セキュリティ関連XML規格の紹介

Size: px

Start display at page:

Download "セキュリティ関連XML規格の紹介"

かずまさわたぬき
4 years ago
Views:

1 XML SAML XACML

2 XML SAML XACML 2002/8/23 1

3 XML XKMS 2.0 W3C: A XML Signature W3C: C SAML OASIS: WS-Security OASIS: XPath Filter 2.0 Exclusive XML C14n W3C:W3C: Canonical XML W3C: D SOAP XML Encryption W3C: XACML OASIS: Decryption Transform W3C: XML B 2002/8/23 2

4 SAML Security Assertion Markup Language / SAML XML 2002/8/23 3

5 SAML Pull Model Push Model 3rd Party Security Model SOAP/HTTP Redirection Proxy 2002/8/23 4

6 SAML SAML 1.0 Specification Set (31 May 2002) Committee Specifications (revision 01) Assertions and Protocol Assertion Schema Protocol Schema Binding and Profiles Security and Privacy Considerations Conformance Program Specification Glossary 2002/8/23 5

7 SAML Policy Policy Policy Credentials Collector Authentication Authority Attribute Authority Policy Decision Point Authentication Assertion Attribute Assertion Authorization Decision Assertion SAML System Entry Authentication Assertion Policy Enforcement Point 2002/8/23 6

8 SAML Pull Model 0 Pull /8/23 7

9 SAML Push Model 0 Push /8/23 8

10 SAML 3rd Party Security Model /8/23 9

11 SAML (Push) /8/23 10

12 SAML (Pull) /8/23 11

13 SAML <samlp:request MajorVersion="1" MinorVersion="0 RequestID= 8xtyzzKqPMLcFswefRIJAL"> <samlp:respondwith>authenticationstatement</samlp:respondwith> <samlp:authenticationquery> <saml:subject> <saml:nameidentifier Name= JFB"/> <saml:subjectconfirmation> <saml:confirmationmethod> </saml:confirmationmethod> <saml:subjectconfirmationdata> utkaryqmytsz= </saml:subjectconfirmationdata> </saml:subjectconfirmation> </saml:subject> </samlp:authenticationquery> </samlp:request> NameIdentifier ConfirmationMethod 2002/8/23 12

14 SAML ( ) <samlp:response InResponseTo= 8xtyzzKqPMLcFswefRIJAL MajorVersion="1" MinorVersion="0 ResponseID= xmlconsortium "> <samlp:status> <samlp:statuscode Value="samlp:Success"/> </samlp:status> <saml:assertion AssertionID="qJcZsDTnJBPPe/4tIJKuZ/OLMtE= IssueInstant=" T11:22: Issuer= JUSTAir MajorVersion="1" MinorVersion="0"> <saml:conditions NotBefore=" T11:22: NotOnOrAfter=" T15:22: "/> <saml:authenticationstatement AuthenticationInstant=" T11:22: AuthenticationMethod=" /password"> <saml:subject> <saml:nameidentifier Name= JFB" SecurityDomain= just:reservation"/> <saml:subjectconfirmation> <saml:confirmationmethod> /password </saml:confirmationmethod> </saml:subjectconfirmation> </saml:subject> </saml:authenticationstatement> </saml:assertion> </samlp:response> Assertion NameIdentifier 2002/8/23 13

15 SAML Interoperability OASIS InterOp [7/15] 12 (Portal Site / Contents Site) Availability / (Java / C++) by Internet2(UCAID) 2002/8/23 14

16 XACML extensible Access Control Markup Language XACML / 2002/8/23 15

17 XACML XACML Working Draft 15 (12 July 2002) Policy Schema Context Schema 2002/8/23 16

18 XACML XACL XML Access Control Language IBM XSS4J XACML XACL <xacl> <object href= premium ] /> <acl> <subject><role>requester</role></subject> <action name= read permission= grant /> <condition operation= and > <predicate name= comparestr > <parameter value= eq /> <parameter> <function name= getuid /> </patameter> <parameter> <function name= getvalue > <parameter value= /name /> </function> </parameter> </predicate> </acl> </xacl> 2002/8/23 17

19 XACML PEP: Policy enforcement point PDP: Policy decision point PRP: Policy retrieval point PAP: Policy administration point PIP: Policy information point Requester PEP XML XML Repository SAML Request SAML Response PIP subject, resource, environment XACML Request install PAP PDP PRP XML XACML Response retrieve store XACML Repository 2002/8/23 18

20 XACML policysetstatement policystatement rule obligations target condition effect subjects resources actions 2002/8/23 19

21 XACML Effect (Allow) (Deny) Target Match Match Condition True False Rule Effect Not applicable Allow Deny Match Indeterminate Indeterminate No-match True Not applicable No-match False Not applicable No-match Indeterminate Not applicable 2002/8/23 20

22 XACML XACML Context domain-specific inputs xacml.xml domain-specific outputs xacmlcontext/ request.xml PDP xacmlcontext/ response.xml 2002/8/23 21

23 XACML <Rule RuleId= //cons.com/rule/id/1 Effect= Allow > <Description>Sample policy</description> <Target> <Subjects MatchId= function:string-match DataType= xs:boolean > <AttributeDesignator Designator= //xacmlcontext/subject/attr DataType= identifier:rfc822name /> <Attribute DataType= identifier:rfc822name </Subjects> <Resources MatchId= function:string-match DataType= xs:boolean > <AttributeDesignator Designator= //xacmlcontext/request/res... DataType= xs:anyuri /> <Attribute DataType= xs:anyuri >//cons.com/record.*</attribute> </Resouces> <Actions MatchId= function:subset DataType= xs:boolean > <AttributeDesignator Designator= DataType= xs:string /> <Attribute DataType= xs:string >read</attribute> </Actions> </Target> <Condition FunctionId= function:daytimeduration-greater-than DataType= xs:boolean > <Function FunctionId= function:date-subtract DataType= xs:daytimed... > <AttributeDesignator Designator= //xacmlcontext/other/ today... DataType= xs:date /> <AttributeDesignator Designator= //xacmlcontext/request/ /employee/employeedob DataType= xs:date> </Function> <Attribute DataType= xs:daytimeduration >20-0-0</Attribute> </Condition> </Rule> subjects resources actions condition ( ) /8/23 22

24 / 2002/8/23 23

25 XML Consortium XML XML /8/23 24

untitled

untitled SAML 2004 12 9 y-endo@ah.jp.nec.com 2. SAML SAML SAML SAML SAML SSO SAML 4. Liberty Alliance Liberty Liberty ID-FF1.2 NEC Corporation 2004 2 PKI ID NEC Corporation 2004 4 PKI ID NEC Corporation 2004 5