TAS 3 Trusted Architecture for Secure Shared Services (with Privacy), Future of Internet PPP, and Internet of Subject Personal Data Store Sampo Kellomäki (sampo@zxidp.org) 11. October 2010, IIW London 09
TAS 3 Intro and Vision • EU FP7 project runs until end of 2011 • Architecture - Identity Management, Authorization, and Audit plumbing - Holistic combination of existing technologies • STD based profiles (SAML2, Liberty ID-WSF2, UMA, XACML2, ...) • Reference implementation in open source (C/C++, PHP, Java, .Net) - zxid.org (Apache2 non-viral open source license) • Vision of empowering users and building trust networks - Pair-wise pseudonymous: uncorrelatable w/o user consent - Internet of Subjects Foundation: not-for-profit governance - Competitive Svcs Market Place: discover services you trust - Delegation: help your loved ones, accept help, represent org - Trust scoring and trust building: make informed choices - Privacy Preserving: user in control, no unexpect correlation IIW London, October 10, 2010 Sampo Kellomäki: TAS3 Arch., FI-PPP, and IoS PDS 09 2
Empowering user to take control of his data • Fully pair-wise pseudonymous design - Prevent correlation and collusion at all layers of deep SOA • Model where user gives his data from his Personal Data Store - User well positioned to impose policies when releasing data - Only store data once, and in place that user chooses • Personas, partial identities • Privacy protection through noncorrelatability, access control, and sticky policies • User self audit dashboard gives user visibility to use of his data - Independent means, to keep the service providers in check • Digitally signed audit trail to ensure legal enforeability IIW London, October 10, 2010 Sampo Kellomäki: TAS3 Arch., FI-PPP, and IoS PDS 09 3
TAS³ Architecture Mini 2010 User is King Identity Provider (Authentication) = Access Controll and Authorization "Front Channel" SSO Self-audit Web Site 2 Web Site 1 Dashboard "Backchannel" Personal Service O Discovery C Web Service 4 Web Service 3 T Trust, Scoring, and Reputation Web Service 5 Audit (comprehensive and ecosystemwide) Governance & Interoperable Technology IIW London, October 10, 2010 Sampo Kellomäki: TAS3 Arch., FI-PPP, and IoS PDS 09 4
TAS3 Layering Human Layer N.B. Not all architectural components are depicted. In particular none of the infrastructure related to authorization is shown. Web Browser User Agent Layer Client Side Application Front Channel Communication TAS3 Security Layer SSO Connector Frontend 1 User Policy Consent Aggregation Delegation Identity Dashboard Editor Manager & Discovery Settings Provider GUI Layer Web GUI Settings Application Layer Frontend Application TAS3 Security Layer TAS3 API Web Services Stack Layer Web Services Client Stack Back Channel Communication Layers (SOAP, HTTPS) Discovery Web Service Provider 2 Web Service Provider 3 Registry Web Services Stack Layer Web Services Provider Stack Web Services Client Stack Web Services Provider Stack & ID Mapper TAS3 Security Layer TAS3 API TAS3 API TAS3 API Application Layer Backend Application Backend Application Legacy / Data Layer Legacy Application 20100503 SK IIW London, October 10, 2010 Sampo Kellomäki: TAS3 Arch., FI-PPP, and IoS PDS 09 5
TAS3 Architecture 2010 Web Browser or Fat Client Client side app (e.g. AJAX) Component Overview v2.3 Organization Domain Runtime & Enforcement Modelling Payload Applications Core TAS3 Infrastructure TAS3 User Tools & Config. Mgmt User Audit Front End Identity Provider Trust Dashboard (e.g. Web GUI) Network Mgmt Business Process Policy Editor & Identity Processes Engine Consent Management Aggregator Config. Web Services Delegation Settings Trust & Reputation Data Biz. Proc. Models Core TAS3 Infrastructure Backchannel Policies Authorization Delegation Service ID Mapper Modelling Credentials & Policies Discovery Registry Ontology Handler Tools Negotiator Org. Level Event Bus Audit Events Management Events Ontology Audit & (Operation Monitoring) (Audit Analysis) Online Compliance Testing Monitor IIW London, October 10, 2010 Sampo Kellomäki: TAS3 Arch., FI-PPP, and IoS PDS 09 6
Built-in rules of the application Built-in rules of the service Service Client App Rules of the operator Rules of the operator Org D PDP Org C PDP Alice Bob TN PDP PEP Rs Out Rules of the TN PEP 1 2 Master Master Rq Out 4 3 PDP PDP Trust PDP PEP PEP Rq In Rs In Alice PDP Bob PDP Personal rules Personal rules Corp D Firewall Corp C Firewall 20100531 Sampo or Packet Filter or Packet Filter IIW London, October 10, 2010 Sampo Kellomäki: TAS3 Arch., FI-PPP, and IoS PDS 09 7
