Subject: RE: [seamoby] More about authorization vs. authentication

From: "Gary Kenward" <[email-masked]>
Date: Thu, 14 Jun 2001 14:12:34 -0400

For what it's worth, Charlie, I like the wording.
As good as it will get I suspect.

Gary

> -----Original Message-----
> From: Charles E. Perkins [mailto:[email-masked]]
> Sent: Thursday, June 14, 2001 2:07 PM
> To: Seamless Mobility Working Group
> Subject: [seamoby] More about authorization vs. authentication
> 
> 
> 
> Hello folks,
> 
> Sorry to have missed out on the last few days of discussion.
> It seems to me that it is crucial to get some definitions right,
> because they are important for the requirements for context
> transfer.  I've studied a number of sources to get useful
> information, and have been very fortunate to get clarifications
> and suggestions from e-mail that have helped me understand the
> issues better.
> 
> Thanks to Henry Haverinen for sending the following
> definitions (which he cited from http://www.pcwebopaedia.com/)
> 
> ===============================================================
> 
> Authentication:
> The process of identifying an individual, usually based on a 
> username and password. In security systems, authentication is 
> distinct from authorization, which is the process of giving 
> individuals access to system objects based on their identity.
> Authentication merely ensures that the individual is who he 
> or she claims to be, but says nothing about the access rights 
> of the individual. 
> 
> Authorization:
> The process of granting or denying access to a network resource.
> Most computer security systems are based on a two-step process.
> The first stage is authentication, which ensures that a user is 
> who he or she claims to be. The second stage is authorization,
> which allows the user access to various resources based on the
> user's identity. 
> 
> ================================================================
> 
> However, there are other competing definitions for these
> terms, often not quite compatible with each other.
> 
> I really think that we have to get some terminology by which
> specific proposals can be judged against the security requirements
> for context transfer.  It seems debatable (at least) whether
> the security requirements are met by existing IPsec protocols.
> 
> Maybe for protocol design the general procedure can be
> described as follows:
> 
> 1. A node asks for access to some resource, and presents 
>    its credentials.
> 
> 2. The request is received, and the credentials verified.
> 
> 3. If the verification succeeds, information about access to
>    the resource is delivered to the requesting node.
> 
> This enumeration doesn't explicitly mention authentication or
> authorization, and yet to me it seems clear and unambiguous.
> Thus, I would suggest that we could use the term "credential
> verification" to replace authentication.  From what I have
> read, most people would understand the meaning of that term
> better.  Then, the process of "authorization" could either be
> taken to mean some sort of internal database access, or else
> the delivery of the access information in (3).  Or maybe
> there wouldn't be any need to use that terminology at all.
> 
> As an aside, I looked in on some related discussion from
> the AAA working group, and found some statement that
> authorization can be provided without authentication.
> 
> Here are definitions from RFC 2989:
> 
>    Authentication
>              The act of verifying a claimed identity, in the form of a
>              pre-existing label from a mutually known name 
> space, as the
>              originator of a message (message authentication) 
> or as the
>              end-point of a channel (entity authentication).
> 
>    Authorization
>              The act of determining if a particular right, such as
>              access to some resource, can be granted to the 
> presenter of
>              a particular credential.
> 
> These definitions support the type of distinctions I had tried to
> make in previous e-mails, and that I have understood to describe
> the relevant care-of address operations for Mobile IPv6.  They
> also have the advantage of being somewhat compatible with the
> definitions from www.pcwebopaedia.com.  They could be taken as
> a start for the appropriate definitions within [seamoby], if the
> terms are to be used at all.
> 
> Bottom line: one's perspective on this issue seems to depend on
> whether "authentication" is taken to mean "identity authentication",
> and maybe we could get away without using the terms anyway if we
> focus on credential verification.
> 
> Regards,
> Charlie P.
>