Thread View: cu.cs.ugrads
1 messages
1 total messages
Started by Ruth Covington
Wed, 23 Apr 2003 20:15
CS Colloquium, April 28: Douglas Sicker
Author: Ruth Covington
Date: Wed, 23 Apr 2003 20:15
Date: Wed, 23 Apr 2003 20:15
383 lines
18433 bytes
18433 bytes
This is a multi-part message in MIME format. ------=_NextPart_000_0070_01C309A2.C3C8BB10 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable University of Colorado at Boulder Department of Computer Science ECOT 717 Engineering Center Campus Box 430 Boulder, Colorado 80309-0430 (303) 492-7514, FAX (303) 492-2844 CS COLLOQUIUM Role Based Authorization in Distributed Real-time Communication Douglas C. Sicker University of Colorado Monday, 28 April 2003 3:00 - 4:00 Bechtel Conference room DLC 1B70 (enter through Engineering Center = walkways) A role-based security policy allows authorization decisions to be based = on a role that the user asserts rather than on identity. Role-based = authorization can be implemented through an approach that conveys user = information in the form of attributes associated with that user. Relying = on attributes provides a number of advantages, including simplifying = access control, providing a means for more granular (and subsequently = more flexible) authorization decisions, and providing a measure of = privacy. While role-based authorization has been investigated in the = intra-domain space, it is only recently that it has been considered for = inter-domain communication. =20 An approach to providing role-based authorization capabilities between = domains could be based on the use of the Session Initiation Protocol = (SIP). SIP is an application layer protocol that allows endpoints to = locate other endpoints and invite them to participate in a session. SIP = presently defines various methods for performing authentication (and to = a limited extent authorization). However, these methods are generally = identity based. In order to facilitate inter-domain role-based = authorization, several new SIP-based mechanisms must be defined. This = approach would require asserting user attributes between domains in a = secure manner. Security Assertion Markup Language (SAML) provides a = format for describing these assertions. These user attributes are coded = into SAML assertions that are then transported between the SIP entities. = =20 In this talk, I will begin by providing an overview of the architecture = for inter-domain role-based authorization. I will then describe a SIP = profile and binding for SAML. These profiles and bindings define the = ways to incorporate SAML into various communication protocols. Next, I = will present a security analysis of the threat model for each of the = profiles. I'll conclude this talk by presenting some performance = assessments of this design.=20 =20 BIOGRAPHY Douglas C. Sicker is an assistant professor at the University of = Colorado at Boulder in the Department of Interdisciplinary = Telecommunications. Before this he was Director of Global Architecture = at Level 3 Communications, LLC. Prior to this, Doug was Chief of the = Network Technology Division at the Federal Communications Commission = (FCC). He has also held faculty positions in the field of medical = sciences. Doug's general interests include signaling and security in = IP-based networks. His recent work focuses on privacy and role-based = authorization in IP-based networks. He is also interested in the = interaction of policy and network technology. Doug is a senior member = of the IEEE, as well as a member of the ACM and the Internet Society. = Doug is active in the Internet2 and the IETF. After leaving the FCC, = Doug served as the Chair of the Network Reliability and Interoperability = Council steering committee, an FCC federal advisory committee. Doug = also served on the Technical Advisory Council of the FCC. Doug holds a = Ph.D. from the University of Pittsburgh. =20 ------------------------------ http://www.cs.colorado.edu/department/events/colloquia/colloquia.html =20 Sign Language Interpreters Available Upon Request. Please contact Ruth = Covington, Department of=20 Computer Science, Engineering ECOT 717, 303-492-7514, at least five = days prior to the colloquium. ------=_NextPart_000_0070_01C309A2.C3C8BB10 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.2800.1126" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT face=3DArial color=3D#000080 size=3D2> <DIV><FONT face=3DArial color=3D#000080 size=3D2><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>University of Colorado at Boulder</FONT></SPAN></DIV> <DIV> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>Department of Computer Science</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>ECOT 717 Engineering Center</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>Campus Box 430</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>Boulder, Colorado 80309-0430</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>(303) 492-7514, FAX (303) 492-2844</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3></FONT></SPAN> </P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>CS COLLOQUIUM</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3></FONT></SPAN> </P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3><EM>Role Based Authorization in Distributed Real-time=20 Communication</EM></FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>Douglas C. Sicker</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>University of Colorado</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3></FONT></SPAN> </P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>Monday, 28 April 2003</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>3:00 - 4:00</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3>Bechtel Conference room DLC 1B70 (enter through Engineering = Center=20 walkways)</FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3></FONT></SPAN> </P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3></FONT></SPAN> </P><SPAN=20 style=3D"COLOR: black; FONT-FAMILY: 'Times New Roman'; = mso-bidi-font-size: 12.0pt"><FONT=20 size=3D3> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt">A role-based security = policy=20 allows authorization decisions to be based on a role that the user = asserts=20 rather than on identity. Role-based authorization can be implemented = through an=20 approach that conveys user information in the form of attributes = associated with=20 that user. Relying on attributes provides a number of advantages, = including=20 simplifying access control, providing a means for more granular (and=20 subsequently more flexible) authorization decisions, and providing a = measure of=20 privacy. While role-based authorization has been investigated in the=20 intra-domain space, it is only recently that it has been considered for=20 inter-domain communication.