Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
en:degrees_of_reliance [2017/07/06 14:05] – Wolfgang Pempe | en:degrees_of_reliance [2023/01/12 19:42] (current) – removed Wolfgang Pempe | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | FIXME **This page is not fully translated, yet. Please help completing the translation.**\\ //(remove this paragraph once the translation is finished)// | ||
- | |||
- | ====== Degrees of Reliance within the DFN-AAI ====== | ||
- | ===== 1 Introduction ===== | ||
- | Service providers have different requirements concerning the protection and accessibility of their resources and therefore different requirements regarding the reliability and trustworthiness of authentication within the DFN-AAI. On the other hand, institutions interested in accessing those resources are using different procedures for identification, | ||
- | |||
- | For these reasons, the DFN-AAI draws a distinction between different degrees of reliance: DFN-AAI Test (for testing purposes only), DFN-AAI Basic and DFN-AAI Advanced. The participating institutions / Home Organisations (i.e. Identity Providers) assign themselves to a certain degree as a declaration of conformity. The service providers chose the degree according to their individual needs in terms of protection of their resources. | ||
- | This ensures that users and resource providers get together at an adequate degree. | ||
- | |||
- | **Please note that the Degree of Reliance does not necessarily refer to the complete IdM of a Home Organisation. | ||
- | |||
- | ===== 2 Minimum Requirements of the Different Degrees of Reliance ===== | ||
- | Besides the aspects of trustworthy server-side communication ensured by digital certificates, | ||
- | * **I:** The procedure with which the Home Organisation confirms the identity of the individual user, | ||
- | * **A:** The procedure with which a user identifies him/herself (authentication) before accessing a resource, and | ||
- | * **D:** Data management and processes implemented by the Home Organisation to maintain its members' | ||
- | |||
- | The following tables determine the specific **minimum requirements** of each degree. This implies that procedures which are defined as minimum requirement of a higher degree are also acceptable for lower degrees. | ||
- | |||
- | ==== 2.1 Identification Procedure by the Home Organisation (I) ==== | ||
- | The Home Organisation has to assign unique digital identities to their users. | ||
- | ^ Degree | ||
- | ^ Test | any procedure | the Home Organisation may use any procedure to ascertain the identity of its users - this degree is intended for testing purposes only | | ||
- | ^ Basic | identification by means of a response from a unique address (e.g. email, phone number, postal address) | this procedure facilitates a quick and simple identification which may be sufficient for some resources - in this case a certain risk remains that the identity of the user could have been forged or stolen by an illegal third party | | ||
- | ^ Advanced | for identification, | ||
- | |||
- | ==== 2.2 Authentication Procedure (A) ==== | ||
- | In order to gain access to a certain resource, users must identify themselves to their Identity Management System (IdM) according to a specific procedure. There are several acceptable procedures in the context of the DFN-AAI. | ||
- | ^ Degree | ||
- | ^ Test | any procedure | the Home Organisation may implement any procedure for user authentication - this degree is intended for testing purposes only | | ||
- | ^ Basic | authentication with a unique digital address | this procedure facilitates a simple check which may be sufficient for some resources - in this case a certain risk remains that the identity of the user could have been forged or stolen by an illegal third party | | ||
- | ^ Advanced |authentication by means of a personal account with user ID and password or with a digital certificate which has been issued under sufficiently secure and trustworthy directives | by means of this procedure a person can unequivocally be authenticated, | ||
- | |||
- | ==== 2.3 Datenhaltung und Prozesse zur Pflege der Identitäten (D) ==== | ||
- | Die nutzende Einrichtung muss die elektronische Identitäten ihrer Nutzer pflegen und insbesondere bei Änderungen diese aktualisieren. | ||
- | ^ Klasse ^ Mindestanforderung ^ Bemerkung ^ | ||
- | ^ Test | Verfahren freigestellt | In dieser Klasse ist es der nutzenden Einrichtung freigestellt, | ||
- | ^ Basic | Mit Verpflichtung bzgl. Korrektheit und Aktualisierung innerhalb von 3 Monaten | n dieser Klasse muss die nutzende Einrichtung sicherstellen, | ||
- | ^ Advanced | Mit Verpflichtung bzgl. Korrektheit und Aktualisierung innerhalb von 2 Wochen | In dieser Klasse muss die nutzende Einrichtung sicherstellen, | ||
- | |||
- | ===== 3 Einordnen in eine Klasse der Verlässlichkeit ===== | ||
- | Die Klassen " | ||
- | Zu den technischen Details siehe unter [[de: | ||
- | |||
- | ==== 3.1 Einordnung der Ressourcen durch die Anbieter ==== | ||
- | Der Anbieter ordnet seinen Service Provider je nach Schutzbedürfnis seiner Ressource in der Metadatenverwaltung selbst der passenden Föderation zu und legt so fest, welche Mindestanforderungen Einrichtungen für die Nutzung der Ressource erfüllen müssen. | ||
- | |||
- | ==== 3.2 Konformitätserklärung der nutzenden Einrichtungen ==== | ||
- | Die nutzende Einrichtung ordnet sich in der Metadatenverwaltung unter Vertragsdaten im Sinne einer Konformitätserklärung selbst einer Klasse der DFN-AAI zu. Ihre Nutzer können dann auf alle Ressourcen zugreifen, deren Schutzbedürfnis von den Anbietern entsprechend eingeordnet wurde. Um sich einer bestimmten Klasse der DFN-AAI zuordnen zu dürfen, muss eine Einrichtung alle o.g. Mindestanforderungen dieser Klasse erfüllen. Die Zuordnung zu einer Klasse erfolgt über die Metadatenverwaltung. | ||
- | |||
- | **Beispiel: | ||