to perform the
protects a Secret computation.
- Publishes a
Public Detail N
03/10/2015
Adaptive Identity Management - Technologies Overview
page 21
Active Digital Credentials
A ttrib u tes
A ttrib u te
N am e
A ttrib u te
V alu e
L o ca l
P ro cessin g
Active Digital Credential: Up-to-Date
V alid ity /
B an k
Tru st
C red it
Lim it
Certified Information
C red it
R atin g
Lo catio n
…
E n terp rise
R ely ing P a rties
G overn m en t
C red ential O w ner
D isclosu re
C red ential Issuer
R eq u est
L ocal/R em ote
In teractions
Issu an ce
In terp retation
Integration of Procedures
Within Digital Credentials to Retrieve
Certified Up-to-Date Information along
with its Trust Evaluation
03/10/2015
L ifecy cle
M anage m en t
A ctiv e
D ig ital
C red ential
E m b ed d ed C o d e
L oca l P rocessing
D yn a m ic
C on tent
P rovision
T rusted
Infor m ation
P ro vid ers
Adaptive Identity Management - Technologies Overview
page 22
Descargar

Document