Vol.55 No (Mar. 2014) 1,a) , SAML/ID-WSF ID-WSF A Proposal and an Evaluation of Technology on Federated Identity and

Size: px

Start display at page:

Download "Vol.55 No (Mar. 2014) 1,a) , SAML/ID-WSF ID-WSF A Proposal and an Evaluation of Technology on Federated Identity and"

さいぞうはらしない
4 years ago
Views:

1 1,a) , SAML/ID-WSF ID-WSF A Proposal and an Evaluation of Technology on Federated Identity and Usage of Attributes in Cloud Computing Takashi Shitamichi 1,a) Ryoichi Sasaki 1 Received: March 25, 2013, Accepted: December 4, 2013 Abstract: Federated services among multi-domain network are expected to be widely deployed onto cloud computing environment. Technology not only for federated identity but also services using distributed attributes, that are not only static but also dynamic, are required. Focusing on SAML and ID-WSF, that are technology for identity management and services with privacy, this paper discusses deployments and problem of them in the real world to extend ID-WSF, proposes adaptable, fast and safe technology which can safely use attributes, and evaluates the effectiveness of the proposed technology. Keywords: identity, cloud computing, federation 1. SAML Security Assertion Markup Language [1] OpenID [2], OAuth [3] 1 Tokyo Denki University, Adachi, Tokyo , Japan a) takashi.shitamichi@private. .ne.jp Federated Identity [4] SAML SAML Shibboleth [5] SAML Liberty Alliance ID-WSF Identity Web Service Framework [6] SAML c 2014 Information Processing Society of Japan 1186

2 static attribute dynamic attribute [7] Facebook Twitter API [8] SSO [9] LAN SSO [10] [11] [12] Web RTT: Round Trip Time SAML/ID-WSF ID-WSF Web SAML ID-WSF SAML ID-WSF SAML ID-WSF 2.1 SAML SAML SSO: Single Sign On 2000 SAML IdP: Identity Provider STS: Security Token Service SP: Service Provider SP IdP IdP SAML SAML XML SAML SSO 1 Web UA User Agent SSO 1 ID c 2014 Information Processing Society of Japan 1187

1 SAML Fig. 1 Identity federation using SAML. 3 SAML Fig. 3 Structure of SAML token. 2 Liberty Alliance Fig. 2 Framework of Liberty Alliance specification.

3 1 SAML Fig. 1 Identity federation using SAML. 3 SAML Fig. 3 Structure of SAML token. 2 Liberty Alliance Fig. 2 Framework of Liberty Alliance specification. SAML SSO Web SSO 3 [13] (1) SP-initiated SSO: Redirect/POST Bindings (2) SP-Initiated SSO: POST/Artifact Bindings (3) IdP-Initiated SSO: POST Binding SSL/TLS SAML Web SOAP Simple Object Access Protocol SAML (2) *1 2.2 ID-WSF ID-WSF Web Liberty Alliance SAML ID-WSF 2 ID-WSF SOAP *1 SSL/TLS [14], [15] SSL/TLS SOAP [16] 4 ID-WSF Fig. 4 Message flow of ID-WSF. ID 3 SAML [17] XML IdP ID-WSF 4 SOAP ID-WSF OpenID REST Representational State Transfer SOAP WS-* c 2014 Information Processing Society of Japan 1188

4 SOAP ID-WSF WSP Web Service Provider WSP URL DS Discovery Service WSC Web Service Consumer DS WSC WSC WSP URL DS WSC WSP WSP WSC 2 IS: Interaction Service /ID-WSF ID-WSF AOL Radio@AOL ID-WSF [18] Nokia ID-WSF SOA [19], [20] [21], [22], [23], [24], [25] ID-WSF [26], [27] 3. SAML SSO SAML SSO POST/Artifact Bindings 3.1 AWS Amazon Web Service 7 IaaS Amazon EC2 Elastic Computing Cloud 1 PC AWS EC2 RTT msec () hop Table 1 RTT between client PC and each AWS EC2 regions (msec, (): number of hops). (1) AWS EC2 PC AWS EC2 OS/Middleware Fedora bit/jdk1.6 Tomcat6 OpenAM9.5.3 Small 1.7 GB memory 1 EC2 Compute Unit 160 GB storage IP 14 Elastic IP PC OS Mac OS X Web Firefox Wired 100 Mbps (2) 7 IdP SP 14 SAML SSO SAML SSO Web IdP SP RTT PC RTT traceroute (3) 1 PC RTT ms ms 30 RTT / ms RTT / ms 20 c 2014 Information Processing Society of Japan 1189

