슬라이드 1

Size: px

Start display at page:

Download "슬라이드 1"

태곤 초
6 years ago
Views:

2 PKI Kerberos SAML & Shibboleth OpenID Cardspace & ID 2

4 < > (= ) password, OTP, bio, smartcard, pki CardSpace, ID What you have.., 2 factor, strong authentication 4

5 (SSO) Kerberos, OpenID 5

6 Shared authentication SAML, shibboleth 6

7 PKI

8 / ( / ) N^2 /? or Sender Receiver Plain Message Encryption Encrypted Message Decryption Plain Message 8

9 ( / ) / Sender Public key of Receiver Private key of Receiver Receiver Plain Message Encryption Encrypted Message Decryption Plain Message 9

10 - =, Message Sender Private key of Sender Public key of Sender Receiver OK Signing Message + Signature Verification 10

11 -,? 2. Public key of R S Verify ownership R R : 11

12 - CA (Certificate Authority) CA CA <Certificate> R CA s sign 3. Publish CA 2. Public key of R 4. Verify Cert Sender 0. trust 1. Verify R CA s public Key 12

13 13 Root CA -KISA KISA 0. CA RA -KB 1. 0.root CA KISA s public Key

14 14 :

16 SSH (Secure Shell) MITM attack ( ) 16

17 KERBEROS, OPENID

18 SSO, point UserD B UserD B 18

19 19 Kerberos ( ) KDC (, ) KDC User AS Authentication Server TGS Ticket Granting Server KDC Key Distrib ution Center Kerberized Client Kerberized Server

20 Kerberos 20

21 Kerberos SSH Kerberos SSH Client Server 21

22 OpenID Open what? Provider : OP(openid provider) Id : Id OpenID (url) Trust Id pw OP 4.id/pw OpenID: Redirection ( ) 5. redirection(assertion) openid 1. ID 22

23 OpenID Protocol 23

24 OpenID SSH SSH Client SSH Server OpenID Client shell url OpenID, 24

25 SAML, SHIBBOLETH

26 Shared authentication domain -> SAML ID Federation?.. kimcs = cskim 26

27 Project Liberty.Net Passport Microsoft Kerberos like.. Liberty Project Liberty from M$ Sun, AOL,IBM! ID Federation authentication sharing (ID- FF -> SAML 2.0) Attribute sharing : ID- WSF 27

28 ID 28 IAM (Identity & Access Management)

29 ID Federation 29 Kimcs Alias :Mr3tTJ Remote site : Site B Name : dtviir cskim Alias :dtviir Remote site : Site A Name :Mr3tTJ

30 SSO 1 30

31 SSO 2 31

32 SSO- 32 Site B SiteA SiteA LOGIN ID : Password : kimcs ****** SiteB.

33 / 33 AuthNRequest RequestID MajorVersion MinorVersion IssueInstant consent Signature ProviderID NameIDPolicy ProtocolProfile RequestAuthnContext AuthnContextClass Ref AuthnContextComparis on RelayState SP Federation : federated SSO :none Artifact POST AuthNResponse ResponseID InResponseTo MajorVersion MinorVersion IssueInstant consent Signature Samlp:Status ProviderID RelayState Assertion AuthNRequest RequestID IDSP ID AuthNRequest RelayState

34 SAML SSH OpenID g-ssh-access-saml-20 34

35 Shibboleth project ( in Internet 2 Middleware) Attribute, Acess control 35

36 EIDMS(ETRI ID Management System) 36

37 37 SSO

38 CARDSPACE, ID

39 User Centric ID management Personal Identity Framework, : (,.. ), (,..) : password, OTP,, 39

40 CardSpace Microsoft client side ID / Card Issuer Card Consumer MS Cardspace Client 40

41 Cardspace SSH SSH CS 41

42 ID by ETRI 42 ID?,,, ID?,, DB,, ID : ETRI, Microsoft, KISA

43 43

45 OTP Bio PKI SmartCard / / 5 / 0/3 4 / 3 /. ->.... User-centric =>, 45

46 SSO SAML OpenID Kerberos, OpenID.., Open Toolkit.,, 2?? Proven Technologies SSH 46

47 Beyond SSH Virtual Organization Virtualization 47

48 PKI : SSO Kerberos : OpenID : SAML : ( ) User Centric or Personal Identity f/w & 48

49 Q&A 49

데이터통신

데이터통신 Future Internet Authentication : Trend and Perspective 2011 년 6 월 28 일, 박승철교수 (scpark@kut.ac.kr) 인증 (authentication) 정의 사용자가전자적으로제시한신원 (identity) 에대한신뢰 (confidence) 를확립하는작업 Process of corroborating an