1 / 13

Separation of Security Functions in the Life Ray Portal: Credential Management Discussions

Explore the separation of functions within the Life Ray Portal for improved security and credential management. Discuss leveraging existing CAs, portal security box usability, and next steps in the design process.

santa
Download Presentation

Separation of Security Functions in the Life Ray Portal: Credential Management Discussions

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Discussions on the Life Ray Portal and credential managementDavid Groep, Oct 11th, 2011

  2. Separation of security functions

  3. EUGridPMA discussion • Separation of functions • thin portal: all credential management on dedicated box • may combine bridge, MyProxy and Uploader on 1 box • Quality of IdM is governed by MICS acceptability • i.e. must be of comparable LoA as TCS Personal • including eligibility requirements • Make sure superfluous keypairs are removed • only the proxy is needed, just like in the uploader case • remove MICS keypair when proxy generation completes • Portal security box acts like a UI to the user • only on explicit request of user & under user control • covered under PKP Guidelines – seems similar to the common ‘remote UI’ use case

  4. Proliferation • Aim to have a limited number of credential management systems, for potentially many portals. But initially one for Italy • Leverage existing MICS CAs as far as possible • no new CA for each portal or portal instance • aim to leverage TERENA TCS eScience Personal • but policy compatibility should still be understood • acceptability of portal instance comes down to CA, i.e. not revoking the certs • it is the MICS CA policy that must be satisfied • PMA only looks at CAs (not at the portals, please)

  5. Next steps • Updated design white paper will reflect changes • Prototype will be developed and demonstrated at later date to appropriate PMAs • Roberto C (and TCS PMA ;-) to study compatibilitywith TCS Personal Should be a significant step towards better usability!

More Related