Article View: cu.cs.ugrads
Article #203CS Colloquium, April 28: Douglas Sicker
From: Ruth Covington
Date: Wed, 23 Apr 2003 20:15
Date: Wed, 23 Apr 2003 20:15
383 lines
18433 bytes
18433 bytes
This is a multi-part message in MIME format. ------=_NextPart_000_0070_01C309A2.C3C8BB10 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable University of Colorado at Boulder Department of Computer Science ECOT 717 Engineering Center Campus Box 430 Boulder, Colorado 80309-0430 (303) 492-7514, FAX (303) 492-2844 CS COLLOQUIUM Role Based Authorization in Distributed Real-time Communication Douglas C. Sicker University of Colorado Monday, 28 April 2003 3:00 - 4:00 Bechtel Conference room DLC 1B70 (enter through Engineering Center = walkways) A role-based security policy allows authorization decisions to be based = on a role that the user asserts rather than on identity. Role-based = authorization can be implemented through an approach that conveys user = information in the form of attributes associated with that user. Relying = on attributes provides a number of advantages, including simplifying = access control, providing a means for more granular (and subsequently = more flexible) authorization decisions, and providing a measure of = privacy. While role-based authorization has been investigated in the = intra-domain space, it is only recently that it has been considered for = inter-domain communication. =20 An approach to providing role-based authorization capabilities between = domains could be based on the use of the Session Initiation Protocol = (SIP). SIP is an application layer protocol that allows endpoints to = locate other endpoints and invite them to participate in a session. SIP = presently defines various methods for performing authentication (and to = a limited extent authorization). However, these methods are generally = identity based. In order to facilitate inter-domain role-based = authorization, several new SIP-based mechanisms must be defined. This = approach would require asserting user attributes between domains in a = secure manner. Security Assertion Markup Language (SAML) provides a = format for describing these assertions. These user attributes are coded = into SAML assertions that are then transported between the SIP entities. = =20 In this talk, I will begin by providing an overview of the architecture = for inter-domain role-based authorization. I will then describe a SIP = profile and binding for SAML. These profiles and bindings define the = ways to incorporate SAML into various communication protocols. Next, I = will present a security analysis of the threat model for each of the = profiles. I'll conclude this talk by presenting some performance = assessments of this design.=20 =20 BIOGRAPHY Douglas C. Sicker is an assistant professor at the University of = Colorado at Boulder in the Department of Interdisciplinary = Telecommunications. Before this he was Director of Global Architecture = at Level 3 Communications, LLC. Prior to this, Doug was Chief of the = Network Technology Division at the Federal Communications Commission = (FCC). He has also held faculty positions in the field of medical = sciences. Doug's general interests include signaling and security in = IP-based networks. His recent work focuses on privacy and role-based = authorization in IP-based networks. He is also interested in the = interaction of policy and network technology. Doug is a senior member = of the IEEE, as well as a member of the ACM and the Internet Society. = Doug is active in the Internet2 and the IETF. After leaving the FCC, = Doug served as the Chair of the Network Reliability and Interoperability = Council steering committee, an FCC federal advisory committee. Doug = also served on the Technical Advisory Council of the FCC. Doug holds a = Ph.D. from the University of Pittsburgh. =20 ------------------------------ http://www.cs.colorado.edu/department/events/colloquia/colloquia.html =20 Sign Language Interpreters Available Upon Request. Please contact Ruth = Covington, Department of=20 Computer Science, Engineering ECOT 717, 303-492-7514, at least five = days prior to the colloquium. ------=_NextPart_000_0070_01C309A2.C3C8BB10 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.2800.1126" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT face=3DArial color=3D#000080 size=3D2> <DIV><FONT face=3DArial color=3D#000080 size=3D2><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>University of Colorado at Boulder</FONT></SPAN></DIV> <DIV> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>Department of Computer Science</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>ECOT 717 