TAS3 Deliverable D1.1: State of the Art Accompanying Letter to The
Total Page:16
File Type:pdf, Size:1020Kb
TAS 3 Deliverable D1.1: State of the Art Accompanying Letter to the Reviewers At the TAS 3 review on February 26 th , 2009, the project reviewers indicated that deliverable D1.1 State of the Art was provisionally accepted. The TAS 3 Consortium has addressed the reviewers’ comments as follows. In addition to the recommended updates, more content has been provided. A new specific chapter (5) has been created concerning Threat Analysis, additional information on Trust KPI as well as large update in Identity Management. a) Ch. 4: Include at least the Common some SAP product only, so this comment Criteria (ISO/IEC 15408) as a real as been removed because it’s not relevant methodology for security requirements. in this context. CA services and scoring (Microsoft SDLM is another one.) model have been added. Several threat methodologies have been included within a new dedicated chapter f) Ch. 10: Add definitions of key terms used (Chap 5). here. Justify why the focus is laid on IFG. Add Kim Camerons laws of identity. b) Ch.6 Include CardSpace, Information Whereas KC's 7 laws are fully expounded Card Forum. in Ch 11, WP7, additional information Information exists in Identity have been added in Legal chapter (chap Management (chap 11). 10). Updated accordingly. g) Ch. 11: (minor remarks: Change c) Ch. 7: Are there any industry specific 1,024bits to 2,048bits. Consider spending blueprints of enterprise architecture one sentence about modern cryptography models relevant for TAS3? like certificateless PKI, identitybased Updated accordingly. cryptography and groupbased cryptography. Mention the possibility of a d) Ch. 8: Reconsider the claims made smart card being an IdP.) about BestCrypt. Add reference for Updated accordingly. Trustbuilder and Protune. Add European Citizen Card (ECC). h) Ch.12: Check the end of the chapter Updated accordingly. (ends abrupt). Updated accordingly. e) Ch. 9: Explain the link of SAP SSO capabilities to trust policies. Add web of i) Ch.13: Add the EU government project trust models (like PGP), certification STORK and IDABC. authority services, scoring models (as used Added accordingly. by eBay) and their (ir) relevance to TAS3 For SAP SSO/Trust: in fact the real j) Ch.14: Complete 13.3.4 Standards and relation is that a user is going to logon add some elaboration. Justify the using SSO to use the reputation system for exclusion of health insurances. a ranking of providers. This is true for Updated accordingly. The WP01 Team SEVENTH FRAMEWORK PROGRAMME Challenge 1 Information and Communication Technologies Trusted Architecture for Securely Shared Services D1.1 State Of The Art 2/140 Table of Contents Table of Contents _____________________________________________________ 2 1 Contributors _____________________________________________________ 6 2 TAS3 Overall Presentation __________________________________________ 6 2.1 Issue _____________________________________________________________ 6 2.2 Solution __________________________________________________________ 7 2.3 Application Domains _______________________________________________ 7 2.4 Project Organization________________________________________________ 8 2.5 The TAS3 Consortium ______________________________________________ 8 2.6 Architecture _______________________________________________________ 8 2.7 Application in the Domains __________________________________________ 9 2.8 Validation_________________________________________________________ 9 3 State of the Art structure __________________________________________ 10 4 Methods for Requirements _________________________________________ 11 4.1 Introduction ______________________________________________________ 11 4.2 Problem statement ________________________________________________ 11 4.3 Overview of existing solutions _______________________________________ 11 4.3.1 Standards and extensions _________________________________________________ 11 4.3.2 Research solutions ______________________________________________________ 12 4.3.3 Commercial solutions ____________________________________________________ 15 4.4 In-situ perspective _________________________________________________ 15 4.5 Trends & Future development_______________________________________ 16 4.6 Project based Gap Analysis with potential enhancement _________________ 16 4.7 Stakeholders _____________________________________________________ 16 5 Methods for Threat Analysis _______________________________________ 17 5.1 Introduction ______________________________________________________ 17 1.1 Problem statement ________________________________________________ 17 5.2 Overview of existing solutions _______________________________________ 17 1.1 In-situ perspective _________________________________________________ 