Web. Web access control using UPKI Federation

Transcription

1 UPKI Web Web HTTP Shibboleth Squid Web access control using UPKI Federation Shingo TAKADA, 1 Naoya KANEKO, 1 Go SAITO, 1 Akira SATO, 1 Yasushi SHINJO, 1 Hisashi NAKAI 2 and Kozo ITANO 1 This paper describes a flexible access control system for Web that is used in public places including libraries. In this system, visitors are authenticated by Shibboleth, a Single Sign On Protocol. Administrators can describe access control policies using URL patterns in regular expressions and the attributes from Shibboleth. Before visitors access web servers through a proxy server, they are authenticated by Shibboleth servers of their organizations. According to the attributes from Shibboleth, access control rules in the proxy server are dynamically modified. As a result, administrators no longer have to create temporary accounts for visitors. The overhead of the access control system was negligible. 1. Web Web Web ( ) A A Web Shibboleth 1) UPKI Shibboleth 3) Shibboleth 2. Opengate 5) Opengate Shibboleth 7) Opengate L4 1 University of Tsukuba, Graduate School of Systems and Information Engineering. 2 University of Tsukuba, Graduate School of Library, Information and Media Studies. 1 c 2010 Information Processing Society of Japan

2 IP Opengate 6) Web Web TCP 80 (L4) HINET2007 4) HINET2007 Shibboleth (L4) Web (L7) Web (GET ) URL 3. Shibboleth Shibboleth Web 3.1 Shibboleth Shibboleth Internet2 SAML(Security Assertion Markup Language) Shibboleth IdP(Identity Provider) SP(Service Provider) IdP DS(Discovery Service) SP SP IdP SP DS DS IdP IdP IdP IdP () 1 Fig. 1 Authentication Flow 3.2 HTTP Web Shibboleth Web HTTP Squid 2) HTTP (Web ) Web Squid url rewrite program Web Shibboleth SP CGI Shibboleth Shibboleth DS DS IdP IdP IdP Shibboleth ( 1) 2 c 2010 Information Processing Society of Japan

3 3.3 2 Fig. 2 System overview Shibboleth edupersonscopedaffiliation edupersonentitlement Web Web 0 Web Web url method action URL HTTP (ACCEPT) (REJECT) () Linda Ruby Linda Ruby Rinda TupleSpace TupleSpace TupleSpace Ruby druby TupleSpace IP Web Shibboleth DS IP edupersonscopedaffiliation edupersonentitlement TupleSpace URL TupleSpace IP IP Web TupleSpace IP Shibboleth 4.2 Shibboleth SP CGI Cookie Shibboleth DS Shibboleth edupersonentitlement edupersonscopedaffiliation TupleSpace IP CGI IP TupleSpace Shibboleth Web Apache Shibboleth SP shibboleth-2.2 CGI Ruby c 2010 Information Processing Society of Japan

4 4.3 URL Rewrite Program Squid url rewrite program URL URL IP TupleSpace IP URL IP Web Web URL ACCEPT REJECT URL CGI URL Web TupleSpace IP IP Rinda notify Rinda Tuple (TTL: Time To Live) TupleSpace TTL TupleSpace CGI TupleSpace IP TTL 4.4 Web Web Shibboleth 3.3 Web YAML 3 Twitter edupersonscopedaffiliation ^student@.+ URL 2ch\.net, bbspink\.com, machi\.to (REJECT) (method) Twitter Twitter URL twitter\.com/sessions twitter\.com URL POST Twitter ACCEPT - cond: affiliation: "^student@.+" rules: - url: "2ch\.net" - url: "bbspink\.com" - url: "machi\.to" - url: "twitter\.com/sessions" action: ACCEPT - url: "twitter\.com" method: POST default_policy: ACCEPT 3 Fig. 3 Rule example CGI TupleSpace IP Rinda notify Rewrite Program IP IP TTL TupleSpace notify Rewrite Program IP IP 4 c 2010 Information Processing Society of Japan

5 ( 1 ) IdP OPAC ( 2 ) IP ( 3 ) Shibboleth edupersonentitlement edupersonscopedaffiliation lafrenze SP IdP PC Citrix XenServer HTTP 500 HTTP HTTP HDD NIC1 NIC2 OS Proxy Server HDD NIC VMM OS HDD NIC OS HTTP Server L2 Switch 1 lafrenze Intel Core2Duo E GHz / 2Core DDR2-SDRAM 4096MB HGST HDP725025GLA380 SATA 250GB 7200rpm Intel PRO/1000 MT Desktop Adopter 1000BASE-T for WAN Realtek RTL8168c 1000BASE-T for LAN Linux el5 squid 2.6.STABLE21-3.el5 abyss Intel Core2Duo E GHz / 2Core DDR2-SDRAM 4096MB HGST HDP725025GLA380 SATA 250GB 7200rpm Realtek RTL8168c 1000BASE-T for LAN Citrix XenServer p SP orpheus / IdP eurydice [ OS] MB Linux el5 HTTP laila Intel Core2Quad Q GHz / 4Core DDR2-SDRAM 4096MB HGST HDT72502 SATA 250GB 7200rpm Intel PRO/1000 MT Desktop Adopter 1000BASE-T Linux el5PAE Apache el5.centos.2 DELL PowerConnect BASE-T 2 [s] [ ] (URL ) (URL ) c 2010 Information Processing Society of Japan

6 Direct Connection Via Proxy (w/o rewrite) Via Proxy (with rewrite) 906 requests / sec 824 requests / sec 796 requests / sec req / sec # of requests / sec 4 Fig. 4 Benchmark result HTTP laila 1024 IdP eurydice HTTP () 3 Ruby HTTP Net::HTTP 1 1 Squid url rewrite program Squid Squid URL UPKI Web Shibboleth Web URL IP Linda Ruby Rinda TupleSpace Web POST POST Web Acknowledgement ICT 1) Internet2 middleware architecture committee for education(mace) directory working group. (Accessed: ). 2) squid : Optimising web delivery. (Accessed: ). 3) shibboleth upki. (Accessed: ). 4),,. sso., Vol. 109, No. 299, pp , ),,,. opengate.. IN,, Vol.99, No. 591, pp , ),,.., Vol. 109, No.60, pp , ),,,. Opengate.. IA,, Vol. 108, No. 459, pp , c 2010 Information Processing Society of Japan