Engineering Center</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>Campus Box 430</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>Boulder, Colorado 80309-0430</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>(303) 492-7514, FAX (303) 492-2844</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3></FONT></SPAN> </P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>CS COLLOQUIUM</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3></FONT></SPAN> </P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3><EM>Role Based Authorization in Distributed Real-time=20 Communication</EM></FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>Douglas C. Sicker</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>University of Colorado</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3></FONT></SPAN> </P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>Monday, 28 April 2003</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>3:00 - 4:00</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>Bechtel Conference room DLC 1B70 (enter through Engineering = Center=20 walkways)</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3></FONT></SPAN> </P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3></FONT></SPAN> </P><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt">A role-based security = policy=20 allows authorization decisions to be based on a role that the user = asserts=20 rather than on identity. Role-based authorization can be implemented = through an=20 approach that conveys user information in the form of attributes = associated with=20 that user. Relying on attributes provides a number of advantages, = including=20 simplifying access control, providing a means for more granular (and=20 subsequently more flexible) authorization decisions, and providing a = measure of=20 privacy. While role-based authorization has been investigated in the=20 intra-domain space, it is only recently that it has been considered for=20 inter-domain communication.<?xml:namespace prefix =3D o ns =3D=20 "urn:schemas-microsoft-com:office:office" /><o:p></o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><o:p> </o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt">An approach to = providing=20 role-based authorization capabilities between domains could be based on = the use=20 of the Session Initiation Protocol (SIP). SIP is an application layer = protocol=20 that allows endpoints to locate other endpoints and invite them to = participate=20 in a session. SIP presently defines various methods for performing=20 authentication (and to a limited extent authorization). However, these = methods=20 are generally identity based. In order to facilitate inter-domain = role-based=20 authorization, several new SIP-based mechanisms must be defined. This = approach=20 would require asserting user attributes between domains in a secure = manner.=20 Security Assertion Markup Language (SAML) provides a format for = describing these=20 assertions.<SPAN style=3D"mso-spacerun: yes"> </SPAN>These user = attributes=20 are coded into SAML assertions that are then transported between the SIP = entities. <o:p></o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><o:p> </o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt">In this talk, I will = begin by=20 providing an overview of the architecture for inter-domain role-based=20 authorization.<SPAN style=3D"mso-spacerun: yes"> </SPAN>I will = then describe=20 a SIP profile and binding for SAML.<SPAN style=3D"mso-spacerun: = yes"> =20 </SPAN>These profiles and bindings define the ways to incorporate SAML = into=20 various communication protocols.<SPAN style=3D"mso-spacerun: yes"> = </SPAN>Next, I will present a security analysis of the threat model for = each of=20 the profiles. I=92ll conclude this talk by presenting some performance = assessments=20 of this design. <o:p></o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><o:p> </o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt">BIOGRAPHY</P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><SPAN=20 style=3D"FONT-SIZE: 10pt">Douglas C. Sicker is an assistant professor at = the=20 University of Colorado at Boulder in the Department of Interdisciplinary = Telecommunications. Before this he was Director of Global Architecture = at Level=20 3 Communications, LLC.<SPAN style=3D"mso-spacerun: yes"> = </SPAN>Prior to=20 this, Doug was Chief of the Network Technology Division at the Federal=20 Communications Commission (FCC).<SPAN style=3D"mso-spacerun: yes"> = </SPAN>He=20 has also held faculty positions in the field of medical sciences.