2009 NTT Corporation. All rights reserved.

Size: px

Start display at page:

ときないさし
5 years ago
Views:

2 SAML2.0 (X.1141) HITSP ITU-T 3GPP ISO OMA ETSI UPKI ISOC OpenID Foundation Concordia Project OATH Bandit OSIS OASIS Higgins OpenSSO Information Card Foundation Open Liberty Identity Commons Data Portability OAuth Friend Connect Open Facebook Web Connect Foundation??? 2

3 (SIG) SIG,,, ID, (GSA) 3

4 4

5 SAML 2.0 : Security Assertion Markup Language 2.0 (Security Assertion) Liberty AllianceOASIS 5

6 ID SP2 SP1 6

7 SAML 2.0 : IdP SP abcd sp1.com wxyz sp2.com idp.com wxyz idp.com 7

8 Liberty ID-WSF: Identity Web Services Framework) 8

9 Boeing, Fidelity Investments, American Express, GM, Intel, HP, Sun, Star Alliance, NTT Orange/France Telecom, T-Online, Telefonica Moviles, TeliaSonera/Telenor, Bluewin (Swiss Telecom), NTT NTT Internet2, EIfEL SaaS Google Apps Salesforce.comSAML2.0 IDaaS (Identity as a Service) ID Covisint, Fischer International, Symplified, Protect Network Microsoft Geneva Active DirectorySAML 2.0 9

1. ID 2. ID 3. 4. ID ID IDPierrefitteVandoeuvre-les- NancyID 5. ID 6. ID 7. 8. 9. ID 10. ID 11. 12. IDID 13.

10 1. ID 2. ID ID ID IDPierrefitteVandoeuvre-les- NancyID 5. ID 6. ID ID 10. ID IDID 13. ID ID 16. IDPF 17. IDPF 18. IDPF / 23. ID 24. ID 25. ID 26. ID ID 29. ID 10

11 Identity Assurance Framework(IAF) (EAP NIST)Liberty Alliance EAuthentication Partnership (EAP) Credential Assessment Framework 2.0 National Institute of Standard and Technology (NIST) Special Publication Assurance Levels Service Assessment Criteria Accreditation and Certification Model Business Rules Liberty Alliance FSTC Financial Services Technology Consortium HITSP Healthcare Information Technology Standards Panel 11

12 /SAML, OpenID, CardSpace ( ) /SAML SaaS TV 12

13 13

14 Advanced Client () ID-WSF 2.6 (2006) 1.23(2014) 2/13/2 Forrester 2008 SSO SAML2.0 People Service ID Governance Conformance testing Identity Assurance Framework 14

15 15

16 3 CardSpace IE7/Vista Information Card Foundation members (Equifax, Google, Microsoft, Novell, Oracle, Paypal, etc.) Liberty Alliance/SAML Liberty Alliance(AOL,BT, France Telecom, Intel, Oracle, Sun, GSA, Citigroup, Novell, NEC, NHK, NTT OpenID URL/XRI ID() OpenID FoundationMicrosoft, Verisign, IBM, Yahoo!, Google, Six Apart 16

17 SAML(Security Assertion Markup Language) 17 NTT Copyrights All rights 17

18 1. (IdP)(SP) IdP SP 4. SSOSP 5. SP IdP SP SAML2.0(anonymous federation) 18

19 SAML 2.0 : 19

20 SSO IdP (3) (0) (2) (4) (5) SOAP (6) SOAP (4) (2 (1) SP (8) SP (7) ( 20

21 Liberty ID-WSF: Identity Web Services Framework) Liberty Alliance openliberty SOAP(REST) 21

22 IdP Proxy ProxyIdP SP IdP IdP Proxy IdP SP 22

23 23

24 24

25 SAML Profiles Protocols Bindings (WebSSO, SLO, ECP ) Bindings Protocols Protocols Assertion Request/Response Assertions Metadata AuthnContext 25

26 SAML 2.0 : ID/ PKI SP IdP IdPSAML Assertion SAML Assertion XML ID IdP URL SP (Authentication Statements) IdP SP XMLSignature 26

27 SSO ID 800 EduTech NY SSO1 (GSA) : Liberty SSO Liberty 27

28 SAML 2.0 IdP1 SP IdP3 SP

29 Mon Service Public 1 ID-FFID SSO 1ID 2 ID-WSF CoTIdP People Service 29

30 / PASSI (Platform of Attributes for Security and Signature) ID SAML WSCA (Web Signature Creation Application) Web ID signature statement SAML Assertion 30

