Re: [Seeks-users] Identity and Access Management

[Emmanuel B. <ebe...@se...>]

Hi,

thanks for the pointers.

At this time there are two security threads to be considered within Seeks:

1/ routing on the DHT requires that peers can be certified. There are two 
  reasons for this:
 
 * secure routing, certificates being a typical counter-measure to Sybil
   attack;

 * trust rings within the main DHT ring itself so that users trusting each
   others can build their own trusty sub-network.

2/ remote access to search profiles. In a near future Seeks will allow
  deporting the user database containing a user's search profile (i.e.
  queries + clicked URLs, expect more fields in the future).
  This will have two applications:

  * users will be able to use a single remote database from all their
  machines, thus centralizing / securing their own data as they'd like
  (instead of carrying the data on their local machine). Where to put
  the database remains the user's decision.

  * public institutions / users will be able to share their profiles
  to so-called 'followers'. These followers will be able to use the
  shared profiles to experience their searches' results under a different
  filter. Typically, searching for solution to a problem say on a Debian
  system, a user would consider using a 'Debian' labelled profile.

The security solutions in the four contexts above are open, and many
questions remain.

Typically, is there a single solution that could address both 1/ & 2/ ?
This, I believe, would be the first question to answer.

In my view, 1/ & 2/ are slightly different. 1/ requires a set of certificates,
along with a central or decentralized authority to issue / revoke them.

About 2/, my current understanding is that there are two needs:
 
 a/ a control of read/write permmissions on remote user databases. This
 for shared databases to remain under the control of their owners;

 b/ a certification system to ensure that a profile (user db) is truely
 provided by the institution / user who claims to own (and fill) it.

Right now, I guess that b/ could be addressed outside Seeks, by serving
the profile from a (certified) website. However, a certification scheme
built-in Seeks would be a plus in the longer term I believe.

Much discussion is needed on the topics above, and much remain to be 
done and decided. I will try to help as much as I can with design and
solution techniques, but I fear my knowledge and current understanding
of these matters is largely insufficient.

Em.

On Tue, Dec 21, 2010 at 03:30:42AM +0100, Alexandre CABROL PERALES wrote:
> Dear seeks contributors,
> i heard about important topic to be discussed for seeks project
> about identity and access management.
> 
> I'm currently working on in my professionnal life, so i push my
> first contribution.
> 
> I found interesting article about existing opensource framework to
> implement IAM in a project.
> 
> http://openliberty.org/wiki/index.php/ProjectAris
> 
> And other solutions which already exists:
> http://www.openliberty.org/wiki/index.php/Existing_Identity_Systems
> 
> Anybody is interested in IAM solution for seeks project and wanna
> talk about ?