Issues in Identity Management for Delay Tolerant Networks


Revision History
02.06.04 Initial Revision, mh
02.12.04 Update following DTN group meetings, mh


I. Issues

   - How do you secure an identity?
     
     Identities are 

   - How do you verify an identity?
   - Within a region how do you validate that a device should have
     access to resources, given that it has already obtained the
     relevant token?
   - Token expiration? Token renewal? Does expiration even make sense in
     a disconnected context? Perhaps it should be governed on a region by
     region basis.
   - Is there a concept of tranference between regions?
   - Can we use locality and identity to determine which network a 
     particular device can use to obtain credentials? (ie, based on 
     SSID location map, choose number to dial in order to obtain 
     access to a channel for which you have authority to access)


II. Identity Management Solutions

    A. Ensim® Unify and Ensim Server Manager
       [from Keshav]  
       - Use Active Directory to store identities
       - Use Unify to manage them
       - Mobile users get identity from Unify, and then can assert
         rights to resources without having to log in every time

       Questions:
       - How will this operate in the context of mobile stations?
       - How will this operate in a disconnected context, given that
         mobile users may never be directly connected to the datacenter?

       Active Directory and Linux
          Since Unify is a Windows based management system, with the option? of
	  managing Linux servers as well, then the Linux servers would have to 
	  talk to the Windows server - and authenticate against it. 

	  http://www.securityfocus.com/infocus/1563
	  
	  Major Issues
	  - Non-supported by MS
	  - Possibly not multi-platform friendly
	  - AD vs LDAP
	  - AD4Unix needs to be installed on datacenter and seems to
	    be potentially very finicky.

	General Assessment
	  No clear relationship between Unify and DTN, platform issues, 
	  however, some ideas/problems solved may be relevant to DTN. 
	  Basic utility is the idea of using Active Directory/LDAP for 
	  authentication and authorization.
  
    B. Authd (Brent)
       - software package for obtaining and verifying user credentials
         based on RSA
       - cluster-wide RSA public/private key pair allows clients 
         to verify user identity from anywhere
    
    C. LDAP
       - supports SSL, Kerberos, cleartext passwords, and SASL
       - OpenLDAP (SleepyCat backend) http://www.openldap.org
       - client/server interaction
         - client establishes session (BIND)
	 - client performs ldap operation (supported list)
	 - client ends session (UNBIND)
	 - session can be ABANDONed
       - supports ACLs to control access rights
      
      http://quark.humbug.org.au/publications/system_auth/sage-au/system_auth.html      

      Actualization Items
       - write an LDAP/PAM/NSS DTN proxy for authentication
          - encapsulate bind and operation(s) into single request
	  - each query/update must be authenticated
	  - asynchronize communication
	  - supports whatever DTN security infrastructure we come up with
       - determine how acls are communicated
       - determine token issuing