1 / 4

A Proposal for the eduGAIN Trust Model Diego R. Lopez

A Proposal for the eduGAIN Trust Model Diego R. Lopez. Some Basic Principles. Obviously, based on X.509 PKI We are using TLS and XMLSig Only applicable to eduGAIN components Do not cross federation trust boundaries Keep certificate evaluation simple Single root of trust for all components

elmer
Download Presentation

A Proposal for the eduGAIN Trust Model Diego R. Lopez

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. A Proposal for the eduGAIN Trust Model Diego R. Lopez

  2. Some Basic Principles • Obviously, based on X.509 PKI • We are using TLS and XMLSig • Only applicable to eduGAIN components • Do not cross federation trust boundaries • Keep certificate evaluation simple • Single root of trust for all components • Flatten the certificate tree as much as possible • Additional peer identity evaluation • Based on the subject identifiers (DN and extensions) • Basic procedures provided by the eduGAINBase API

  3. The CA Hierarchy eduGAIN Root CA . . . . eduGAIN Common CA eduGAIN Fed1 CA eduGAIN FedN CA HLS server(s) BE1 BE1 . . . FPP Fed1 . . . . . . BEN BEN FPP FedN

  4. Peer Validation • The subject DN of each certificate MUST contain the eduGAIN component identifier • Including the CAs • CN is the most obvious choice for this • The AlternateSubjectName extension MUST contain the FQDN for the interfaces these component is offering • Peers SHOULD be validated using these identifiers • From pre-configured metadata • From metadata received through the HLS • Common basic methods for this will be provided by eduGAINBase • Metadata installation • Peer validation • A detailed specification is required

More Related