Re: [Ace] Offline operation of Resource Server

Hi Ludwig:

El 15/07/2014, a las 07:47, Ludwig Seitz <ludwig@sics.se> escribió:

> On 07/14/2014 10:12 PM, Michael Richardson wrote:
>> 
>> Hannes Tschofenig <hannes.tschofenig@gmx.net> wrote:
>>     > To re-use the Kerberos language, the client gets the TGT. The real-time
>>     > interaction I was talking about relates to the interaction between the
>>     > resource server and the authorization server.
>> 
>> During enrollment, the Authorization Server gets a TGT on the *resource* server.
>> Given that, it can now issue new tickets to clients that come along that wish
>> to access the resource.  The client, during enrollment, asks the (possibly
>> federated list of) authorization servers for a resource ticket.
>> (This is why part of network join needs to be in scope for ACE)
>> 
>> All of the above has to occur online.
>> 
>> Once the client has the resource ticket, the resource server can validate it offline.
>> 
> 
> 
> >>Ludwig, could you please explain this offline requirement a bit more?
> 
> It means exactly the kind of offline validation that Michael described above.

[Rafa] I had the following in mind:

The RS is deployed under the domain of a "controller". To ensure the controller and the RS are authenticated are authorized they use EAP/AAA (so we avoid a rogue controller or a rogue RS). EAP peer is the RS, the EAP authenticator is the "controller" and EAP server is placed on the AS. We can also think (to simplify) that controller/AS is the same entity for now.

> 
> 1. You need some initial enrollment of AS <-> RS (that could be online or offline & manual such as by reading off some QR code with the RSs initial key material and feeding that to the AS).

Then, one option is to do online enrollment with EAP/AAA.  

> 
> 2. Then you need some online authorization decision step between C and AS.

I also think we can use online authorization decision based on EAP/AAA.

> 
> 3. Then (possibly later) there is some interaction between C and RS, that could be offline. Here RS needs to be able to do offline validation of the authorization decision from step 2.

That is possible if during the EAP/AAA interactions there is a bootstrapping of some short term credential (e.g. Kerberos tickets). For example, if we talk in Kerberos terminology, the "controller" could be the KDC. Then C could obtain a TGT first and then a ST to access the RS. As long as the C has the ST, it can access the RS and the RS can do the validation offline.

So, in summary, there could be an online enrollment and online authorization decision based on EAP/AAA that allows to bootstrap "something" that enables RS and C to have an offline interaction during a period of time (e.g. ticket lifetime).

My 0.02 cents.

> 
> 
> /Ludwig
> 
> -- 
> Ludwig Seitz, PhD
> SICS Swedish ICT AB
> Ideon Science Park
> Building Beta 2
> Scheelevägen 17
> SE-223 70 Lund
> 
> Phone +46(0)70-349 92 51
> http://www.sics.se
> 
> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace

-------------------------------------------------------
Rafael Marin Lopez, PhD
Dept. Information and Communications Engineering (DIIC)
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: +34868888501 Fax: +34868884151 e-mail: rafa@um.es
-------------------------------------------------------