LOA of Attributes: An Examination

1. LOA of Attributes: An Examination Peter Alterman, Ph.D. Senior Advisor for Strategic Initiatives National Institutes of Health

2. Fundamentals Attributes are consumed by relying party applications for AuthZ and/or provisioning; Attributes may be assigned by many issuers, including relying party apps, and these issuers are authoritative for them; It doesn’t look like there will be consensus on the form of the attributes any time soon;

3. Basic Principles The issuer of attributes is authoritative for the validity of those attributes; Any useful user credential is likely to include attributes from more than one issuer; Attributes may be stored or aggregated anywhere; Relying party applications are likely to be both consumers of attributes and issuer of attributes.

4. Existing Models X.500ish: local repositories hold attributes (assumes all attributes are issued locally) and some are exposed; Shibboleth: user proxy service holds attributes (punts the question of issuer/reliability) Silo-Land: each relying party application assigns attributes – usually roles and AuthZ – and stores them locally (since the app is issuing and storing them, they are authoritative for them)

5. Key Shortcomings of Existing Models Transaction protocols are technology-specific – requires intermediate functionality; Attribute exchange is pairwise today – will not scale – includes discovery and validation – see above; No trust infrastructure for attributes that is comparable to that for identity.

6. The Million Dollar Question In a federated world, how can a relying party application know it can trust an attribute issued by another entity?

7. Proposed Solutions Keep the siloed approach, where each application issues and manages attributes locally; Local Back-End Attribute Exchanges (BAE) store attributes and pointers to issuing entity data stores; Wait for Government to issue attribute policies comparable to identity policies; Select an industry entity (Internet Society, OASIS, ISO, etc.) to host the design, development and construction of a global attribute management infrastructure, such as an uber-BAE.

8. Why LOA of Attributes Is More Trouble Than It’s Worth Any separation of attribute validation from issuer introduces trust and security threats which rapidly degrade the utility of attributes; Proxied attribute validation requiring LOA also requires a common body of policy, an authoritative source for policy and a high assurance assessment infrastructure; Informal agreements don’t scale – reintroduces the pairwise model and there is no way to mediate among multiple pairwise models.

9. Attribute LOA Should Be Binary (but no solution is without its issues) Let the issuer validate attributes. Then the answer is either Y or N (yes, it’s like the X.509 model) Requires attributes to include a pointer to the issuer and would require the issuer to maintain a repository

10. Caboose Because of our experience and the general culture of our business, we are inclined to find elegant, complex solutions to issues. That should be avoided like the plague in this case. Contact info: peter.alterman@nih.gov