Improving Identity and Authentication Assurance in Research & Education Federations

Abstract

In this paper we present a lightweight identity and authentication assurance framework tailored to the needs of the research & education (R&E) sector. A comprehensive requirements analysis has been carried out with its findings being compared with existing assurance frameworks such as NIST 800-63-3, IGTF and Kantara. Due to the special requirements in a federated environment that spans multiple countries, none of the existing frameworks seems to scale in this environment. In this context, conditions such as the independence of organizations, the different organizational cultures and technical capabilities prevent the definition of strict security requirements as they are required in most policies. The REFEDS assurance suite presented here, defines a set of identity and authentication assurance criteria also including two assurance profiles differentiating between low-risk and high-risk research use cases. The presented approach still incorporates relevant criteria from existing frameworks and has been evaluated by means of a public consultation and a technical pilot. The evaluation has shown successful configuration and testing with Shibboleth and SimpleSAMLphp software, but also positive feedback from the R&E community members.