Subject: [seamoby] More about authorization vs. authentication

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 14 Jun 2001 11:06:30 -0700

Hello folks,

Sorry to have missed out on the last few days of discussion.
It seems to me that it is crucial to get some definitions right,
because they are important for the requirements for context
transfer.  I've studied a number of sources to get useful
information, and have been very fortunate to get clarifications
and suggestions from e-mail that have helped me understand the
issues better.

Thanks to Henry Haverinen for sending the following
definitions (which he cited from http://www.pcwebopaedia.com/)

===============================================================

Authentication:
The process of identifying an individual, usually based on a 
username and password. In security systems, authentication is 
distinct from authorization, which is the process of giving 
individuals access to system objects based on their identity.
Authentication merely ensures that the individual is who he 
or she claims to be, but says nothing about the access rights 
of the individual. 

Authorization:
The process of granting or denying access to a network resource.
Most computer security systems are based on a two-step process.
The first stage is authentication, which ensures that a user is 
who he or she claims to be. The second stage is authorization,
which allows the user access to various resources based on the
user's identity. 

================================================================

However, there are other competing definitions for these
terms, often not quite compatible with each other.

I really think that we have to get some terminology by which
specific proposals can be judged against the security requirements
for context transfer.  It seems debatable (at least) whether
the security requirements are met by existing IPsec protocols.

Maybe for protocol design the general procedure can be
described as follows:

1. A node asks for access to some resource, and presents 
   its credentials.

2. The request is received, and the credentials verified.

3. If the verification succeeds, information about access to
   the resource is delivered to the requesting node.

This enumeration doesn't explicitly mention authentication or
authorization, and yet to me it seems clear and unambiguous.
Thus, I would suggest that we could use the term "credential
verification" to replace authentication.  From what I have
read, most people would understand the meaning of that term
better.  Then, the process of "authorization" could either be
taken to mean some sort of internal database access, or else
the delivery of the access information in (3).  Or maybe
there wouldn't be any need to use that terminology at all.

As an aside, I looked in on some related discussion from
the AAA working group, and found some statement that
authorization can be provided without authentication.

Here are definitions from RFC 2989:

   Authentication
             The act of verifying a claimed identity, in the form of a
             pre-existing label from a mutually known name space, as the
             originator of a message (message authentication) or as the
             end-point of a channel (entity authentication).

   Authorization
             The act of determining if a particular right, such as
             access to some resource, can be granted to the presenter of
             a particular credential.

These definitions support the type of distinctions I had tried to
make in previous e-mails, and that I have understood to describe
the relevant care-of address operations for Mobile IPv6.  They
also have the advantage of being somewhat compatible with the
definitions from www.pcwebopaedia.com.  They could be taken as
a start for the appropriate definitions within [seamoby], if the
terms are to be used at all.

Bottom line: one's perspective on this issue seems to depend on
whether "authentication" is taken to mean "identity authentication",
and maybe we could get away without using the terms anyway if we
focus on credential verification.

Regards,
Charlie P.

---

From: Erik Anderlind <[email-masked]>
Date: Fri, 15 Jun 2001 14:21:50 -0400

Hi Charlie,
I think you make a mistake in equating "claimed identity" with
"individual".
THe AAA group's definitions seem to provide a better starting point.

If we think in terms of authorizing a specific role (as opposed to 
authorizing an individual), the required security bindings will 
become much clearer. An individual's "networking role" can be 
authorized to make a context transfer. It doesn't have to 
use the same security contexts as the application login role.

Authentication mechanisms go beyond credential verfication as they 
also include e.g. the mechanism for submitting the credentials.
..Erik