属性認証ハンドブック

Size: px

Start display at page:

Download "属性認証ハンドブック"

あけなおなみこし
5 years ago
Views:

18 ID

21 (KDC Alice(A) K A (S A )TGT AS =K KDC (A, S A ) K KDC K A S A Bob S A (Time) TGS K KDC S AB S A (B, S AB ) K B (A, S AB ) TGTS A Bob=K B (A, S AB ) K B Bob Bob K B (A, S AB ) Bob(B) K B K A +1 S AB

22 PKI PKI

23 A B B B

24 A B B B A B

25 A B A A

26 A B A A C A C

39 ISO/TS hcrole

40 PKI PKC PKC PKC

42 AC CA PKC PKC+AC PKC AA AC AC CA PKC PKC PKC SOA AA AC AC PKC+AC AC AC RFC3281 X.509

43 AC (AA) PKC+() or PKC or AC or AC or

44 AC (AA) PKC AC AC or

45 (AA) AC (CA) AC AC PKC AC AC AC AC

46 () (AC) (AC) PKC ()

48 Web Web Web Web PKI PC/PC

49 SAMLLibertyWS-Federation SAML

51 Policy Decision Authorization Liberty Alliance

55 WS-Federation WS-Secure Conversation WS-Policy WS-Trust WS- Federation WS- Authorization WS-Privacy WS-Security OASIS WSS 1.0 SOAP Foundation

58 Liberty Alliance WS-Federation

62 IdPAuthenticate <samlp: Request...> <samlp: AttributeQuery> <saml: Subject> <saml: NameIdentifier SecurityDomain="ecom.jp" Name="rimap"/> </ saml: Subject> <saml: AttributeDesignator AttributeName="Employee_ ID" AttributeNamespace="ecom.jp"> </ saml: AttributeDesignator> </ samlp: AttributeQuery> </ samlp: Request> SAMLAuthentication <samlp: Response MajorVersion="1" MinorVersion="0" RequestID=" " InResponseTo=" " StatusCode="Success"> SAMLAuthentication <saml: Assertion MajorVersion="1" MinorVersion="0" AssertionID=" " Issuer="Ecom.jp" IssueInstant=" T10: 00: 23Z"> <saml: Conditions NotBefore=" T10: 00: 30Z" NotAfter=" T10: 15: 00Z" /> <saml: AuthenticationStatement AuthenticationMethod="Password" AuthenticationInstant=" T10: 00: 20Z"> <saml: Subject> <saml: NameIdentifier SecurityDomain="ecom.jp" Name="rimap" /> </ saml: Subject> </ saml: AuthenticationStatement> </ saml: Assertion> </ samlp: Response>

63 Security Token <S:Envelope xmlns:s="..." xmlns=".../secext" xmlns:wsu=".../utility> <S:Header>... <Security> <UsernameToken wsu:id="mytoken"> <Username>NNK</Username> <Nonce>FKJh...</Non ce> <wsu:created> t09:00:00z </wsu:created> </UsernameToken> <ds:signature xmlns:d s="...">... </ds:signature> </Security>... </S:Header> <S:Body wsu:id="req"> <RequestSecurityToken> <TokenType>wsse:X509v3</TokenType> <RequestType>wsse:ReqIssue</RequestType> <Base> <Reference URI="#myToken"/> </Base> </RequestSecurityToken> </S:Body> </S: Envelope>

64 Response <S:Envelope xmlns:s="..." xmlns=".../secext" xmlns:wsu=".../utility"> <S:Header>... <Security> <BinarySecurityToken wsu:id="mytoken2" ValueType="wsse:X509v3" EncodingType="wsse:Base64Binary"> DFJHuedsujfnrnv45JZc0... </BinarySecurityToken> <ds:signature xmlns:ds="...">... </ds:signature> </Security>... </S:Header> <S:Body> <RequestSecurityTokenResponse> <RequestedSecurityToken> <BinarySecurityToken ValueType="wsse:X509v3" EncodingType="wsse:Base64Binary"> MIIEZzCCA9CgAwIBAgIQEmtJZc0... </BinarySecurityToken> </RequestedSecurityToken> <RequestedProofToken> <ds:keyinfo xmlns:ds="..."> <ds:keyvalue>... </ds:keyvalue> </ds:keyinfo> </RequestedProofToken> </RequestSecurityTokenResponse> </S:Body> </S:Envelope> SAMLAssertion <S:Envelope xmlns:s="..."> <S:Header> <wsse:security xmlns:wsse="..."> <saml:assertion MajorVersion="1" MinorVersion="0" AssertionID="SecurityToken-ef375268" Issuer="elliotw1" IssueInstant=" T11:32: :00" xmlns:saml="urn:oasis:names:tc:saml:1.0:assertion">... </saml:assertion>... </wsse:security> </S:Header> <S:Body>... </S:Body> </S:Envelope>

66 IdP IdP IdP RBACNIST

69 XACMLXACML

70 PIP Subject Environment Resource Requester PEP Context PDP PAP Context Policy Obligation Obligation Service

75 <PolicySet> Policy Combining Algorithm <Subjects> <Obligations> <Policy> <Target> <Resources> <Condition> Rule Combining Algorithm <Actions> <Rule>

82 e-authentication e-authentication (CSP, IdP) Relying Parties eauthentication

88 EAPElectronic Authentication Partnership

91 CEN/ISSShttp:// EESSIhttp:// ETSIhttp://

92 IDA IETFhttp://

93 ISIS-MTT ISOhttp://

94 ITU-Thttp:// OASIShttp:// W3Chttp://

97 XML

98 <Signature (Id=ID)?> <SignedInfo (Id=ID)?> <CanonicalizationMethod Algorithm=anyURI/> <SignatureMethod Algorithm=anyURI/> (<Reference (Id=ID)? (URI=anyURI)? (Type=anyURI)?> (<Transforms>)? <DigestMethod Algorithm=anyURI> <DigestValue> </Reference>)+ </SignedInfo> <SignatureValue> (<KeyInfo (Id=ID)?>)? (<Object (Id=ID)? (MimeType=string)? (Encoding=anyURI)?>)* </Signature>

100 XML

101 Canonicalization

102

103 XKMSXML Key Management Specification X-KRSS

104 X-KISS

105

106

107

108

109

110

111

セキュリティ関連XML規格の紹介

セキュリティ関連XML規格の紹介 XML 2002 6 10 XML WG SWG XML XML XML XML XML 2 XML 3 XML XML 4 2001 2002 7 8 9 10 11 12 1 2 3 4 5 6 XML V2 XML XML Web XACML SAML XKMS XML 5 XML 6 : ( ) ( ) : ) ( / ) XML 7 DoS XML 8 FW DIS DoS XML 9 XML