Subject: [abfab] I-D Action: draft-wei-abfab-usecases-00.txt

From: "Wei Juan" <[email-masked]>
Date: Thu, 26 Sep 2013 09:11:20 +0800

Dear all,

We just submitted an I-D to IETF regarding the security of  federated identitiy managment in ABFAB few days ago. Please kindly review and feel free to give us any comments. Thank you in advance.

Key points & Requirements Analysis
This I-D describes two use cases in ABFAB.  The main idea is to differentiate the level of assurance for authentication and to classify the authenticity of attributes in order to improve the security and usability of federation identity management on ABFAB architecture.

The former is usually used for meeting the requirements of multiple terminals accessing network and complexity  of network environment. To differentiate authentication level can make a trade-off between usability and security. The latter is typically used to assist service providers to make authorization decisions, that is service providers can grant specific protected resources to requestors according  the trustworthiness of their identity attributes without compromising the security of resources.

Although ABFAB architecture can support multiple authentication mechanisms and attributes transmission, it does not give a fine-grained classification which can satisfy requirements in real world better.

Best wishes, Juan

Wei Juan

---

From: Sam Hartman <[email-masked]>
Date: Thu, 26 Sep 2013 09:26:58 -0400

ABFAB is typically used for application authentication rather than say
network authentication.
However, in your example you suggest that the level of assurance
required might depend on what network technology a user is using.
I'd like to better understand how that is true in your environment.

--Sam

---

From: "Wei Juan" <[email-masked]>
Date: Thu, 26 Sep 2013 22:00:23 +0800

sorry, what I really want to say  is that  different applications may require different level of assurance for authentication. For example, a financial application usually requires a higher level of assurance for authentication while the level of authentication of a general application may be lower. In addtion, the network technology a user is using just represents the environment of accessing target application, and the same application may require different level assurance for authentication in different environment in order to guarantee the security of services.

Wei Juan

From: Sam Hartman
Date: 2013-09-26 21:26
To: Wei Juan
CC: abfab
Subject: Re: [abfab] I-D Action: draft-wei-abfab-usecases-00.txt

--Sam

---

From: Sam Hartman <[email-masked]>
Date: Thu, 26 Sep 2013 10:27:42 -0400

I think  a better example of environment might be location than network
technology.
At least in enterprize contexts, it's somewhat common to require higher
LOA when accessing a resource from off-site than when accessing it from
within a secure space.