APAN 25 Middleware Session, Hawaii Jan.24, 2008 Japanese University PKI (UPKI) Update and Shibboleth using PKI authentication

Transcription

1 APAN 25 Middleware Session, Hawaii Jan.24, 2008 Japanese University (U) Update and Shibboleth using authentication National Institute of Informatics, JAPAN Toshiyuki Kataoka, Shigeki Tanimoto, Masaki Shimaoka

2 OUTLINE 1.Overview of U 2.U Common Specifications 3.U Public Server Certificate 4.U Start-Pack 5.Shibboleth using Authentication 2

3 1. Overview of U 3

4 1-1 U Architecture Open Domain サーハ サーハ Srv. NII Pub Other Pub サーハ サーハ Srv. Sign, Encrypt. Campus A Univ. 学内用学内用 Auth, Sign, Encrypt. B Univ. 学内用学内用 Auth, Sign, Encrypt. NAREGI A Univ. NAREGI B Univ. NAREGI Grid Computing Server, Super Computer Student, Faculty Server, Super Computer Student, Faculty 4

5 1-2 U Activities Open Domain サーハ サーハ Srv. NII Pub Server Certificates サーハ サーハ Srv. Other Pub Certificates Sign, Encrypt. Campus A Univ. Start-Pack 学内用学内用 Auth, Sign, Encrypt. U Common Specification B Univ. Auth, Sign, Encrypt. Eduroam 学内用学内用 NAREGI A Univ. NAREGI NAREGI- Enhancement B Univ. NAREGI Grid Computing Server, Super Computer Student, Faculty Server, Super Computer Student, Faculty 5

6 2. U Common Specifications 6

7 2-1 U Common Specifications Open Domain サーハ サーハ Srv. NII Pub Other Pub サーハ サーハ Srv. Sign, Encrypt. Campus A Univ. 学内用学内用 Auth, Sign, Encrypt. U Common Specifications B Univ. Auth, Sign, Encrypt. 学内用学内用 NAREGI A Univ. NAREGI B Univ. NAREGI Grid Computing Server, Super Computer Student, Faculty Server, Super Computer Student, Faculty 7

8 2-2 U Common Specifications U Common Specifications Campus procurement guidelines deployment Campus CP/CPS templates -To reduce cost -To keep multi Campus model cooperativity Two outsource models and one insource model Outsource model (FY2006) Developed and Published from; (Japanese Only) Insource model (FY2007) Developed, and to be published soon -To promote Campus To keep multi-universityuniversity Campus Spec. Campus CP/CPS templates Outsource model Outsource model Insource model Multi-university cooperative model Multi-university cooperative model -Deployment of campus at each universities -Connecting universities - Federation of applications 8

9 2-3 Operation Models of Full outsource Univ. provider CP/CPS RA IA IA outsource Univ provider RA IA Insource Univ RA IA 9

10 2-4 Construction of Common Specification Common Specification of Campus (1) Guidance (2) Campus supply specification 1 Guideline 2 Template (3) Campus CP/CPS Guideline 1 Guideline 2 Template CP/CPS Download URL: (Japanese only) 10

11 3.U Public Server Certificate 11

12 3-1 Server Certificate Pilot project Project status FY2006: Developed RA/LRA model for High-Ed Institutions FY2007: Started to issue public server certs Objectives Deployment of server certificates to High-Ed Institutions Feasibility study of developed schemes optimized for High- Ed Feasibility study of business operation over FY2009 What it does Providing a server certificate to participants Achieving LoA equal to commercial High-Assurance certs Delegating some RA operations to Local operator of participants Customizing the local operation practice by each participants Available participants Institutions participated to SINET (Need a subscription) 12

13 3-2 Quick view of Pilot project (cont d) Challenges Optimization of RA operation for High-Ed Customization of local operation in each institution Automization of RA operation by using Campus certs as a credential (in the future) Expected outcomes Best practice of local operation optimized for High-Ed Tips for server certificate installation (for niche implementation) Tips for local operations improvement in institutions Demand of stimulation for (using for Local Operators) 13

14 3-3 Schemes for Registration and Issuance Offline Online Cert chain Organization identity Domain ownership Local operator acceptance IA Registration & Issuance RA operator Root Provider NII Open Domain Bulk request Bulk recipience Server Installation High-Ed Institution Subscriber Identity Subscriber Acceptance Server ownership Local Operator CSR Certificate Subscriber 14

15 3-4 Issuance of U Public Certificates Number of Certificates Feb/ Mar/ April/ May/ 07 June /07 36 July/ Aug/ Sep/ 07 Oct/ Nov/ Dec/ Jan/ 07 Nuber of Issuance Total

16 3-5 Number of Participants 50 Number of Institutions May/ 07 June/07 July/07 Aug/07 Sep/07 Oct/07 Nov/07 Dec/07 Month Total

