Standards in the Cloud: a transatlantic mindshare. OASIS standards supporting trust in the cloud. Gershon Janssen. 29 th September 2011 Valbonne

Transkript

1 Standards in the Cloud: a transatlantic mindshare OASIS standards supporting trust in the cloud 29 th September 2011 Valbonne Gershon Janssen

2 Overview Introduction About OASIS OASIS Standards as Building Blocks 2

3 OASIS Overview OASIS is a member consortium dedicated to building e-business systems interoperability specifications Main focus is on applications of structured information standards (e.g. XML, SGML) but increasing focus on adoption of standards Members of OASIS are providers, users and specialists of standardsbased technologies Include organisations, individuals, industry groups and governments More than 600 member organisations, 1000s individuals, 100+ countries Global, Not-for-profit, Open, Independent Successful through industry and government wide collaboration MOUs and Liaison Agreements with all major standardisation bodies, e.g. ETSI, ISO, UN/CEFACT, CEN, W3C. 3

4 OASIS working arrangements Technical Committees are set-up by OASIS members to deliver a specific piece of work and then, usually, close down. Examples of standards produces by Technical Committees are ebxml, UBL, SAML, WS-Security, WS-ReliableMessaging, BPEL. Member Sections are created when a collection of OASIS Members recognize a particular need or common goal and are willing to commit to work on that need over an extended period. Examples of Member Sections are IDtrust MS and e-government MS 4

5 OASIS Standards as Building Blocks XACML KMIP extensible Access Control Markup Language Key Management Interoperability Protocol IDCloud Identity in the Cloud ORMS Open Reputation Management Systems PMRM Privacy Management Reference Model EIC-TEM Electronic Identity Credential Trust Elevation Methods 5

6 XACML - extensible Access Control Markup Language What is it? XML language for access control Extremely powerful evaluation logic Ability to use any available information Superset of Permissions, ACLs, RBAC, etc Scales from PDA to Internet Federated policy administration Cloud features: Powerful language features: capture complex business relationships Federated Administration: combining algorithms resolve conflicts Administrative Policies: policies managed by providers, customers, end users Domain-specific Profiles: Healthcare, Intellectual property, Privacy 6

7 KMIP - Key Management Interoperability Protocol What is it? Single Protocol Supporting Enterprise Cryptographic Environments Enables key lifecycle management: legacy and new cryptographicenabled applications, supporting symmetric keys, asymmetric keys, digital certificates, and other "shared secrets KMIP defines the protocol for cryptographic client and keymanagement server communication Cloud features: Expandable to Cloud Environments Infrastructure Entity Identification in Cloud Infrastructures: e.g. utility company with their distributed commercial, residential and industrial meters. 7

8 IDCloud Identity in the Cloud What is it? Cloud Identity Management Objectives: identify use cases, define interoperability profiles, gap analysis Secondary objectives: create a glossary on Cloud Identity, do not reinvent the wheel, strong liaison relationships Cloud features: Structured, categorized use cases of identity in the cloud Profiles based on use and combinations of existing standards, protocols and formats High ranked use cases: Managing identities at all levels in the cloud, Federated SSO, Enterprise to Cloud SSO, Auditing, Multi-factor Authentication for privileged Users Access 8

9 ORMS Open Reputation Management Systems What is it? Reputation mechanisms for electronics based communities Reputation reflects the opinions about an entity, from others and is one of the factors upon which trust can be based through the use of verifiable claims. Reputation changes with time and is used within a context. Trust and reputation are related to a context. Focus on details about how it is obtained, calculated, in what context - Interoperability and expression (e.g., score normalization, distribution notation etc.) and protocol Cloud features: Use of reputation systems for various applications such as validating the trustworthiness of entities within a cloud context 9

10 PMRM Privacy Management Reference Model What is it? A formal reference model for data privacy Define a set of operationally-focused privacy management services Define a formal methodology for applying the model and expressing use cases One ore more use cases utilizing PMRM Define profiles of the PMRM applied to selected environments such as Cloud Computing, Health and SmartGrid Cloud features: Methodology for analyzing the uses of personal information and applicable rule-sets within a use case context encompassing cloudbased environments. 10

11 EIC-TEM Electronic Identity Credential Trust Elevation Methods What is it? Identify methods currently used to authenticate electronic identities by online relying parties, service providers, and theoretical models Propose and describe a set of standardized protocols that service providers may use to elevate the trust in an electronic identity credential presented to them for authentication At levels of identity assurance or risk mitigation, representing increasing degrees of authentication certainty. 11

12 Summary OASIS standards development contribute to security, privacy and trust in cloud computing environments 12

13 OASIS website: IDtrust Member Section: Gershon Janssen 13