5 2 IdP/SP Table 2 Duration between IdP and SP. 5 SAML SSO POST/Artifact Bindings Fig. 5 Sequence of SAML SSO POST/Artifact Bindings. RTT 1msec 3.2 AWS EC2 SAML SSO (1) (2) SAML SP-Initiated SSO POST/Artifact Bindings AWS EC2 7 IdP SP tshark 5 t1 t24 24 T 1 =SP IdP T 2 = SP T u = SP T T = T 1 + T u + T 2 T u T s T s = T 1 + T 2 T s T s (3) IdP/SP 2 T 1 / 989 msec T 2 / 1,929 msec T s / 2,540 msec T 1 T 2 T s / 63 msec 199 msec 262 msec T s / 2,540 msec / 262 msec 10 T 1 1 T 2 2 T 2 / / 3 5 S 8 S 9 IdP/SP SOAP 3 t14 t19 Δ Δt15 = 468 msec Δt16 = 294 msec Δt17 = 3 msec TCP/IP Δt15 [SYN] [SYN, ACK] [SYN] TCP/IP Δt16 POST [ACK] IdP S8 Artifact Response S8 c 2014 Information Processing Society of Japan 1190

6 3 T1 T2 Table 3 Duration of T1 and T2. Idp Δt17 3msec SOAP 3.3 SAML ID-WSF [28], [29] (1) 4 ID-WSF WSC WSP *2 ID-WSF WSC WSP WSC WSP *2 Web 3 47% 2 Web Web 3 40% [31] ID-WSF (2) [30] ID-WSF *3 4. ID-WSF 2 RTT ID-WSF WSC (1) (a) WSP WSPs WSPd A B *3 Liberty Geo Location Service [32] c 2014 Information Processing Society of Japan 1191

7 ID-SIS Personal Profile id-sis-pp <DyamicAttributes> id-sis-pp XML 6 Fig. 6 Message flow of dynamic attributes roaming. (b) WSPd WSC WSPr WSC WSPd HTTP (a) (b) 6 (2) WSC ID-WSF ID-SIS id-sis-wps id-sis-wpd id-sis-wpr 3 id-sis-wps (3) WSC WSPr 6 () 1 WSPd DS dd1 WSC WSPs id-sis-wps <DynamicAttributes> id-siswpd WSC DS WSPd 2 DS dd2 WSC c 2014 Information Processing Society of Japan 1192

8 3 WSPd pd1 ResourceID WSC WSPd 8 WSPr WSPd cd1 WSPr BulkRequest WSPd 4 WSPd pd2 WSPd 9 WSPd WSPr cd2 WSPd WSPr 5 WSPr DS dr1 WSPd roam WSC ServiceType id-sis-wpr DS WSPr 6 DS dr2 DS WSPr ResourceID 10 pr1 WSC WSC WSPr WSPd UA WSPr WSPd (4) WSPr pr1 WSPd WSPr WSC WSPr 4.2 SOAP 1 1 RTT RTT (1) WSPr n WSPd n c 2014 Information Processing Society of Japan 1193

9 Fig. 7 7 Sequence of dynamic attributes roaming method. Fig. 9 9 System flow of parallel transfer of batched dynamic attributes. 8 Fig. 8 Comparison with transfer methods. n HTTP SOAP n SOAP (2) SOAP SSL SOAP XML XML SOAP XML (3) 8 (a) HTTP GET (b) HTTP GET (c) 1 (4) C 9 S1 WSPr CP n fork() S2 CP HTTP GET WSPd n b n S3 WSPd httpd CGI S4 CP HTTP GET httpd CGI n c 2014 Information Processing Society of Japan 1194