31 B2E, B2B, B2C Boeing, Fidelity Investments, American Express, GM, Intel, HP, Sun, Star Alliance Orange/France Telecom, T-Online, Telefonica Moviles, TeliaSonera/Telenor, Bluewin (Swiss Telecom) T-Online 1200ISP SSO SaaS Google Apps Salesforce.comSAML2.0 IDaaS (Identity as a Service) ID Covisint, Fischer International, Symplified, Protect Network Microsoft Geneva Active DirectorySAML

32 UPKI UPKI 7 SaaS NHK NTT (( ID ) JAL ONLINE NTT / NTT gooid NTT Mydocomo ID imode.net, DCMX 32

33 (PKI,, etc.) IdP USIM SAML Assertion AuthnRequest Service provider SAML 33

34 TV 34

35 Liberty Alliance IAF OMB M NIST Special Publication ITU-T X.eaa ISO WD US EAP CAF Liberty Alliance IAF FSTC HITSP FSTC Financial Services Technology Consortium HITSP Healthcare Information Technology Standards Panel OASIS WS-* OASIS SAML OpenID OASIS Organization for the Advancement of Structured Information Standards 35

36 OMB M (E-Authentication Guidance for Federal Agencies) OMB Office of Management and Budget, NIST Special Publication (Electronic Authentication Guideline) NIST National Institute of Standards and Technology, OMB4 SAML Assertion bearer Assertion CAF (Credential Assurance Framework) (EAP, US E-Authentication Partnership) CAF ID ID (GSA) 36

37 IAF (Identity Assurance Framework) EAP Liberty Alliance(LA) LA IAEG (Identity Assurance Expert Group) CAF IAF 1.1 LAITU-TFSTCHITSP() LA X.eaa (Entity Authentication Assurance) ITU-T SG LA IAF ISO Correspondence Group NIST LA WD (Entity Authentication Assurance) ISO/IEC JTC1/SC27 ITU-T ITU-T X.eaa FSTC (Financial Services Technology Consortium) HITSP (Healthcare Information Technology Standards Panel) 37

38 IAF (Identity Assurance Framework) IAF ID ID IAEG (Identity Assurance Expert Group) IAF EAPCAF EAP CAF IAF IAF 1.1 GSA EAP: US E-Authentication Partnership / CAF: Credential Assessment Framework 38

39 IAF 2 Assurance Levels ID4 ID 3 Service Assessment Criteria 4 Assurance Level 4 Accreditation and Certification Rules 5 Business Rules IAF IAF 39

40 2 Assurance Level ID ID ID ID ID e Web 40

41 ID ID

43 3 Service Assessment Criteria ID 43

44 4 Accreditation and Certification Rules IAF IAF 44

45 5 Business Rules IAF Liberty IAEG CSP Liberty IAEG CSP CSP Credential Service Provider SAMLIdP SAMLSP IAEG CSP (Credential Service Provider) CSP IAEG CSP IAF 45

46 IAF ID ID IAEG IAF 1e4 IAF 46

47 (SAML, ID-WSF) OpenID CardSpace(WS-*) Microsoft, Boeing, GM, AOL, Chevron, Cisco, NTT, NRI, Internet 2, Sun SAML OpenID 2009 SAML CardSpace 2008 Inernet2,,, Ping Identity,, SymLabs, 47

48 OpenID-> SAML 48

49 CardSpace -> SAML Security token Request for security token STS RP (InfoCard enabled) IdP (SAML enabled) Authentication request/response User (CardSpace Client) Service request/response 49

50 egov SIG (State Services Commission) (National IT and Telecom Agency) /(Agencia Catalana De Certfiicacio) Sun Microsystems France Telecom Symlabs GSASAML SAML egov Profile 50

51 SaaS IDaaS: Identity as a Service ID Covisint (B2B) ID Fischer International ID Rearden Commerce ID Symplified ID Protect Network ID 51

52 52

untitled

untitled All rights reserved. NTT Copy rights 2007 1 HTTPS 100% 92% 53% S. Schechter et al, The Emperor's New Security Indicators, Proc. IEEE Symp. Security and Privacy, 2007 All rights reserved. NTT Copy rights