[plasma] Plasma Policy discovery via ABFAB

[Trevor Freeman <[e-mail]>]

Since there was some interest in policy discovery at the BoF, I have tried to illustrate how this might happen in Plasma with an AbFab infrastructure.

Since the full authentication and exchange of claims process is relatively "expensive" we did not want this exchange to happen for every message. We are proposing a model similar to Kerberos where the full authentication process results in a relatively long lived token  issued by the PDP STS; this long lived token is then used for subsequent transactions with the PDP STS. The roll token in our proposed model is therefore equivalent to a Kerberos TGT.

The subject has one or more roles registered with the PDP STS. Each roll has a set of polices which the subject is allowed to assert in email. The roll token lists all the policies that the roll can assert in that roll. A roll may optionally be associated with an email address if the roll has a separate mailbox to the subjects personal mailbox. A subject can have associations with multiple PDP STS's. The set of PDP STS's is a matter of local policy for the Plasma client.

When bootstrapping a plasma client it would first have to discover all the roll tokens for all the PDP STS's it has in local policy. It starts by making a Get Tokens request to each PDP (line 1 in the slide) over HTTPS.

Then EAP would be initiated over the HTTPS tunnel where the subject would supply their realm name (line 2)

The PDP STS would then make a mutually authenticated radius\diameter connection to the realm IdP STS supplied by the subject (line 3)

The subject would then authenticate to the IdP STS via an EAP tunnel between subject and IdP STS (line 4). If we were using EAP Fast the client would build a TLS tunnel over the HTTPS session to the IdP STS.

The PDP STS then sends a list of claims required to the IdP STS(line 5).

The IdP STS then returns the SAML token with the requested claims to the PDP STS (line 6).

The PDP STS then returns one or more roll tokens to the subject (Line 7).

The Plasma client would now be bootstrapped ready to send protected email.

Dr Trevor Freeman  Senior Security Strategist
End to End Trust Team<http://www.microsoft.com/mscorp/twc/endtoendtrust/default.mspx>
Microsoft Trustworthy Computing <http://www.microsoft.com/mscorp/twc/default.mspx>