Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
367
In addition to that, claims standardization will also be required, including
definitions of claims. It is because the semantic relationship between domains needs
to be agreed, so claims mapping and processing rules can be effectively implemented
on the claim receiving side for authorization decisions.
This process of “Identity Mapping” is probably the most complex and expensive
aspect of federation. It is recommended to development a Federation Profile
that can be used by all partners in the federation, which specifies the metadata,
attribute usage, and constraints on protocol option use as required [8]. Although
NATO has started to develop “Service Interface Profiles” (SIP) for service interaction,
the federation profile has not yet been issued. An analysis of the federation
profile specified by the Transglobal Secure Collaboration Program (TSCP) [11] for
adoption in NATO is a recommended approach.
1) Management of claims:
In order to successfully use claims for the identity of the actor within the system,
and to ensure that they are unambiguous, each attribute has a unique identifier
assigned to it, in a form of URI. These URIs must therefore be managed, to
ensure that duplicate identifiers are not assigned for attributes that are not identical.
Many common attributes, such as email address, CommonName, and Surname
have already been defined by xmlsoap.org, an industry body that proposed many
of the original SOAP and Web Services (WS)-* standards, and these are widely
understood by Security Token Service (STS) implementations from many different
suppliers. However, in case of attributes specific for a classified environment,
such as Clearance, URIs must be registered with the appropriate body, e.g. NATO’s
Naming and Addressing Registration Authority.
2) Distribution of claims:
Claims contain information about the entity which is to be shared with federation
partners, and some consideration needs to be given to which attributes
can be distributed outside NATO. Certain claims may be too sensitive to share with
partners, and in some cases privacy issues must be respected to prevent personal
information being distributed beyond organizational boundaries. One way to
protect this information in transit is to encrypt the security tokens, and STSs must
therefore be able to handle encrypted tokens, but the scope of individual claims also
needs to be specified. It is proposed, for example, that a user’s group membership
at the domain level is not distributed outside NATO.
In this context it is worth noting that the control of personal data and the protection
of privacy are better guaranteed through the use of assertions rather than allowing
shared access to identity information between domains.