10 S5 n S6 HTTP SOAP CP S7 CP SOAP b n S8 CP WSPr 4 RTT sec / Table 4 Comparison of RTT in each method and effectiveness (msec, effectiveness: non-roaming/roaming) XML (a) (b) (a) WSC (b) WSPd WSPr n n n (a) 5.1 (1) 7 3 (Ts1,Ts2) (Td1,Td2) (Tr) WSC S8 S9 n S8 S9 / td1/td2 td3/td4 tdp 1 Td1 RTT Tdt Tdt = = n (Td1)i = i=1 n (ΔS8+ΔS9+tdp)i i=1 n ((td2 td1) + (td4 td3) + (td3 td2))i i=1 RTT Trt Trt = 17 i=12 ΔSi + 5 (trp)i i=1 =(tr2 tr1) + (tr3 tr2) + +(tr12 tr11) Tdt Trt AWS EC2 (2) AWS EC2 WSC WSPd WSPr DS/IdP C AWS EC2 1GB mem CentOS5.7 Apache 2.2 MySQL5.1 1,024 2,048 8,192 16,384 byte C (3) 4 N N =1 10, 20, 50, 100, 200, 500, 1,000 RTT Trt RTT Tdt WSC WSPd 10 (4) 8,192 byte 4 10 / / c 2014 Information Processing Society of Japan 1195

11 10 N =1 10 RTT Fig. 10 Comparison of RTT with each methoed from N =1 to 10. RTT RTT RTT WSC WSPd RTT N =1,000 WSC WSPd RTT N N = 100 N >100 N =3 > 1 N =20/ / 1 N N 1 N =1,000 8,192 1,000=8 MB RTT N =10 10 (5) / 100 RTT 2.79 / 11 M Fig. 11 Comparison of transfer time at multiplicity M. RTT RTT 5.2 (1) 1 WSPd SOAP WSPr AWS EC2 (2) 2 AWS EC2 WSPd WSPr AWS EC2 1.7 GB mem High-CPU Medium Instance CentOS6.3 Apache 2.2 MySQL KB 256 KB 512 KB 768 KB 1,536 KB (3) WSPr WSPd M HTTP M 4.2 C 10 (4) M c 2014 Information Processing Society of Japan 1196

12 12 M Fig. 12 Comparison of transfer bandwidth at multiplicity M. vmstat OS WSPr M = 100 CPU Idle 90% WSPd M =50 CPU idle 70% M = % CPU (5) AWS EC AWS AWS AWS 13 XML Fig. 13 Comparison of processing time to attach XML signature. 5.3 (1) SSL AWS EC2 OS XML XML Security Library (2) AWS EC2 2 PC 3 AWS EC2 1.7 GB mem High-CPU Medium Instance CentOS6.3 Apache 2.2 MySQL5.5 PC Native Core i7 2.2 GHz 4 core 16 GB mem MacOS 10.7 VM Virtual Box GB mem CentOS6.3 XML Security Library xmlsec SHA256 RSA2048 XML 100 KB 500 KB 1MB 2MB 4MB 8MB (3) XML AWS EC2 2 3 XML (4) 13 XML 14 XML AWS EC2 High-CPU Medium Instance PC 20 30% c 2014 Information Processing Society of Japan 1197

13 14 XML Fig. 14 Comparison of processing time to verify XML signature. 5 Table 5 Effectiveness by each method. 1MB XML 74 msec 58 msec 2MB XML 123 msec 99 msec OS Linux MacOS CPU xmlsec MacOS Linux (5) AWS EC2 CPU PC SOAP XML 6. 5 AWS XML XML AWS XML 7. SAML/ID-WSF RTT SOAP [1] OASIS Security Services (SAML) TC, available from home.php? wg abbrev=security. [2] OpenID Authentication 2.0 Final, available from 0.html. c 2014 Information Processing Society of Japan 1198

[3] The OAuth 1.0 Protocol, available from http://tools. ietf.org/html/rfc5849. [4] Liberty Alliance Project White Paper, available from http://www.projectliberty.

