Issues in Identity Management for Delay Tolerant Networks
Revision History
02.06.04 Initial Revision, mh
02.12.04 Update following DTN group meetings, mh
I. Issues
- How do you secure an identity?
Identities are
- How do you verify an identity?
- Within a region how do you validate that a device should have
access to resources, given that it has already obtained the
relevant token?
- Token expiration? Token renewal? Does expiration even make sense in
a disconnected context? Perhaps it should be governed on a region by
region basis.
- Is there a concept of tranference between regions?
- Can we use locality and identity to determine which network a
particular device can use to obtain credentials? (ie, based on
SSID location map, choose number to dial in order to obtain
access to a channel for which you have authority to access)
II. Identity Management Solutions
A. Ensim® Unify and Ensim Server Manager
[from Keshav]
- Use Active Directory to store identities
- Use Unify to manage them
- Mobile users get identity from Unify, and then can assert
rights to resources without having to log in every time
Questions:
- How will this operate in the context of mobile stations?
- How will this operate in a disconnected context, given that
mobile users may never be directly connected to the datacenter?
Active Directory and Linux
Since Unify is a Windows based management system, with the option? of
managing Linux servers as well, then the Linux servers would have to
talk to the Windows server - and authenticate against it.
http://www.securityfocus.com/infocus/1563
Major Issues
- Non-supported by MS
- Possibly not multi-platform friendly
- AD vs LDAP
- AD4Unix needs to be installed on datacenter and seems to
be potentially very finicky.
General Assessment
No clear relationship between Unify and DTN, platform issues,
however, some ideas/problems solved may be relevant to DTN.
Basic utility is the idea of using Active Directory/LDAP for
authentication and authorization.
B. Authd (Brent)
- software package for obtaining and verifying user credentials
based on RSA
- cluster-wide RSA public/private key pair allows clients
to verify user identity from anywhere
C. LDAP
- supports SSL, Kerberos, cleartext passwords, and SASL
- OpenLDAP (SleepyCat backend) http://www.openldap.org
- client/server interaction
- client establishes session (BIND)
- client performs ldap operation (supported list)
- client ends session (UNBIND)
- session can be ABANDONed
- supports ACLs to control access rights
http://quark.humbug.org.au/publications/system_auth/sage-au/system_auth.html
Actualization Items
- write an LDAP/PAM/NSS DTN proxy for authentication
- encapsulate bind and operation(s) into single request
- each query/update must be authenticated
- asynchronize communication
- supports whatever DTN security infrastructure we come up with
- determine how acls are communicated
- determine token issuing