PPT Slide

User Org

KDC

User

Broker

Application

User Org

AAA Server

TGT

UOST

UOST (Binding),

Auth

AM

(Binding)

CERT

(Binding)

CERT

(Binding)

CERT (Binding)

OK

Figure 5a - Inter-Domain Push Sequence

User Org Performs Authentication and Authorization

Trusted Broker Signs Authorization

KDC: Kerberos Key Distribution Center

TGT: Ticket Granting Ticket

UOST: User Org AAA Server Service Ticket

Auth: Authenticator created by User and encrypted with UOST session key

AM: Message authorizing User to Application / Can be bound to: User name or ID, User IP address (these could be sent through AM) , secure channel session between User and Application (if created - would need to pass the session key or identifier to the AAA server)

CERT: Created from AM and signed by trusted Broker

Binding: User IP addr, or User name, or User/Application secure session ID, etc …

Secure Channel

Previous slide

Next slide

Back to first slide

View graphic version

Slide Notes and Questions:

• What set of information does the User Org authorization message (AM) contain?

• What set of information does the Broker authorization message (AM’) contain?

• What should be used as the binding?

4. What exactly is implied by “secure channel”?

5. Are there any security issues?

6. What set of information does the User Org authorization certificate (CERT) contain? Is it signed with the

Application’s public key or with a shared secret between the Broker and the Application?

7. The reason why a secure channel is needed between the User Org and the Broker is because the AM and AM’

messages are not protected. The secure channel could be removed if AM and AM’ are sent as certificates signed

with some shared secret between the User Org and the Broker.

8. UOST => {Tcs}Ks

Tcs => User Org AAA server, User, IP addr of User, ts, lifetime, Kcs

Ks => User Org AAA server’s shared key with the KDC

Auth => {Ac}Kcs

Ac => name of User, IP addr of User, ts (New Ac must be generated per service request)

Kcs => Session key for User and User Org AAA server