Seven Perspectives on CardSpace Ronny Bjones Security Strategist Microsoft Corporation.
-
Upload
jesus-wood -
Category
Documents
-
view
215 -
download
0
Transcript of Seven Perspectives on CardSpace Ronny Bjones Security Strategist Microsoft Corporation.
Seven Perspectives onSeven Perspectives onCardSpaceCardSpace
Ronny BjonesRonny Bjones
Security StrategistSecurity Strategist
Microsoft CorporationMicrosoft Corporation
““The Laws of Identity”The Laws of Identity”The original researchThe original research
1.1. User control and consentUser control and consent
2.2. Minimal disclosure for a defined useMinimal disclosure for a defined use
3.3. Justifiable partiesJustifiable parties
4.4. Directional identityDirectional identity
5.5. Pluralism of operators and technologiesPluralism of operators and technologies
6.6. Human integrationHuman integration
7.7. Consistent experience across contextsConsistent experience across contextsJoin the discussion atJoin the discussion at www.identityblog.comwww.identityblog.com
Seven Perspectives on CardSpaceSeven Perspectives on CardSpace
1.1. Component of the identity metasystemComponent of the identity metasystem
2.2. Abstraction layer for authentication technologiesAbstraction layer for authentication technologies
3.3. Anti-phishing technologyAnti-phishing technology
4.4. User convenienceUser convenience
5.5. SecuritySecurity
6.6. PrivacyPrivacy
7.7. Development FrameworkDevelopment Framework
Perspective #1Perspective #1CardSpace as a component of CardSpace as a component of
the Identity Metasystemthe Identity Metasystem
•The need of an identity layer on the InternetThe need of an identity layer on the Internet
•InteroperabilityInteroperability
•Technology & Platform independenceTechnology & Platform independence
The Identity MetasystemThe Identity Metasystem
InternetServices
PartnersCustomers
Identity Metasystem
Extending the Reachof Information Workers
Extending the Reach of Applications
WS-* Web ServicesArchitecture
Framework for InteroperabilityFramework for Interoperability
TCP/IP of IdentitiesTCP/IP of Identities
Defined on open standards – WS*Defined on open standards – WS*
Extended by CardSpace’s definition of CLAIMSExtended by CardSpace’s definition of CLAIMS
http://download.microsoft.com/download/5/4/0/54091e0b-464c-4961-a934-d47f91b66228/infocard-techref-beta2-published.pdf
CardSpace is security token agnosticCardSpace is security token agnostic
SAML, Kerberos, X.509, customSAML, Kerberos, X.509, custom
Identity Providers can bridge different identity silosIdentity Providers can bridge different identity silos
Multiprotocol Federation Interoperability DemonstrationMultiprotocol Federation Interoperability Demonstration
Burton Group – Gerry Gebel - November 1th 2005Burton Group – Gerry Gebel - November 1th 2005
Protocol Drill DownProtocol Drill Down
Identity Provider(IP)
Relying Party(RP)
ClientClient would like to access a resource
RP provides identity requirements: format, claims & issuer of security token
1
2
User
3 Client shows which of known IPs can satisfy requirements
User selects an IP4
5Request to IPSecurity Token Service for security token providing user credentials
6
IP generates security token based on RP’s requirementswith display token and proof of possession for user
7User views display token andapproves the release of token
8
Token is released to RP with proof of possession RP reads claims and allows access
• Contains claims about my identity that I assert
• Not corroborated• Stored locally• Signed and encrypted to
prevent replay attacks
• Provided by banks, stores, government, clubs, etc
• Locally stored cards contain metadata only!
• Data stored by Identity Provider and obtained only when card submitted
CardSpace CardsCardSpace Cards
SELF - ISSUED MANAGED
Platform & Technology IndependentPlatform & Technology Independent
Third-party support for FirefoxThird-party support for Firefox
http://perpetual-motion.com/kevin/
Information Card support on MAC-SafariInformation Card support on MAC-Safari
http://www.identityblog.com/?p=579
Open Source InitiativesOpen Source Initiatives
Higgens Trust Framework ProjectHiggens Trust Framework Project
Perspective #2Perspective #2CardSpace as an abstraction CardSpace as an abstraction
layer for authentication layer for authentication mechanismsmechanisms
•Orchestrate the dead of the passwordOrchestrate the dead of the password
•Multi-factor AuthenticationMulti-factor Authentication
Root Causes of e-Identity TheftRoot Causes of e-Identity TheftLack of Lack of AwarenessAwareness
Vulnerabilities/Vulnerabilities/SpywareSpyware
Weak foundation Weak foundation provided by provided by password password systemssystems
Admin password
Admin.R386W
992 Days After Product Release
87
Released11/29/2000
Released09/28/2003
51
Abstraction LayerAbstraction Layer
eID CardseID Cards
Microsoft’s supportMicrosoft’s support
Enterprise ScenariosEnterprise Scenarios
Consumer ScenariosConsumer Scenarios
Perspective #3Perspective #3CardSpace as an anti-phishing CardSpace as an anti-phishing
technologytechnology
• Move away from ID/PasswordsMove away from ID/Passwords
• Human integrationHuman integration
How to remember all these passwords?How to remember all these passwords?
Identity CrisisIdentity Crisis
The Internet is a dangerous place!The Internet is a dangerous place!
Identity theft, spoofing, phishing, phraud, malwareIdentity theft, spoofing, phishing, phraud, malware
Username + password is weak and overwhelmedUsername + password is weak and overwhelmed
Poor choicePoor choice
Poor managementPoor management
Poor (re-)usePoor (re-)use
How do we safely, reliably identify a site to a user… How do we safely, reliably identify a site to a user…
……and a user to a site?and a user to a site?