<?xml:namespace prefix =3D o ns =3D=20 "urn:schemas-microsoft-com:office:office" /><o:p></o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><o:p> </o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt">An approach to = providing=20 role-based authorization capabilities between domains could be based on = the use=20 of the Session Initiation Protocol (SIP). SIP is an application layer = protocol=20 that allows endpoints to locate other endpoints and invite them to = participate=20 in a session. SIP presently defines various methods for performing=20 authentication (and to a limited extent authorization). However, these = methods=20 are generally identity based. In order to facilitate inter-domain = role-based=20 authorization, several new SIP-based mechanisms must be defined. This = approach=20 would require asserting user attributes between domains in a secure = manner.=20 Security Assertion Markup Language (SAML) provides a format for = describing these=20 assertions.<SPAN style=3D"mso-spacerun: yes"> </SPAN>These user = attributes=20 are coded into SAML assertions that are then transported between the SIP = entities. <o:p></o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><o:p> </o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt">In this talk, I will = begin by=20 providing an overview of the architecture for inter-domain role-based=20 authorization.<SPAN style=3D"mso-spacerun: yes"> </SPAN>I will = then describe=20 a SIP profile and binding for SAML.<SPAN style=3D"mso-spacerun: = yes"> =20 </SPAN>These profiles and bindings define the ways to incorporate SAML = into=20 various communication protocols.<SPAN style=3D"mso-spacerun: yes"> = </SPAN>Next, I will present a security analysis of the threat model for = each of=20 the profiles. I=92ll conclude this talk by presenting some performance = assessments=20 of this design. <o:p></o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><o:p> </o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt">BIOGRAPHY</P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><SPAN=20 style=3D"FONT-SIZE: 10pt">Douglas C. Sicker is an assistant professor at = the=20 University of Colorado at Boulder in the Department of Interdisciplinary = Telecommunications. Before this he was Director of Global Architecture = at Level=20 3 Communications, LLC.<SPAN style=3D"mso-spacerun: yes"> = </SPAN>Prior to=20 this, Doug was Chief of the Network Technology Division at the Federal=20 Communications Commission (FCC).<SPAN style=3D"mso-spacerun: yes"> = </SPAN>He=20 has also held faculty positions in the field of medical sciences.<SPAN=20 style=3D"mso-spacerun: yes"> </SPAN>Doug=92s general interests = include=20 signaling and security in IP-based networks.<SPAN=20 style=3D"mso-spacerun: yes"> </SPAN>His recent work focuses on = privacy and=20 role-based authorization in IP-based networks. He is also interested in = the=20 interaction of policy and network technology.<SPAN=20 style=3D"mso-spacerun: yes"> </SPAN>Doug is a senior member of the = IEEE, as=20 well as a member of the ACM and the Internet Society.<SPAN=20 style=3D"mso-spacerun: yes"> </SPAN>Doug is active in the = Internet2 and the=20 IETF.<SPAN style=3D"mso-spacerun: yes"> </SPAN>After leaving the = FCC, Doug=20 served as the Chair of the Network Reliability and Interoperability = Council=20 steering committee, an FCC federal advisory committee.<SPAN=20 style=3D"mso-spacerun: yes"> </SPAN>Doug also served on the = Technical=20 Advisory Council of the FCC.<SPAN style=3D"mso-spacerun: yes"> = </SPAN>Doug=20 holds a Ph.D. from the University of Pittsburgh.<SPAN=20 style=3D"mso-spacerun: yes"> </SPAN><o:p></o:p></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; mso-margin-top-alt: = auto; mso-margin-bottom-alt: auto"></FONT></SPAN><FONT=20 face=3DTimes color=3D#000000 size=3D3><SPAN=20 style=3D"mso-spacerun: yes"></SPAN></FONT> </P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; TEXT-ALIGN: center"=20 align=3Dcenter><B style=3D"mso-bidi-font-weight: normal"><FONT = face=3DTimes=20 color=3D#000000 size=3D3>------------------------------</FONT></B></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; TEXT-ALIGN: center"=20 align=3Dcenter><FONT face=3DTimes color=3D#000000=20 size=3D3>http://www.cs.colorado.edu/department/events/colloquia/colloquia= .html</FONT></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: normal; TEXT-ALIGN: center"=20 align=3Dcenter><o:p><FONT face=3DTimes color=3D#000000 = size=3D3> </FONT></o:p></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: = normal"><FONT=20 face=3DTimes color=3D#000000 size=3D3>Sign Language Interpreters = Available Upon=20 Request.<SPAN style=3D"mso-spacerun: yes"> </SPAN>Please contact = Ruth=20 Covington, Department of </FONT></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt; LINE-HEIGHT: = normal"><FONT=20 face=3DTimes color=3D#000000 size=3D3>Computer Science, Engineering<SPAN = style=3D"mso-spacerun: yes"> </SPAN>ECOT 717, 303-492-7514, at = least five=20 days prior to the colloquium.</FONT></P></FONT></DIV></FONT></DIV> <DIV><FONT face=3DArial color=3D#000080 = size=3D2></FONT> </DIV></BODY></HTML> ------=_NextPart_000_0070_01C309A2.C3C8BB10-- _______________________________________________ cscolloq mailing list cscolloq@cs.colorado.edu http://www.cs.colorado.edu/mailman/listinfo/cscolloq
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads