Re: [Ace] Offline operation of Resource Server

[Ludwig Seitz <[e-mail]>]

On 07/14/2014 10:12 PM, Michael Richardson wrote:
>
> Hannes Tschofenig <[e-mail]> wrote:
>      > To re-use the Kerberos language, the client gets the TGT. The real-time
>      > interaction I was talking about relates to the interaction between the
>      > resource server and the authorization server.
>
> During enrollment, the Authorization Server gets a TGT on the *resource* server.
> Given that, it can now issue new tickets to clients that come along that wish
> to access the resource.  The client, during enrollment, asks the (possibly
> federated list of) authorization servers for a resource ticket.
> (This is why part of network join needs to be in scope for ACE)
>
> All of the above has to occur online.
>
> Once the client has the resource ticket, the resource server can validate it offline.
>


 >>Ludwig, could you please explain this offline requirement a bit more?

It means exactly the kind of offline validation that Michael described 
above.

1. You need some initial enrollment of AS <-> RS (that could be online 
or offline & manual such as by reading off some QR code with the RSs 
initial key material and feeding that to the AS).

2. Then you need some online authorization decision step between C and AS.

3. Then (possibly later) there is some interaction between C and RS, 
that could be offline. Here RS needs to be able to do offline validation 
of the authorization decision from step 2.


/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone [phone]
http://www.sics.se