XACML SAML profile TAS3 Integration w/ZXID zxididp zxididp with TAS3 Trust extensions 20091016 SK SAML 2.0 TUE Discovery Trust PDP IdP 3 ID-WSF 2.0 Discovery with TAS3 Trust SP1: Frontend SP2: Web Service extensions Inter- Payload 1 ceptor Servlet CTX DB Inter- ID-WSF 2.0 7 JSESSION ceptor w/TAS3 ext ZXSES H A H WSPout PEP-rs-out P P W e S s e D P P T T t E E S t I S E e t E 2 T T t P P c C O P s c P C WSPin PEP-rs-in P r P User XACML SAML profile zxid_az() zxid_az() mod_auth_saml ZXID zxid_call() or ssoservlet ZXID zxid_wsp_decorate() Servlet AXIS2 Master Master KENT zxid_simple() KENT Filter PDP2 Module PDP1 zxid_wsp_validate() IIW London, October 10, 2010 Sampo Kellomäki: TAS3 Arch., FI-PPP, and IoS PDS 09 8
Liberty Liberty Identity Service Interface Federation Specifications (ID-SIS) Framework Enables interoperable identity services such as ID-FF personal identity profile, contact book, SAML 2.0 presence, and so on Enables identity federation and management through Liberty Web Services features such as Framework (ID-WSF) identity/account linkage Simplified Sign-On, and simple session Provides the framework for building interoperable management. identity services, permissions based attribute sharing, identity service description and discovery, and the associated security profiles. Liberty specifications build on existing standards (SAML, SOAP, WS-Addressing, WS-Security, XML, etc.) Figure 1: Liberty Alliance Architecture (for comparison of similarity). IIW London, October 10, 2010 Sampo Kellomäki: TAS3 Arch., FI-PPP, and IoS PDS 09 9
TAS 3 Data Sheet Ideas • What: Use the "TAS 3 Intro and Vision" slide • Diagram: Pick mini arch, use comp if there is space IIW London, October 10, 2010 Sampo Kellomäki: TAS3 Arch., FI-PPP, and IoS PDS 09 10
TAS 3 Benefits (short) • User as an equal stakeholder enables more equal opportunity to participate in Internet based Services Economy - Easier to innovate economic activity (individuals, SMEs) - New kinds of markets, expansion, get out of zero-sum-game - Ubiquotus use: becomes part of way of life and the way to do things, eliminating haphazard and confusing point-solution sys- tems • Solid layer - Avoid fraud, avoid data handling accidents, increase trust - Increase usage and business - EU Regulatory Compliance on by default - Not repudiatable, accountable: Tie-in to legal system, strong authentication • Realistic and available now IIW London, October 10, 2010 Sampo Kellomäki: TAS3 Arch., FI-PPP, and IoS PDS 09 11
- Standards based, reviewed, IPR safe, multivendor, plug and play - Open source reference implementation available ( zxid.org ) - Certification programs available - Has been deployed in real world IIW London, October 10, 2010 Sampo Kellomäki: TAS3 Arch., FI-PPP, and IoS PDS 09 12
TAS 3 Benefits (long): User • User as an equal stakeholder enables more equal opportunity to participate in Internet based Services Economy - Control personal data - Even delete your data - Easier to innovate economic activity (self-employment, SMEs) - New kinds of markets, expansion, get out of zero-sum-game • Life in high trust societies tends to be easier and more pleasant • Easier to use technology that is adequately safe • Ubiquitous use: becomes part of way of life and the way to do things, eliminate haphazard, confusing, point-solution systems • Uniform user experience and data sharing practices lead to aware- ness and feeling of control (which feeling is based on real ability to control, not just impression) • Awareness leads to responsible action, which minimizes unin- tended consequences IIW London, October 10, 2010 Sampo Kellomäki: TAS3 Arch., FI-PPP, and IoS PDS 09 13
TAS 3 Benefits (long): Service Provider (B2C) • Higher trust has network effect, enabling expansion • Operate on internet scale - Reach new audiences and markets - Reach bigger audiences - Find and address smaller, niche, audiences and markets prof- itably (long tail) - New kinds of markets, expansion, get out of zero-sum-game • Businesses can focus on business as the regulatory compliance is taken care of • Practical technology that works: it interoperates and you can buy it from multiple vendors • Lower costs from efficiencies • Control your risks IIW London, October 10, 2010 Sampo Kellomäki: TAS3 Arch., FI-PPP, and IoS PDS 09 14
Recommend
More recommend
