untitled

Size: px

Start display at page:

Download "untitled"

かねろうゆのもと
5 years ago
Views:

4 HSS BSF AV, (Diameter ) AKA ID (HTTP Digest AKA) NW 3GPP(IMS)PKI General Authentication Architecture 3GPP Release 8 (TS , TS ) K,SQN AV: Home Subscriber AUTN,RAND, System XRES,IK,CK Bootstrapping Server Functionality Subscriber profile ID K S IK,CK) BSF NAF ID (Diameter ) PKI Operator-controlled Network Application Functionality (HTTP Digest ) K,SQN User All rights Equipment reserved. NTT Copy rights AKA 2007 Authentication and Key Agreement 7 3 CardSpace IE7 Microsoft, Novell, IBM Liberty Alliance/SAML Liberty Alliance(Oracle, Sun, GSA, Citigroup, NEC, NHK, NTT OpenID URL ID() OpenID Foundation Microsoft, Verisign, IBM, Yahoo!, Google, Six Apart NTT Copyrights All rights reserved. 8

5 3 SP: IdP: IdP/SP SP IdP SP SP SP SP IdP IdP/ LA/SAML SP (IdP/SP OpenID, CardSpace, LA/SAML All rights reserved. NTT Copy rights OpenID Foundation Bandit Higgins ETSI/ TV-Anytime OpenID OSIS Open Liberty OpenSSO SAML2.0 (X.1141) ITU-T 3GPP Liberty Alliance ( SAML) Concordia Project Card Space OMA Inernet 2 NTT Copyrights All rights reserved. OATH OASIS XML 10

7 1. IdP SP IdP SP 4. SSOSP 5. SP IdP SP All rights reserved. NTT Copy rights SAML v2.0: Security Assertion Markup Language v2.0 SSO (Liberty Alliance, OASIS) IdP (Identity Provider IdP A SP1 SP2 SP (Service Provider IdP SP All rights reserved. NTT Copy rights (Source: Liberty Alliance Project 2006)

8 IdP SP ID IdP : john@idp abcd sp1.com pqrs IdP SP1 SP1 : Lennon1@sp1 pqrs idp.com abcd SP2 : Lennon2@sp2 efgh sp2.com wxyz SP2 wxyz idp.com efgh All rights reserved. NTT Copy rights 2007 (Source: Liberty Alliance Project 2006) 15 (SP) IdP(PKI) SAML Assertion ID(IdP) All rights reserved. NTT Copy rights 2007 (SP) PKI 16

9 ID () SP (Assertion Statement), IdP SP SAML (Security Assertion Markup Language) IdP SP IdP (Source: Liberty Alliance Project 2006) All rights reserved. NTT Copy rights Authentication Context IdPSP Identification) ( (Technical Protection) ( IC (Operational Protection) IdP ( (Authentication Method) IdP ) (PKI (Governing Agreements) () All rights reserved. NTT Copy rights

10 SAMLv2.0 IdP SP IdP IdP SP SP IdP (Name Identifier) SP IdP IdP SP IdPIdP IdP SPSP SP IdP All rights reserved. NTT Copy rights 2007 (Source: Liberty Alliance Project 2006) 19 SAML PKI SP IdP(PKI) SP SP SAML Assertion IdP SAML Assertion SP SP SP PKI All rights reserved. NTT Copy rights

11 User Centric IdP SP User centric The Law of Identity 3 Microsoft CardSpace OpenID 2.0 Liberty Alliance/SAML All rights reserved. NTT Copy rights CardSpace Microsoft Vista IE7 SAML Web Services Security SAML Token Profile v 1.0 and REL Token Profile v1.0 < open.org/specs/index.php#wssprofilesv1.0> OASIS WS SecureConversation, WS SecurityPolicy, WS Security, WS Transaction, WS Trust, WS Federation OSIS (Open Source Identity System) Bandit, Higgins, OpenSSO Firefox NTT Copyrights All rights reserved. 22

