GridNet Funding Report
Open Grid Forum 19
28 January 2007 – 2 February 2007
Chapel Hill, North Carolina, USA
Dr Ning Zhang
School of Computer Science
University of Manchester
ning.zhang@manchester.ac.uk
I attended OGF19 to chair the LoA BOF session there. This report summarises
my attendance at OGF19 and my work in relation to the LoA BOF session.
I initiated and chaired the LoA BOF at OGF 19 that was the primary security
meeting on Wednesday that week. I wrote and disseminated a document, EInfrastructure Security: An Investigation of Authentication Levels of Assurance
(LoAs) (now available at
http://www.ogf.org/OGF19/materials/561/OGFLoABoF.pdf) prior to the session.
The session followed the theme of this document. It started with an overview of
existing LOA definitions including those defined by the US government’s Office of
Management and Budget (OMB) and the NIST (US National Institute of Standard
and Technology). It then highlighted the motivations for further work, and
emphasised that the existing definitions only cater for human-to-machine
authentication scenarios. Finally, it discussed how to proceed to address the
gaps when current definitions are being applied in Grid/e-Science contexts.
The session was attended by 18 attendees, and there were a lot of discussions
going on. There was a general feeling that the 4 levels as specified by the US
OMB/NIST are good ones, but more work and community consensus are
required to address the gaps as introduced by the Gird usecase scenarios. These
gaps cover several aspects, namely, (1) the LoA attributes and factors that have
not been addressed by the existing standards, (2) algorithms for the calculation
of overall LoA when an authentication process involves a chain of authentication
related activities, and (3) how LoA attribute values may be conveyed from IdP to
service providers.
At the end of the 90 minutes session, it was agreed that the LoA is a very
important aspect of Grid security, and a special research group in OGF, i.e. LoA
RG, should be formed to research and understand the issues and gaps in relation
to existing LoA definitions and how LoA may be applied in the Grid environment.
It was also agreed to add a work item to the proposed OGSA-Authn WG to cover
the transporting of LOAs between IdPs and service providers, and to leave the
definition of the various LOA levels to IGTF.
I happily accepted to lead this new RG, together with Yoshio Tanaka,
yoshio.tanaka@aist.go.jp.
In addition to chairing the LoA BOF session, I also attended the following
security related meetings: the SAGA security discussions, the Federated Identity
workshop, and the OGSA Authz WG meeting.