20 6 Framework, Architecture and Semantics ______________________________ 21 6.1 Introduction ______________________________________________________ 21 6.2 Problem statement ________________________________________________ 21 6.3 Overview of existing solutions _______________________________________ 21 6.3.1 Standards and extensions _________________________________________________ 21 6.3.2 Research solutions ______________________________________________________ 23 6.4 Trends & Future development_______________________________________ 25 6.5 Project based Gap Analysis with potential enhancement _________________ 25 FP7-ICT_2007-1 May 27, 2009 - TAS³ IP 3/140 6.6 Stakeholders _____________________________________________________ 27 7 Adaptable Secure Business Processes ________________________________ 28 7.1 Introduction ______________________________________________________ 28 7.2 Problem statement ________________________________________________ 28 7.3 Overview of existing solutions _______________________________________ 28 7.3.1 Standards and extensions _________________________________________________ 28 7.3.2 Research solutions ______________________________________________________ 30 7.3.3 Commercial solutions ____________________________________________________ 31 7.4 In-situ perspective _________________________________________________ 31 7.5 Policies __________________________________________________________ 32 7.6 Trends & Future development_______________________________________ 32 7.7 Project based Gap Analysis with potential enhancement _________________ 32 7.8 Stakeholders _____________________________________________________ 32 8 Information Protection ____________________________________________ 34 8.1 Introduction ______________________________________________________ 34 8.2 Problem statement ________________________________________________ 34 8.3 Overview of existing solutions _______________________________________ 34 8.3.1 Standards and extensions _________________________________________________ 35 8.4 Trends & Future development_______________________________________ 39 8.5 Project based Gap Analysis with potential enhancement _________________ 39 8.6 Stakeholders _____________________________________________________ 39 9 Trust Policy Management __________________________________________ 40 9.1 Introduction ______________________________________________________ 40 9.2 Problem statement ________________________________________________ 40 9.3 Overview of existing solutions _______________________________________ 41 9.3.1 Research solutions ______________________________________________________ 41 9.3.2 Commercial solutions ____________________________________________________ 42 9.4 Trends & Future development_______________________________________ 42 9.5 Project based Gap Analysis with potential enhancement _________________ 43 10 Legal, Privacy and Ethics _________________________________________ 44 10.1 Introduction ______________________________________________________ 44 10.2 Problem statement ________________________________________________ 44 10.3 Overview of existing solutions _______________________________________ 44 10.3.1 Standards and extensions _________________________________________________ 44 10.3.2 Research solutions ______________________________________________________ 51 10.3.3 Commercial solutions ____________________________________________________ 51 10.4 In-situ perspective _________________________________________________ 51 10.5 Policies __________________________________________________________ 52 10.6 Trends & Future development_______________________________________ 52 10.7 Project based Gap Analysis with potential enhancement _________________ 52 FP7-ICT_2007-1 May 27, 2009 - TAS³ IP 4/140 10.8 Stakeholders _____________________________________________________ 53 11 Identity Management ___________________________________________ 54 11.1 Introduction ______________________________________________________ 54 11.2 Problem statement ________________________________________________ 54 11.3 Overview of existing solutions _______________________________________ 54 11.3.1 Identity Management Principals and Definitions ______________________________ 54 11.3.2 User Centric Identity Management _________________________________________ 63 11.3.3 Existing Technologies and protocols for Federated Access to Resources ___________ 66 11.3.4 Attribute Aggregation ____________________________________________________ 72 11.3.5 Research solutions ______________________________________________________ 85 11.3.6 Commercial solutions ____________________________________________________ 85 11.4 Policies __________________________________________________________ 86 11.5 Trends & Future development_______________________________________