Interoperability between Heterogeneous Federation Architectures: Illustration with SAML and WS-Federation

International audienceDigital identity management intra and inter information systems, and, service oriented architectures, are the roots of identity federation. This kind of security architectures aims at enabling information system interoperability. Existing architectures, however, do not consider interoperability of heterogeneous federation architectures, which rely on different federation protocols.In this paper, we try to initiate an in-depth reflection on this issue, through the comparison of two main federation architecture specifications: SAML and WS-Federation. We firstly propose an overall outline of identity federation. We furthermore address the issue of interoperability for federation architectures using a different federation protocol. Afterwards, we compare SAML and WS-Federation. Eventually, we define the ways of convergence, and therefore, of interoperability

Requirements for identity management in next generation networks

Identity management will become crucial to the success of Next Generation Networks (NGN). However, until now very little research has been done in this fieid. This paper presents the requirements for identity management in NGN which are currently being investigated by our research group. Our analysis is based on the characteristics and requirements of NGN architectures, services, network operators, end users, identity management requirements for web services, recent standardization efforts by various bodies, etc

The Review of Non-Technical Assumptions in Digital Identity Architectures

The literature on digital identity management systems (IdM) is abundant and solutions vary by technology components and non-technical requirements. In the long run, however, there is a need for exchanging identities across domains or even borders, which requires interoperable solutions and flexible architectures. This article aims to give an overview of the current research on digital identity management. We conduct a systematic literature review of digital identity solution architectures and extract their inherent non-technical assumptions. The findings show that solution designs can be based on organizational, business and trust assumptions as well as human-user assumptions. Namely, establishing the trust relationships and collaborations among participating organizations; human-users capability for maintaining private cryptographic material or the assumptions that win-win business models could be easily identified. By reviewing the key findings of solutions proposed and looking at the differences and commonalities of their technical, organizational and social requirements, we discuss their potential real-life inhibitors and identify opportunities for future research in IdM

A cooperative cellular and broadcast conditional access system for Pay-TV systems

This is the author's accepted manuscript. The final published article is available from the link below. Copyright @ 2009 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other users, including reprinting/ republishing this material for advertising or promotional purposes, creating new collective works for resale or redistribution to servers or lists, or reuse of any copyrighted components of this work in other works.The lack of interoperability between Pay-TV service providers and a horizontally integrated business transaction model have compromised the competition in the Pay-TV market. In addition, the lack of interactivity with customers has resulted in high churn rate and improper security measures have contributed into considerable business loss. These issues are the main cause of high operational costs and subscription fees in the Pay-TV systems. As a result, this paper presents the Mobile Conditional Access System (MICAS) as an end-to-end access control solution for Pay-TV systems. It incorporates the mobile and broadcasting systems and provides a platform whereby service providers can effectively interact with their customers, personalize their services and adopt appropriate security measurements. This would result in the decrease of operating expenses and increase of customers' satisfaction in the system. The paper provides an overview of state-of-the-art conditional access solutions followed by detailed description of design, reference model implementation and analysis of possible MICAS security architectures.Strategy & Technology (S&T) Lt

A Survey on Handover Management in Mobility Architectures

This work presents a comprehensive and structured taxonomy of available techniques for managing the handover process in mobility architectures. Representative works from the existing literature have been divided into appropriate categories, based on their ability to support horizontal handovers, vertical handovers and multihoming. We describe approaches designed to work on the current Internet (i.e. IPv4-based networks), as well as those that have been devised for the "future" Internet (e.g. IPv6-based networks and extensions). Quantitative measures and qualitative indicators are also presented and used to evaluate and compare the examined approaches. This critical review provides some valuable guidelines and suggestions for designing and developing mobility architectures, including some practical expedients (e.g. those required in the current Internet environment), aimed to cope with the presence of NAT/firewalls and to provide support to legacy systems and several communication protocols working at the application layer

A 3GPP open-ID framework

Currently Mobile Network Operators (MNO) rely on an authentication, authorization and profile management architecture which has proved, by its generalized use and acceptance, as being appropriate. The use of a secure component, the SIM-Card, provides a set of capabilities not seen in other access architectures and an advantage for MNOs. Nevertheless upcoming requirements in terms of open interfaces, new services and customer demands are questioning the actual architecture. This paper presents a novel approach to authentication and profile management that can be reused by both MNOs and 3rd party providers to answer the upcoming requirements. Here, a user is able to store his own identity information in different places, while taking advantage of the strong authentication mechanisms provided by the MNO. Furthermore, by integrating MNOs' generic authentication architecture with user-centric identity management, we are creating a generic way for service providers to reuse this authentication infrastructure, providing both single sign-on and strong authentication. Copyright © 2010 The authors

Secure data sharing and processing in heterogeneous clouds

The extensive cloud adoption among the European Public Sector Players empowered them to own and operate a range of cloud infrastructures. These deployments vary both in the size and capabilities, as well as in the range of employed technologies and processes. The public sector, however, lacks the necessary technology to enable effective, interoperable and secure integration of a multitude of its computing clouds and services. In this work we focus on the federation of private clouds and the approaches that enable secure data sharing and processing among the collaborating infrastructures and services of public entities. We investigate the aspects of access control, data and security policy languages, as well as cryptographic approaches that enable fine-grained security and data processing in semi-trusted environments. We identify the main challenges and frame the future work that serve as an enabler of interoperability among heterogeneous infrastructures and services. Our goal is to enable both security and legal conformance as well as to facilitate transparency, privacy and effectivity of private cloud federations for the public sector needs. © 2015 The Authors

A Centralized SDN Architecture for the 5G Cellular Network

In order to meet the increasing demands of high data rate and low latency cellular broadband applications, plans are underway to roll out the Fifth Generation (5G) cellular wireless system by the year 2020. This paper proposes a novel method for adapting the Third Generation Partnership Project (3GPP)'s 5G architecture to the principles of Software Defined Networking (SDN). We propose to have centralized network functions in the 5G network core to control the network, end-to-end. This is achieved by relocating the control functionality present in the 5G Radio Access Network (RAN) to the network core, resulting in the conversion of the base station known as the gNB into a pure data plane node. This brings about a significant reduction in signaling costs between the RAN and the core network. It also results in improved system performance. The merits of our proposal have been illustrated by evaluating the Key Performance Indicators (KPIs) of the 5G network, such as network attach (registration) time and handover time. We have also demonstrated improvements in attach time and system throughput due to the use of centralized algorithms for mobility management with the help of ns-3 simulations

UniquID: A Quest to Reconcile Identity Access Management and the Internet of Things

The Internet of Things (IoT) has caused a revolutionary paradigm shift in computer networking. After decades of human-centered routines, where devices were merely tools that enabled human beings to authenticate themselves and perform activities, we are now dealing with a device-centered paradigm: the devices themselves are actors, not just tools for people. Conventional identity access management (IAM) frameworks were not designed to handle the challenges of IoT. Trying to use traditional IAM systems to reconcile heterogeneous devices and complex federations of online services (e.g., IoT sensors and cloud computing solutions) adds a cumbersome architectural layer that can become hard to maintain and act as a single point of failure. In this paper, we propose UniquID, a blockchain-based solution that overcomes the need for centralized IAM architectures while providing scalability and robustness. We also present the experimental results of a proof-of-concept UniquID enrolment network, and we discuss two different use-cases that show the considerable value of a blockchain-based IAM.Comment: 15 pages, 10 figure