[Hipsec-rg] Hierarchical HITs

[oleg.ponomarev at hiit.fi (Oleg Ponomarev)]

Greetings!

>> I think we should distinguish authorization (deciding whether to grant
>> access) and authentication (verifying identity).

> I think Sheng Jiang just indicates that the authentication results 
> should be able to be used by authorisation systems. In any un-trivial 
> systems, access control (AC) is performed by authorisation mechanisms, 
> and authentication results do not mean a lot if they cannot be used for 
> authorisation. HHITs can provide information about administration 
> domains, which may be valuable for authorisation systems to make AC 
> assertions.

Could you please elaborate why HIP-authentication cannot be used for 
authorization?

1) HIP is used to verify the identity of the host (that the host possesses 
the private key indeed)

2) The verified identity is used for the authorization purposes: simply 
check that it is in the list of authorized identities or request access 
certificate issued to that identity by the trusted CA or whatever.


The fingerprints (and other biometrics) is "self-generated" and does not 
have any hierarchy, but can be used for authorization very well.

-- 
Regards, Oleg.