““Good phishing sites fooled 90% of participants” - Good phishing sites fooled 90% of participants” - HarvardHarvard
Human Integration Human Integration
A simple, A simple,
consistent, consistent,
secure waysecure way
to represent identityto represent identity
Support cryptographicSupport cryptographic
verifiable, yet user-friendlyverifiable, yet user-friendly
Security TokensSecurity Tokens
Wallet MetaphorWallet Metaphor
A set of A set of claimsclaims someone someone makes about memakes about me
Claims are packaged as Claims are packaged as security tokenssecurity tokens
Many identities for many usesMany identities for many uses
Useful to distinguish from Useful to distinguish from profilesprofiles
Windows “CardSpace”Windows “CardSpace”
Enables federated claims-based identityEnables federated claims-based identityLingua franca for identity, roles & attributes that Lingua franca for identity, roles & attributes that builds on EIDbuilds on EID
Any identity/service provider can integrate using Any identity/service provider can integrate using public WS-* protocolspublic WS-* protocols
Identity provider support for:Identity provider support for:Windows Server with Active DirectoryWindows Server with Active Directory
PingID for Linux, UNIX, Apache, othersPingID for Linux, UNIX, Apache, others
More to come…More to come…
New credential common dialogNew credential common dialogOne-click loginOne-click login
Streamlines user registrationStreamlines user registration
Mitigates some common attackMitigates some common attackvectors (e.g. phishing)vectors (e.g. phishing)
Additional privacy benefits
Perspective #4Perspective #4CardSpace as a user CardSpace as a user
convenience technologyconvenience technology
DemoDemo
Perspective #5Perspective #5CardSpace as a security CardSpace as a security
technologytechnology
• Move away from ID/PasswordsMove away from ID/Passwords
• Secure Desktop integrationSecure Desktop integration
Secure CardSpace EnvironmentSecure CardSpace Environment
Runs under separate Runs under separate desktop and restricted desktop and restricted accountaccount
Isolates CardSpace Isolates CardSpace runtime from Windows runtime from Windows desktopdesktop
Deters hacking attempts Deters hacking attempts by user-mode processesby user-mode processes
Perspective #6Perspective #6CardSpace as a privacy CardSpace as a privacy enhancing technologyenhancing technology
• User control on revealing identity User control on revealing identity information information
• No unique identifiersNo unique identifiers
• Fine-grained Claims – mandates & identity Fine-grained Claims – mandates & identity attributesattributes
Many privacy concerns with existing identity Many privacy concerns with existing identity systemssystems
Microsoft PassportMicrosoft Passport
The systems reveal too much privacy-related informationThe systems reveal too much privacy-related information
Linkability of transactions because of unique identifier Linkability of transactions because of unique identifier (e.g. public keys)(e.g. public keys)
Privacy attributes of CardSpacePrivacy attributes of CardSpace
The user controls which data to reveal to the relying The user controls which data to reveal to the relying partyparty
No need for the relying party to copy all privacy related No need for the relying party to copy all privacy related informationinformation
A different identifier used for each relying partyA different identifier used for each relying party
Allows for fine-grained identity attributesAllows for fine-grained identity attributes
E.g. Claim (“Subject above 18”)E.g. Claim (“Subject above 18”)
Perspective #7Perspective #7CardSpace as a development CardSpace as a development
frameworkframework
• Integration into .NET Framework 3.0Integration into .NET Framework 3.0
• IE7 IntegrationIE7 Integration
• Easy integrationEasy integration
.NET At The Core.NET At The Core
• XPXP
• VistaVista
• W2k3W2k3
Building a Relying PartyBuilding a Relying Party
Four key tasksFour key tasks
Update user databaseUpdate user database
Create an association pageCreate an association page
Update the sign in pageUpdate the sign in page
Update the registration pageUpdate the registration page
Examples here in ASP.NET 2.0Examples here in ASP.NET 2.0
But can be done in PHP/Java/PERL/etc. if requiredBut can be done in PHP/Java/PERL/etc. if required
Create an association pageCreate an association page
<!-- ... --> <button onclick="javascript:return CardSpacelogin.submit();"> Update account with your Information Card </button>
<form name="CardSpacelogin" target="_self" method="post"> <object type="application/x-informationcard" name="xmlToken"> <param name="tokenType" value="urn:oasis:names:tc:SAML:1.0:assertion"> <param name="issuer“ value="http://schemas..../identity/issuer/self"> <param name="requiredClaims" value="http://.../claims/givenname, http://.../claims/surname, http://../claims/emailaddress, http://.../claims/privatepersonalidentifier"> </object> </form><!-- ... -->
Seven Perspectives on CardSpaceSeven Perspectives on CardSpace
1.1. Component of the identity metasystemComponent of the identity metasystem
2.2. Abstraction layer for authentication technologiesAbstraction layer for authentication technologies
3.3. Anti-phishing technologyAnti-phishing technology
4.4. User convenienceUser convenience
5.5. SecuritySecurity
6.6. PrivacyPrivacy
7.7. Development FrameworkDevelopment Framework
ResourcesResources
Windows Vista SecurityWindows Vista Security
http://www.microsoft.com/windows/longhorn/security.mspx
CardSpaceCardSpace
http://msdn2.microsoft.com/en-us/netframework/default.aspx
http://www.identityblog.com/
http://cardspace.netfx3.com
© 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only.© 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only.MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.