17 3-6 Future Plan Analyze every customized local operation, and model typical cases Analyze a relation between the models and various characteristics of institutions Improve the delegation architecture of RA operations through the participant s experience Consider a business operation plan over FY

18 4.U Start-Pack 18

19 4-1 U Start-Pack Objectives The knowledge in setting up and operating system is necessary to consider campus certificate authority. The experiences of constructing and operating certificate authority will help to consider, construct and operate adequate authentication infrastructure under each universities situations. Concepts Develop and provide Start-Pack that enables universities easily to construct and start Certificate Authority By restricting to one application only, make it possible to construct and start to operate very easily and in a short time. system should be not only for experience but also for real operation. 19

20 4-2 To create Start-Pack Application configured to issue certificates for inter-university wireless LAN authentication To support only IE802.1X EAP-TLS that uses both server certificate and client certificate system NAREGI- that is developed by NAREGI(National Research Grid Initiative) project and has been operated in several sites NAREGI- is open source software and it enables to operate certificate authority as same level as commercial system Including additional features of enhanced certificate issuing procedure developed in U project Wireless LAN system Use open software: FreeRadius and OpenLDAP 20

21 4-3 IE802.1X EAP-TLS EAP (Extensible Authentication Protocol) Client Authentication Server Authentication Security Level Operation Cost EAP-TLS Certificate Certificate High High EAP-TTLS ID/Password Certificate Mid. Mid. EAP-PEAP ID/Password Certificate Mid. Mid. LEAP ID/Password ID/Password Low Low EAP-MD5 ID/Password --- Low Low 21

22 4-4 Contents Scripts Installation script; For easy setting Template: Profile template for wireless LAN client certificate and server certificate Documents(Japanese Only) Start-Up Guide: How to install system, how to use scripts to configure settings in order to use for wireless LAN authentication Operation Guide: How to operate Certificate Authority for wireless LAN authentication Users Guide: How to obtain certificate, and set up the certificate to use wireless LAN System NAREGI- Ver2.2 ( download from NAREGI site) 22

23 08/ How to use Start-Pack Systems Start-Pack Scripts, Documents University Easy Setup! RA RA Administrator Start to operate quickly! Application Server (web) Administrator Authority Delegation TARO SUZUKI Smart Card Apply Authorize RA Operator Identify User Admin Server (web) Issue Request Issue Certificate LDAP RADIUS AP 23

24 4-6 Current Status Download: Available from the end of Jan On U Initiative Page (Japanese Only) Support: On U Initiative Start-Pack site 24

25 5. Shibboleth using Authentication 25

26 5-1 Shibboleth using authentication Objectives; To design architecture for Japanese Academic Federation that is suitable for Japanese institutions base on U infrastructure Challenges; To develop necessary functions to connect Shibboleth and U infrastructure To evaluate usability and operability of Shib- architecture 26

27 5-2 Shibboleth on U Architecture Sign, Encrypt. Open Domain サーハ サーハ Srv. NII Pub サーハ サーハ Srv. Other Pub Campus A Univ. 学内用学内用 Auth N U IdP U SP Auth Z U IdP U SP Auth N Auth, Sign, Encrypt. B Univ. 学内用学内用 NAREGI A Univ. NAREGI B Univ. NAREGI Grid Computing Server, Super Computer Student, Faculty Server, Super Computer Student, Faculty 27

28 5-2 Shibboleth on U Architecture Sign, Encrypt. Open Domain サーハ サーハ Srv. NII Pub Japanese Academic Federation サーハ サーハ Srv. Other Pub Campus A Univ. 学内用学内用 Auth N U IdP U SP Auth Z U IdP U SP Auth N Auth, Sign, Encrypt. B Univ. 学内用学内用 NAREGI A Univ. NAREGI B Univ. NAREGI Grid Computing Server, Super Computer Student, Faculty Server, Super Computer Student, Faculty 28

29 5-3 Shib- connecting function IdP (University) Shib- DS (Discovery Service) SP (e-journal, e-learning,,,) (5) Authentication (4) Redirect (3) Cert (Subject DN) (2) Redirect (1) Access USER 29

30 5-4 Testbed using Shib- Internet Univ. A Auto redirect Univ. B Auto redirect Issuance of Server Cert. IdP1 AuthN Campus Certificate IdP2 AuthN Campus Certificate SP Access DS + Shib- Open Domain User1 User2 Access Japanese Academic Federation Testbed 30

31 5-5 Future Plan Japanese Academic Federation Architecture design; Develop suitable architecture on U infrastructure ( three layers) taking institutions situations into consideration. Roadmap; FY2007: Develop Shib- and testbed FY2008 1H: Evaluate and develop architecture using testbed FY2008 2H: Small start with a few SP services 31