<SPAN=20 style=3D"mso-spacerun: yes"> </SPAN>Doug=92s general interests = include=20 signaling and security in IP-based networks.<SPAN=20 style=3D"mso-spacerun: yes"> </SPAN>His recent work focuses on = privacy and=20 role-based authorization in IP-based networks. He is also interested in = the=20 interaction of policy and network technology.<SPAN=20 style=3D"mso-spacerun: yes"> </SPAN>Doug is a senior member of the = IEEE, as=20 well as a member of the ACM and the Internet Society.<SPAN=20 style=3D"mso-spacerun: yes"> </SPAN>Doug is active in the = Internet2 and the=20 IETF.<SPAN style=3D"mso-spacerun: yes"> </SPAN>After leaving the = FCC, Doug=20 served as the Chair of the Network Reliability and Interoperability = Council=20 steering committee, an FCC federal advisory committee.<SPAN=20 style=3D"mso-spacerun: yes"> </SPAN>Doug also served on the = Technical=20 Advisory Council of the FCC.<SPAN style=3D"mso-spacerun: yes"> = </SPAN>Doug=20 holds a Ph.D. from the University of Pittsburgh.<SPAN=20 style=3D"mso-spacerun: yes"> </SPAN><o:p></o:p></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"></FONT></SPAN><FONT=20 face=3DTimes color=3D#000000 size=3D3><SPAN=20 style=3D"mso-spacerun: yes"></SPAN></FONT> </P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; TEXT-ALIGN: center"=20 align=3Dcenter><B style=3D"mso-bidi-font-weight: normal"><FONT = face=3DTimes=20 color=3D#000000 size=3D3>------------------------------</FONT></B></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; TEXT-ALIGN: center"=20 align=3Dcenter><FONT face=3DTimes color=3D#000000=20 size=3D3>http://www.cs.colorado.edu/department/events/colloquia/colloquia= .html</FONT></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; TEXT-ALIGN: center"=20 align=3Dcenter><o:p><FONT face=3DTimes color=3D#000000 = size=3D3> </FONT></o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: = normal"><FONT=20 face=3DTimes color=3D#000000 size=3D3>Sign Language Interpreters = Available Upon=20 Request.<SPAN style=3D"mso-spacerun: yes"> </SPAN>Please contact = Ruth=20 Covington, Department of </FONT></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: = normal"><FONT=20 face=3DTimes color=3D#000000 size=3D3>Computer Science, Engineering<SPAN = style=3D"mso-spacerun: yes"> </SPAN>ECOT 717, 303-492-7514, at = least five=20 days prior to the colloquium.</FONT></P></FONT></DIV></FONT></DIV> <DIV><FONT face=3DArial color=3D#000080 = size=3D2></FONT> </DIV></BODY></HTML> ------=_NextPart_000_0070_01C309A2.C3C8BB10-- _______________________________________________ cscolloq mailing list cscolloq@cs.colorado.edu http://www.cs.colorado.edu/mailman/listinfo/cscolloq
Technical Details
Message-ID:
<1051129926.27037@csnews.cs.colorado.edu>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-03!sn-xit-01!sn-xit-09!supernews.com!news.maxwell.syr.edu!cyclone.bc.net!news-hog.berkeley.edu!ucberkeley!enews.sgi.com!coop.net!cs.colorado.edu!csnews!recnewsShow Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 11534c,7422f04da54ae4bf,start X-Google-Attributes: gid11534c,public X-Google-ArrivalTime: 2003-04-23 13:32:21 PST Newsgroups: cu.cs.ugrads From: "Ruth Covington" <Ruth.Covington@colorado.edu> Subject: CS Colloquium, April 28: Douglas Sicker MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0070_01C309A2.C3C8BB10" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Errors-To: cscolloq-admin@cs.colorado.edu X-BeenThere: cscolloq@cs.colorado.edu X-Mailman-Version: 2.0.13 Precedence: bulk Reply-To: Ruth.Covington@colorado.edu X-Reply-To: "Ruth Covington" <Ruth.Covington@Colorado.EDU> List-Help: <mailto:cscolloq-request@cs.colorado.edu?subject=help> List-Post: <mailto:cscolloq@cs.colorado.edu> List-Subscribe: <http://www.cs.colorado.edu/mailman/listinfo/cscolloq>, <mailto:cscolloq-request@cs.colorado.edu?subject=subscribe> List-Id: CS Colloquium announcements <cscolloq.cs.colorado.edu> List-Unsubscribe: <http://www.cs.colorado.edu/mailman/listinfo/cscolloq>, <mailto:cscolloq-request@cs.colorado.edu?subject=unsubscribe> List-Archive: <http://www.cs.colorado.edu/pipermail/cscolloq/> Date: 23 Apr 2003 14:15:17 -0600 Message-ID: <1051129926.27037@csnews.cs.colorado.edu> Sender: news Distribution: co X-Note1: message-id generated by recnews X-Note2: mail msgid was <007301c309d5$0e7b9510$20ec8a80@cs.colorado.edu> Originator: daemon@csnews.cs.colorado.edu NNTP-Posting-Host: 128.138.243.15 X-Trace: cs.colorado.edu!csnews 1051129927 128.138.243.15 (23 Apr 2003 14:32:07 -0600) Lines: 383 Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-03!sn-xit-01!sn-xit-09!supernews.com!news.maxwell.syr.edu!cyclone.bc.net!news-hog.berkeley.edu!ucberkeley!enews.sgi.com!coop.net!cs.colorado.edu!csnews!recnews