12 CardSpace CardSpace PKI SAML (, WS-Trust, WS-Policy, WS-Metadata Exchange STS Security Token Server (STS) (IdP ) Relying Party All rights reserved. NTT Copy rights (SP OpenID 2.0 OSIS Versign, Sxip, JanRain, Sxi Apart SOAP (OpenID1.1, Yadis, XRI URIXRI XRI: extensible Resource Identifier All rights reserved. NTT Copyright

14 PKCS#7XML ds:signedinfods:signedinfo c14npkcs#7 PKCS#7 < ID= xxxxxxxx > < ID= xxxxxxxx > < ></ > < ></ > < ></ > < ></ > </ > </ > <ds:signedinfo> <ds:signedinfo> <ds:canonicalizationmethod Algorithm="xml-exc-c14n /> <ds:canonicalizationmethod Algorithm="xml-exc-c14n /> <ds:signaturemethod Algorithm="rsa-sha1"/> <ds:signaturemethod Algorithm="rsa-sha1"/> <ds:reference URI= xxxxxxxx > <ds:reference URI= xxxxxxxx > <ds:transforms> <ds:transforms> <ds:transform Algorithm="enveloped-signature /> <ds:transform Algorithm="enveloped-signature /> <ds:transform Algorithm="xml-exc-c14n /> <ds:transform Algorithm="xml-exc-c14n /> </ds:transforms> </ds:transforms> <ds:digestmethod Algorithm="sha1 /> <ds:digestmethod Algorithm="sha1 /> <ds:digestvalue>c14nsha1 </ds:digestvalue> <ds:digestvalue>c14nsha1 </ds:digestvalue> </ds:reference> </ds:reference> </ds:signedinfo> </ds:signedinfo> ds:signedinfo SignedData SignedData version version digestalgorithms digestalgorithms contentinfo ds:signedinfoc14n contentinfo ds:signedinfoc14n certificates certificates certificate X509 certificate X509 signerinfos signerinfos signerinfo signerinfo digestalgorithm sha1 digestalgorithm sha1 digestencryptionalgorithm rsa digestencryptionalgorithm rsa encrypteddigest ds:signedinfoc14nrsa-sha1 encrypteddigest ds:signedinfoc14nrsa-sha1 ds:signedinfo PKCS#7

XML < ID= xxxxxxxx > < ID= xxxxxxxx > < ></ > < ></ > < ></ > < ></ > </ > </ > PKCS#7 SignedData SignedData version version digestalgorithms digestalgorithms contentinfo ds:signedinfoc14n

15 XML < ID= xxxxxxxx > < ID= xxxxxxxx > < ></ > < ></ > < ></ > < ></ > </ > </ > PKCS#7 SignedData SignedData version version digestalgorithms digestalgorithms contentinfo ds:signedinfoc14n contentinfo ds:signedinfoc14n certificates certificates certificate X509 certificate X509 signerinfos signerinfos signerinfo signerinfo digestalgorithm sha1 digestalgorithm sha1 digestencryptionalgorithm rsa digestencryptionalgorithm rsa encrypteddigest ds:signedinfoc14nrsa-sha1 encrypteddigest ds:signedinfoc14nrsa-sha1 ds:signedinfo XML NTTVol.19, No All rights reserved. NTT Copy rights 2007

16 ODP(On Demand Pass) () ODP ODP IPsec VPN ODP SSL VPN ODP 802.1x ODP AP All rights reserved. NTT Copy rights Copyright(c)2007 NTT,corp.All Rights Reserved. 31 PKI( SAML, OpenID, CardSpace PKI All rights reserved. NTT Copy rights

2009 NTT Corporation. All rights reserved.

2009 NTT Corporation. All rights reserved. SAML2.0 (X.1141) HITSP ITU-T 3GPP ISO OMA ETSI UPKI ISOC OpenID Foundation Concordia Project OATH Bandit OSIS OASIS Higgins OpenSSO Information Card Foundation