ARe3NA Crabbé et al. (2014) AAA for Data and Services (D1.1.2 & D1.2.2): Analysing Standards &Technologies for AAA ISA Action 1.17: A Reusable INSPIRE Reference Platform (ARE3NA) Authentication, Authorization & Accounting for Data and Services in EU Public Administrations D1.1.2 & D1.2.2– Analysing standards and technologies for AAA Ann Crabbé Danny Vandenbroucke Andreas Matheus Dirk Frigne Frank Maes Reijer Copier 0 ARe3NA Crabbé et al. (2014) AAA for Data and Services (D1.1.2 & D1.2.2): Analysing Standards &Technologies for AAA This publication is a Deliverable of Action 1.17 of the Interoperability Solutions for European Public Admin- istrations (ISA) Programme of the European Union, A Reusable INSPIRE Reference Platform (ARE3NA), managed by the Joint Research Centre, the European Commission’s in-house science service. Disclaimer The scientific output expressed does not imply a policy position of the European Commission. Neither the European Commission nor any person acting on behalf of the Commission is responsible for the use which might be made of this publication. Copyright notice © European Union, 2014. Reuse is authorised, provided the source is acknowledged. The reuse policy of the European Commission is implemented by the Decision on the reuse of Commission documents of 12 December 2011. Bibliographic Information: Ann Crabbé, Danny Vandenbroucke, Andreas Matheus, Dirk Frigne, Frank Maes and Reijer Copier Authenti- cation, Authorization and Accounting for Data and Services in EU Public Administrations: D1.1.2 & D1.2.2 – Analysing standards and technologies for AAA. European Commission; 2014. JRC92555 1 ARe3NA Crabbé et al. (2014) AAA for Data and Services (D1.1.2 & D1.2.2): Analysing Standards &Technologies for AAA Contents 1. INTRODUCTION ........................................................................................................................................... 7 2. INSPIRE AND SECURE ACCESS MECHANISMS ................................................................................................. 7 2.1 Limiting public access ...................................................................................................................... 7 2.2 AAA in the ISA Programme ............................................................................................................. 9 3. AAA: AUTHENTICATION, AUTHORIZATION AND ACCOUNTING ...................................................................... 11 3.1 Access Management Federation [2] [3] ....................................................................................... 11 3.2 Authentication and Authorization Standards .............................................................................. 14 3.2.1 Secure communication ............................................................................................................ 14 3.2.2 Authentication ......................................................................................................................... 14 3.2.3 Authorization ........................................................................................................................... 16 3.2.4 Other standards ....................................................................................................................... 17 3.3 Authentication and Authorization Technologies ........................................................................ 18 3.3.1 Tools for implementing SAML and other AAA standards ........................................................ 18 3.3.2 Shibboleth ................................................................................................................................ 33 4. ACCESS MANAGEMENT FEDERATION INFRASTRUCTURE: HOW IT WORKS ...................................................... 34 4.1 Secure access to resources .............................................................................................................. 34 4.2 Organisational issues ....................................................................................................................... 35 5. ISA PROGRAMME: INTEROPERABILITY SOLUTIONS FOR EUROPEAN PUBLIC ADMINISTRATIONS ...................... 39 5.1 ISA action 1.4: EU-wide interoperability of electronic identities (ECAS-STORK integration) [12]... 39 5.2 ISA action 1.18: Federated Authorization Across European Public Administrations [14] ............... 39 6. CONCLUSIONS ........................................................................................................................................... 42 7 REFERENCES ............................................................................................................................................. 43 8 Annex 1: Security Standards Overview ................................................................................................... 44 8.1 Standards for securing Communication ................................................................................... 44 8.1.1 Standards associated with the Network Layer ........................................................................ 44 8.1.2 Standards associated with the Binding Layer .......................................................................... 45 8.1.3 Standards associated to Message Security ............................................................................. 45 8.1.4 Standards associated to Message Content Security ............................................................... 46 8.2 Standards for Authentication .......................................................................................................... 47 8.3 Standards for Authorization (Attribute Based Access Control) ....................................................... 51 2 ARe3NA Crabbé et al. (2014) AAA for Data and Services (D1.1.2 & D1.2.2): Analysing Standards &Technologies for AAA 8.4 Standards for Licensing.................................................................................................................... 52 8.5 Standards for Web Services ............................................................................................................. 53 8.6 Draft Standards for Web Services ................................................................................................... 57 8.7 Standards for eBusiness .................................................................................................................. 59 8.8 ISO Standard for Common Criteria for Information Technology Security Evaluation (abbreviated as Common Criteria or CC) ............................................................................................................................... 61 8.9 Standards for Security Techniques .................................................................................................. 62 8.10 Standards for Open Systems Interconnection ................................................................................. 63 8.11 Other Literature ............................................................................................................................... 64 3 ARe3NA Crabbé et al. (2014) AAA for Data and Services (D1.1.2 & D1.2.2): Analysing Standards &Technologies for AAA 1 TABLE OF FIGURES Figure 1: The Three-Tier INSPIRE Architecture ................................................................................................................................. 9 Figure 2: Access Management Federation [2] ............................................................................................................................... 12 Figure 3: Schematic overview of AAA and related standards ......................................................................................................... 18 Figure 4: Schematic overview of the access management federation. .......................................................................................... 34 Figure 5: Example of secure access to a resource by a user (Max) ................................................................................................. 35 Table 1: Conditions under which public access to data and services can be limited (Directive 2007/2/EC Art.13) ......................... 8 Table 2: Comparison of different authentication standards (based on Chadwick, [13]) ................................................................ 15 Table 3: Comparison of different authorization standards ............................................................................................................ 17 Table 4: Tools for the implementation of security standards (adapted and updated from the Kantara Initiative, 2011) .............. 20 Table 5: number of data and service providers in INSPIRE ............................................................................................................. 37 Table 6: Issues addressed by STORK 2 as compared to STORK 1 .................................................................................................... 40 4 ARe3NA Crabbé et al. (2014) AAA for Data and Services (D1.1.2 & D1.2.2): Analysing Standards &Technologies for AAA 2 GLOSSARY AAA Authentication, Authorization and Accounting ARE3NA A Reusable INSPIRE Reference Platform AMF Access Management Federation BKG Bundesamt für Kartographie und Geodäsie CC Coordination Centre CIRCABC Communication and Information Resource Centre for Administrations, Businesses and Citizens DRM Digital Rights Management DSS Digital Signature Software ECAS European Citizen Action Service