论文标题
零信任联合会：在用户控制下共享上下文对身份联合的零信任
Zero Trust Federation: Sharing Context under User Control toward Zero Trust in Identity Federation
论文作者
论文摘要
为了安全地控制对系统的访问，已经提出了零信任的概念。基于零信任概念的访问控制删除了隐性信任，而是专注于通过使用上下文在每个访问请求下评估可信度。上下文是有关实体提出访问请求和设备状态等实体的信息。考虑实体（依赖方； RP）基于零信任概念强制执行访问控制的身份联合会中零信任的方案。 RPS应该通过自己使用收集的上下文来不断评估可信度，但是用户很少访问无法自行收集足够的上下文的RP。因此，我们提出了一个称为零信任联合会（ZTF）的新联合会。在ZTF中，共享上下文和身份，以便RP可以基于零信任概念来强制执行访问控制。联合上下文由一个名为“上下文属性提供商”的新实体管理，该提供商与身份提供者无关。我们通过使用两个协议设计了ZTF中实体之间共享环境的机制。基于连续访问评估协议和用户同意协议基于用户托管访问权限的上下文传输协议。我们实施了ZTF原型，并评估了4个用例中ZTF的能力。
To securely control access to systems, the concept of Zero Trust has been proposed. Access Control based on Zero Trust concept removes implicit trust and instead focuses on evaluating trustworthiness at every access request by using contexts. Contexts are information about the entity making an access request like the user and the device status. Consider the scenario of Zero Trust in an identity federation where the entity (Relying Party; RP) enforces access control based on Zero Trust concept. RPs should continuously evaluate trustworthiness by using collected contexts by themselves, but RPs where users rarely access cannot collect enough contexts on their own. Therefore, we propose a new federation called Zero Trust Federation (ZTF). In ZTF, contexts as well as identity are shared so that RPs can enforce access control based on Zero Trust concept. Federated contexts are managed by a new entity called Context Attribute Provider, which is independent of Identity Providers. We design a mechanism sharing contexts among entities in a ZTF by using the two protocols; context transport protocol based on Continuous Access Evaluation Protocol and user consent protocol based on User Managed Access. We implemented the ZTF prototype and evaluated the capability of ZTF in 4 use-cases.
