|
1 <title>Issues in Identity Management for DTNs</title> |
|
2 |
|
3 <pre> |
|
4 <b><u>Issues in Identity Management for Delay Tolerant Networks</u></b> |
|
5 |
|
6 <small> |
|
7 Revision History |
|
8 02.06.04 Initial Revision, mh |
|
9 02.12.04 Update following DTN group meetings, mh |
|
10 </small> |
|
11 |
|
12 <u>I. Issues</u> |
|
13 |
|
14 - How do you secure an identity? |
|
15 |
|
16 Identities are |
|
17 |
|
18 - How do you verify an identity? |
|
19 - Within a region how do you validate that a device should have |
|
20 access to resources, given that it has already obtained the |
|
21 relevant token? |
|
22 - Token expiration? Token renewal? Does expiration even make sense in |
|
23 a disconnected context? Perhaps it should be governed on a region by |
|
24 region basis. |
|
25 - Is there a concept of tranference between regions? |
|
26 - Can we use locality and identity to determine which network a |
|
27 particular device can use to obtain credentials? (ie, based on |
|
28 SSID location map, choose number to dial in order to obtain |
|
29 access to a channel for which you have authority to access) |
|
30 |
|
31 |
|
32 <u>II. Identity Management Solutions</u> |
|
33 |
|
34 A. Ensim® Unify and Ensim Server Manager |
|
35 [from Keshav] |
|
36 - Use Active Directory to store identities |
|
37 - Use Unify to manage them |
|
38 - Mobile users get identity from Unify, and then can assert |
|
39 rights to resources without having to log in every time |
|
40 |
|
41 Questions: |
|
42 - How will this operate in the context of mobile stations? |
|
43 - How will this operate in a disconnected context, given that |
|
44 mobile users may never be directly connected to the datacenter? |
|
45 |
|
46 Active Directory and Linux |
|
47 Since Unify is a Windows based management system, with the option? of |
|
48 managing Linux servers as well, then the Linux servers would have to |
|
49 talk to the Windows server - and authenticate against it. |
|
50 |
|
51 http://www.securityfocus.com/infocus/1563 |
|
52 |
|
53 Major Issues |
|
54 - Non-supported by MS |
|
55 - Possibly not multi-platform friendly |
|
56 - AD vs LDAP |
|
57 - AD4Unix needs to be installed on datacenter and seems to |
|
58 be potentially very finicky. |
|
59 |
|
60 General Assessment |
|
61 No clear relationship between Unify and DTN, platform issues, |
|
62 however, some ideas/problems solved may be relevant to DTN. |
|
63 Basic utility is the idea of using Active Directory/LDAP for |
|
64 authentication and authorization. |
|
65 |
|
66 B. Authd (Brent) |
|
67 - software package for obtaining and verifying user credentials |
|
68 based on RSA |
|
69 - cluster-wide RSA public/private key pair allows clients |
|
70 to verify user identity from anywhere |
|
71 |
|
72 C. LDAP |
|
73 - supports SSL, Kerberos, cleartext passwords, and SASL |
|
74 - OpenLDAP (SleepyCat backend) http://www.openldap.org |
|
75 - client/server interaction |
|
76 - client establishes session (BIND) |
|
77 - client performs ldap operation (supported list) |
|
78 - client ends session (UNBIND) |
|
79 - session can be ABANDONed |
|
80 - supports ACLs to control access rights |
|
81 |
|
82 http://quark.humbug.org.au/publications/system_auth/sage-au/system_auth.html |
|
83 |
|
84 Actualization Items |
|
85 - write an LDAP/PAM/NSS DTN proxy for authentication |
|
86 - encapsulate bind and operation(s) into single request |
|
87 - each query/update must be authenticated |
|
88 - asynchronize communication |
|
89 - supports whatever DTN security infrastructure we come up with |
|
90 - determine how acls are communicated |
|
91 - determine token issuing |
|
92 |
|
93 </pre> |