14 [3] The OAuth 1.0 Protocol, available from ietf.org/html/rfc5849. [4] Liberty Alliance Project White Paper, available from ad/387/2720/file/liberty Federated Social Identity.pdf. [5] Internet2 Shibboleth Project, available from [6] Liberty Alliance ID-WSF 2.0 Specifications including Errata v1.0 Updates, available from projectliberty.org/resource center/specifications/liberty alliance id wsf 2 0 specifications including errata v1 0 updates/. [7] Web AI Vol.24, No.4, pp , [8] Takeda, Y., Kondo, S., Kitayama, Y., Torato, M. and Motegi, T.: Avoidance of Performance Bottlenecks Caused by HTTP Redirect in Identity Management Protocols, DIM 06, Proc. 2nd ACM Workshop on Digital Identity Management, ACM (2006). [9] Tran, T. and Wietfeld, C.: Approaches for Optimizing the Performance of a Mobile SAML-based Emergency Response System, Enterprise Distributed Object Computing Conference Workshops, EDOCW 2009, 13th, IEEE (2009). [10] Vol.47, No.3, pp (2006). [11] F-1 (2010). [12] Cuddy, S., Katchabaw, M. and Lutfiyya, H.: Context- Aware Service Selection Based on Dynamic and Static Service Attributes, Wireless And Mobile Computing, IEEE International Conference on Networking And Communications (WiMob 2005 ), Vol.4, IEEE (2005). [13] Security Assertion Markup Language (SAML) V2.0 Technical Overview, OASIS (25 Mar. 2008). [14] SSL/TLS renegotiation IPSJ SIG Notes 2010-CSEC-50(12), 1-4, (2010). [15] Heninger, N., Durumeric, Z., Wustrow, E. and Halderman, J.A.: Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices, USENIX Security 12 (2012). [16] V2.5 (2012). [17] ID-WSF (2011). [18] Liberty Alliance Project XML (Sep. 2005). [19] Nokia Web Services Framework for Devices A Serviceoriented Architecture, NOKIA CORPORATION. [20] Web Services Framework API: Using the API, available from Developers Library/GUID-759FBC7F A8D4B76F6AA6/html/Web Services Framework API4. html. [21] (Sep. 2008). [22] Vol.2009-DPS-141, No.14 (2009). [23] ID IN (2010-1) (2009). [24] FIT L-035 (2010). [25] Hatakeyama, M. and Shima, S.: Privilege Federation between Different User Profiles for Service Federation, DIM 08, Proc. 4th ACM Workshop on Digital Identity Management, ACM (2008). [26] 9 2r gdlt-att/2r gdqj.pdf. [27] html. [28] Liberty Alliance Liberty ID-WSF Security Mechanisms Core, available from org/liberty/content/download/3478/23060/file/libertyidwsf-security-mechanisms-core-2.0-errata-v1.0.pdf. [29] ID-WSF 2.0 SecMech SAML Profile, available from /file/liberty-idwsf-security-mechanisms-saml-profilev2.0.pdf. [30] No.28, pp , (2010). [31] Forrester Research: ecommerce Web Site Performance Today An Updated Look At Consumer Reaction To A Poor Online Shopping Experience (Aug. 2009), available from ecommerce website perf wp.pdf. [32] Liberty ID-SIS Geolocation Service Specification, available from center/specifications/liberty alliance id sis 1 0 specifica tions/. AT&T UNIX Java API 2010 IPA Ruby ISO SC27/WG5 ISACA CISA CISM c 2014 Information Processing Society of Japan 1199

1971 3 4 2001 4 2007 4 1998 2002 2007 IT 2008 c

15 IT 2008 c 2014 Information Processing Society of Japan 1200

ppt

ppt XML Liberty Alliance Project 2005 9 13 Liberty Alliance SIG Co-Chair NEC 1 Liberty Alliance 2 Liberty Alliance Project Liberty Alliance Liberty 3 Liberty Alliance Project 4 Liberty