COMPSAC2014.pdf

Transcript

1. Centralized Online Sign-up and Client Certificate Issuing System for eduroam July 21, 2014 8th IEEE International Workshop on Middleware Architecture in the Internet (MidArch 2014) Tomo Niizuma , Hideaki Goto (Tohoku University , Japan) 1
2. Contents • Introduction • Centralized Client Certificate Issuing System • Online Sign-up System • Conclusion 2
3. Backgrounds - eduroam • Secure user authentication based on IEEE 802.1X • Enables to provide a visiting user with wireless network access with his/her account issued by home institution (Wireless LAN roaming) • About 70 countries (areas) all over the world and 
 71 institutions in Japan have joined eduroam 
 ( as of July, 2014 ) 3
4. How does eduroam authenticate users ? • ID/Password(EAP-TTLS, PEAP) is mainly used in eduroam authentication • The demand for authentication by client certificate is becoming high ‣ EAP-TLS in IEEE 802.1X is high secure ‣ The user is freed from re-typing ID/Password when the saved credential is accidentally lost 
 ( while using ID/Password , you have to do it ) ‣ Able to be support Disruption-tolerant, large-scale WLAN roaming architecture (2013, Goto) 4
5. Challenging part of adoption EAP-TLS in eduroam • Operation costs (e.g. money, labor) are high ‣ Distribution of public key and CRL , Revocation of certificates • Introducing CA (Certificate Authority) at each institution is not practical 5 ➡ Centralized certificate issuing system ‣ Delegate Authentication System (DEAS) is already deployed (2008) ‣ 24 institutions out of 71 eduroam members use DEAS in Japan ✓ Adding certificate issuing function to DEAS is an effective solution
6. Delegate Authentication System (DEAS, 2008 ~) • The high deployment and operation costs of RADIUS servers are the hurdles for institution to join eduroam • DEAS works as an alternative RADIUS IdP for each institution ‣ Make it more easily for many institutions to join eduroam - Manually distributing eduroam accounts to end-users is a heavy burden for the institutional administrators 6 DEAS au jp A Top level RADIUS proxy B C AP AP AP D E F Institutional admin. End users Distributing accounts manually National RADIUS proxy Institutional RADIUS IdP NO institutional RADIUS IdP
7. Two Purposes of this work • Adding certificate issuing function to 
 conventional DEAS ‣ Reduce the highly operational costs of certificate-based authentication in Wireless LAN Roaming • Deploying Online Sign-up System (for end users) 
 in DEAS ‣ Reduce the heavy burden of manual ID distribution for institutional administrators in DEAS ‣ Email-based verification (explain later) 7
8. Contents • Introduction • Centralized Client Certificate Issuing System • Online Sign-up System • Conclusion 8
9. Requirements in Client Certificate Issuing System • End users can get their certificate directly online ‣ Reduce the costs of certificate distribution by institutional administrators ‣ Prevent the certificate from falling into third person’s hand • DEAS creates the users’ secret key, public key and CSR (Certificate Signing Request) to create their certificates ‣ It’s complicated for users to create them by themselves • The permission of getting certificate is decided when each account is created
 (Institutional administrators can approve or deny) ‣ NOT All eduroam users need their certificates 9
10. The architecture of Centralized Certificate Issuing System 10 • Adding a web user interface ‣ The users can get their certificate directly on the web • Institutional administrators can revoke the users’ certificate
 (If some incident happens or the certificate is stolen) %&"4
    8FC
    TFSWFS
    3"%*64
    TFSWFS
    )PNF
    *OTUJUVUJPO
    *OTUJUVUJPOBM
    "ENJOJTUSBUPS
    6TFS
    1BTT
    *%
    •  (FU
    
    DFSUJpDBUF
    •  3FWPLF
    DFSUJpDBUF
    •  *%
    SFRVFTU
    •  3FWPLF
    
    
    
    DFSUJpDBUFT
    
    OFX
    GFBUVSF
    8FC6*
    8FC6*
    /FX
    GFBUVSFT
    
11. The sequence of installing certificate to user’s terminal 11 user DEAS (1)Log in to web using eduroam ID/Password (ID is eduroam ID without realm ) (2)Show user passphrase input form (3)Input passphrase for installing certificate (4) Generate client certificate (5)Download certificate from the web (6) Install certificate into user’s terminal using passphrase inputted at (3)
12. If your eduroam ID is yxurlsdh@hogeinst.eduroam.jp • Log in to user Web using eduroam ID without realm and eduroam password (Basic authentication via https) ‣ Mitigate the risk of phishing eduroam ID/Password ‣ If the whole eduroam ID is inputted constantly at web-based interface , it increases phishing risk 12
13. If your eduroam ID is yxurlsdh@hogeinst.eduroam.jp • User menu 13
14. If your eduroam ID is yxurlsdh@hogeinst.eduroam.jp • Input Passphrase ‣ Use this passphrase to install the certificate 14
15. If your eduroam ID is yxurlsdh@hogeinst.eduroam.jp 15
16. Contents • Introduction • Centralized Client Certificate Issuing System • Online Sign-up System • Conclusion 16
17. Features for Secure Online Sign-up System • Email-based identity verification ‣ In most institutions/universities, the members have Email address linked with the identity • Limit the last part of the domain in the Email address ‣ To prevent outsiders from signing-up ex) In case of Tohoku University, 
 the last part of the address is limited to tohoku.ac.jp
 niizuma@sc.isc.tohoku.ac.jp => OK ! • The sign-up request is manually verified by the institutional administrator (approval/reject) ‣ To prevent malicious users from signing-up
 (e.g. A user who has abused eduroam in the past) 17
18. Why do we adopt Email-based verification ? • 16 institutions out of 24 DEAS members are NOT members of GakuNin ‣ The institutions who have joined the federation is not too many ➡That’s why we adopt E-mail-based verification (SAML-based sign-up system could be more secure and useful) 18
19. Online Sign-up System 19 DEAS IdP service Institution A Institution B Institution C Online sign-up extension user (inst B) ɾ ɾ ɾ
    (1) Sign-up on the web (2) Verification request email (3)Verification on the web (6) ID notification email (4) Request notification by email (5) Approval or reject via web • Email-based verification • Limit the last part of the domain in the Email address • Manual approval/reject of each sign-up by institutional administrator
20. Example • Select institution 20
21. Example • Registration form 21 varies by the insitutition
22. Example 22 • E-mail notification after interim registration
23. Examples 23 • Temporary password verification
24. Examples 24 • If you success in the verification, 
 you can know the eduroam ID/Password.
25. Examples 25 • If your sign-up is approved by the institutional administrator 
 DEAS sends a notification e-mail to you
26. Contents • Introduction • Centralized Client Certificate Issuing System • Online Sign-up System • Conclusion 26
27. Conclusion • Centalized certificate issuing system ‣ Low operational costs of authentication system using EAP-TLS ‣ Be able to apply it to Disruption-tolerant, large-scale WLAN roaming architecture. • Online Sign-up System ‣ Reduce labor for ID distribution at each institution in DEAS • Future work ‣ Sign-up System using Shibboleth ‣ New DEAS operation test in Japan (Soon) 27