Common Secure Interoperability Version 2 CSI v2

Transcription

1 Common Secure Interoperability Version 2 CSI v2 A User s View by Don Flinn

2 The Specification Team Compaq Concept Five Gemstone Hewlett Packard IBM Inprise IONA/OOC Oracle Persistence Promia SUN Syracuse/Adiron

3 CSI v2: What, Why, How What Secure Interoperable Wire Protocol Why Support authentication, delegation & privileges Define a CSI Architecture Support SSL & Interoperate with EJB How Tightly Define Wire Protocol, Messages, IDL Support Interoperability using SSL and optionally SECIOP

4 CSIv2 Status CSI v2 has been passed by vote of the OMG Architecture Board CSI v2 has been accepted/referenced by EJB version 2.0 CSI v2 is undergoing the FTF process of the OMG Editorial Correct Errors in Found in Implementation

5 What CSIv2 Can Do For You Secure Interoperability CORBA to CORBA EJB / CORBA Extended Attributes for Authorization Standard Credential (PAC) Delegation Both Simplified and Extended Federation Lay the Groundwork

6 CSIv2 Flexibility Different Transport Layer Protocols SSL Required X.509 Certificates Supported by GSSUP username/password SECIOP Kerberos, SPKM, CSI-ECMA Stateful or Stateless Degrees of Authorization UserName to PACs Multiple Forms of Delegation

7 Secure Attribute Service (SAS) Protocol Security Attribute Layer Supplemental Client Authn Layer Identity Assertion Pushed Privilege Attr. Proxy Endorsement Client Authentication SAS Service Context Protocol Transport Layer Message Protection Target-to-Client Authn Client Authentication SSL/TLS or SECIOP

8 SAS Messages EstablishContext Sent by Client to Establish Context CompleteEstablishContext Sent by Target to Acknowlege MessageInContext Sent by Client in Stateful Session ContextError Sent by Target if Error in Establish Context

9 Simple Example Client Securely Interoperate w/ Target Pass Security Data Use the Service Context in Request/Reply Header & Optionally Transport Layer Type of Data Authentication Transport Layer (SSL Certificate) Authentication Layer (GSSUP) Authorization Name Privilege Attribute Certificate (PAC)

10 UserName/Password GSSUP // GSSUP::InitialContextToken struct InitialContextToken { Security::UTF8String username; Security::UTF8String password; CSI::GSS_NT_ExportedName target_name; }; target_name contains the name of the authentication domain in which the client is authenticating.

11 Privilege Attribute Certificate (PAC) AttributeCertificate ::= SEQUENCE { acinfo AttributeCertificateInfo, signaturealgorithm AlgorithmIdentifier, signaturevalue BIT STRING } AttributeCertificateInfo ::= SEQUENCE { version AttCertVersion DEFAULT v1, holder Holder, issuer AttCertIssuer, signature AlgorithmIdentifier, serialnumber CertificateSerialNumber, attrcertvalidityperiod AttCertValidityPeriod, attributes SEQUENCE OF Attribute, issueruniqueid UniqueIdentifier OPTIONAL, extensions Extensions OPTIONAL }

12 Simple Interoperability CSIv2 Credentials Tokens Security Attribute Layer (Empty) Client (Initiator) P1 Authentication Layer P1 authentication token (or) Transport Layer P1 Transport identity (certificate) Target

13 Push Privilege Attributes CSIv2 Credentials Tokens Client (Initiator) P1 Security Attribute Layer P1 (PAC) Authorization token Authentication Layer P1 authentication token (or) Transport Layer P1 Transport identity (certificate) Target

14 Delegation Delegation Data Identity Token or PAC Types of Delegation Authorization token-based delegation Forward trust evaluation Identity assertion-based delegation Backward trust evaluation Presumed trust

15 Identity Token Carries the Spoken For or Asserted Identity Identity Token Types Absent Anonymous Principal Name Distinguished Name X.509 Certificate Name

16 Delegation - Backward Trust CSIv2 Credentials Tokens Security Attribute Layer P1 Identity tokens Client (Initiator) P1 Intermediate P2 Authentication Layer P2 Client authentication token Target (Rules) (or) Transport Layer P2 Transport identity (certificate)

17 Delegation - Forward Trust CSIv2 Credentials Tokens Client (Initiator) P1 Intermediate P2 Security Attribute Layer P1 PAC (Any) / P1 identity tokens Authentication Layer P2 authentication token (or) Target Transport Layer P2 Transport identity (certificate)

18 Delegation - Restricted CSIv2 Credentials Tokens Security Attribute Layer P1 PAC (Restrictions)/ P1 identity tokens Client (Initiator) P1 Intermediate P2 Authentication Layer P1 Authentication token Target Transport Layer P1 Transport identity (certificate)

19 Delegation con t Examples of CSIv2 Credentials Passed from Intermediate to Target Security Layers 1 No delegation Security Attribute Layer Authorization/ identity tokens Authentication Identity Client authentication token or transport identity Target Validation Checks 2 No delegation, push privilege attributes 3 Identity assertionbased delegation, backward trust evaluation 4 Authorization token-based delegation, forward trust evaluation -- P2 PAC P1 identity token P1 PAC, "Any" proxy attribute; P1 identity token 5 Authorization token based delegation (restricted), forward trust evaluation P1 PAC, P2 identity proxy attribute; P1 identity token P2 identity P2 identity P2 identity P2 identity P2 identity -- P2 PAC belongs to P2 identity P2 permitted to speak for P1 identity based on rules of the target; presumed trust if target has no rules P1 PAC belongs to P1 identity; "Any" proxy attribute permits any intermediate to use P1 PAC (unrestricted delegation) P1 PAC belongs to P1 identity; P2 identity proxy attribute permits P2 to use P1 PAC (restricted delegation)

20 Level 0 Conformance SSL/TLS & GSSUP Stateless SAS - Identity Assertion Level 1 Authorization Token (Push) Level 2 PAC with Delegation Stateful Conformance