Military Communications and Information Technology: A Trusted ...

368 Military Communications and Information Technology...
3) Types of claims:
Two key classes of claims have been identified concerning entities within
the system:
• Organizational claims, described as “Custodial Identity” in [8], are issued by
the IdP of the entities, and represent their organizational role independent
of the applications to be accessed. This includes common attributes such
as nationality, clearance, email address, etc. A unique identifier should be also
included, for which a common format has to be agreed. NATO unique identifiers
will be generated by the NATO Enterprise Directory Service (NEDS),
when deployed in the operational environment (mid 2013);
• Application specific claims, described as “Contextual Identity” in [8], are
issued by the relying party STSs and contain application-specific attributes
to support authorization, and have little or no validity outside the scope
of the application or service being consumed. These attributes are most likely
to be retrieved from local attribute stores, such as directories or databases,
and contain data about the roles of the actor in the application.
In addition, Context claims describe the environment in which the entity is acting,
and may be used as further parameters for evaluating authorization decisions.
4) Modality of claims:
When categorizing the requirement to include a claim in a token, modality
values are proposed as follows:
• Mandatory – only the Unique Identifying Claim should be mandated;
• Recommended;
• Optional;
• Not Recommended;
• Forbidden.
5) Unique Identifying Claim:
The Unique Identifying Claim should be used to identify the source of an entity
as well uniquely identify the entity in all application-specific attribute stores.
Therefore this unique identifier will be an organizational, rather than application
claim. There is still some debate as to what the format of this attribute should be,
though some requirements have been identified:
• it will uniquely identify all entities (users, services, devices, etc.);
• it will allow the identification of the source domain;
• it will be semantically abstracted from the underlying data through the use
of a NATO-specific URI. i.e. even though it may be the user’s email address,
it will have a URI that identifies it as a unique identifier (ID) rather
than email address;
• it may be multi-valued, i.e. it may contain more than one attribute value.
This will allow the use of other values (then e.g. an e-mail address) like