+6.2 Federation Threat Mitigation Strategies
|
6.2 Federation Threat Mitigation Strategies
In addition to the security controls discussed in Sec. 3.11, mechanisms that assist in mitigating the above threats are identified in Table 4. Table 4. Mitigating federation threats
| Federation Threat/Attack |
Threat Mitigation Mechanisms |
Normative Reference(s) |
| Assertion Manufacture or Modification |
Cryptographically sign the assertion at the IdP and verify at the RP |
3.5, 3.12.2 |
| |
Send the assertion over an authenticated protected channel that authenticates the IdP |
4.11 |
| |
Include a non-guessable random identifier in the assertion |
3.12.1 |
| Assertion Disclosure |
Send the assertion over an authenticated protected channel that authenticates the RP |
4.9, 5.8 |
| |
Encrypt the assertion for a specific RP (may be accomplished using a mutually authenticated protected channel) |
3.12.3 |
| Assertion Repudiation by the IdP |
Cryptographically sign the assertion at the IdP with a signing key that supports non-repudiation, and verify the signature at the RP |
3.12.2 |
| Assertion Repudiation by the Subscriber |
Issue holder-of-key assertions or assertions with bound authenticators; proof of possession of the authenticator verifies the subscriber’s participation to the RP |
3.14 3.15 |
| Assertion Redirect |
Include the identity of the RP for which the assertion is issued in its signed content; the RP verifies that they are the intended recipient |
3.12.4 |
| Assertion Reuse |
Include an issuance timestamp with a short validity period in the signed content of the assertion; the RP verifies the time period |
4.9, 5.8 |
| |
The RP keeps track of assertions that are consumed within a configurable time window to ensure that a given assertion is not used more than once |
3.12.1 |
| Assertion Substitution |
Ensure that assertions contain a reference to the assertion request or some other nonce that was cryptographically bound to the request by the RP |
4.9, 5.8 |
| |
Send assertions in the same authenticated protected channel as the request (e.g., back-channel presentation) |
4.11.1 |
| Revoked or Stale Attributes |
Ensure fresh assertions with valid time windows |
4.9, 5.8 |
| |
Enable checking validity of attribute bundles independently of assertions |
5.1.1 |
1. Ülevaade
1.1 Viited
1.2 Tuvastatud nõuded
1.3 Seotud regulatsioonid
2. Tuvastatud nõuded
3. Seotud regulatsioonid
Regulatsioonid
| Allikas |
Regulatsioon |
- NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.
DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.
|