1. Copyright © 2009 Trusted Computing Group An Introduction to Federated TNC Josh Howlett, JANET(UK) 11 June, 2009.

2. Trusted Computing Group Confidential What is the Trusted Computing Group?

3. Copyright© 2009 Trusted Computing Group – Other names and brands are properties of their respective owners. Slide #3 Who is TCG? The Trusted Computing Group (TCG) is an international industry standards group The TCG develops specifications amongst it members  Upon completion, the TCG publishes the specifications  Anyone may use the specifications once they are published The TCG publicizes the specifications and uses membership implementations as examples of the use of TCG Technology The TCG is organized into a work group model whereby experts from each technology category can work together to develop the specifications  This fosters a neutral environment where competitors and collaborators can develop industry best capabilities that are vendor neutral and interoperable

4. Copyright© 2009 Trusted Computing Group – Other names and brands are properties of their respective owners. Slide #4 TCG: Standards for Trusted Systems Mobile Phones Authentication Storage Applications Software Stack Operating Systems Web Services Authentication Data Protection Infrastructure Servers Desktops & Notebooks Security Hardware Network Security Printers & Hardcopy Virtualized Platform

5. Trusted Computing Group Confidential What is Trusted Network Connect?

6. Copyright© 2009 Trusted Computing Group – Other names and brands are properties of their respective owners. Slide #6 TNC Architecture

7. Copyright© 2009 Trusted Computing Group – Other names and brands are properties of their respective owners. Slide #7 TNC status  TNC standards-based products are available  TNC-enabled solutions have been implemented by customers  The number of TNC adopters (vendor and client) continue to grow  TNC-based IETF standards (NEA) expected to reach RFC status in 2009

8. Trusted Computing Group Confidential What is Federated TNC?

9. Copyright© 2009 Trusted Computing Group – Other names and brands are properties of their respective owners. Slide #9 Some history, and acknowledgements  Federated TNC builds on previous work  The GN2 JRA5 ‘DAMe’ project  The Internet2 RADIUS-SAML profile

10. Copyright© 2009 Trusted Computing Group – Other names and brands are properties of their respective owners. Slide #10 Conceptual model

11. Copyright© 2009 Trusted Computing Group – Other names and brands are properties of their respective owners. Slide #11 What does it specify?  Network Assessment Profile  Assess an endpoint as it connects to an IEEE 802.1X protected network.  Web Assessment Profile  Assess an endpoint as it connects to a SAML protected web application.  SAML Attribute Profile  Defines how TNC attributes can be expressed as SAML attributes.  SAML Name Identifier Formats  Defines Name Identifier formats for NAIs and MAC addresses.

12. Copyright© 2009 Trusted Computing Group – Other names and brands are properties of their respective owners. Slide #12 The Assessment Profiles  Both profiles use a common message exchange pattern  For SAML 1.1, uses the Shibboleth Attribute Exchange Profile.  For SAML 2.0, uses the Assertion Query/Request Profile.  Both profile support the request of attributes about endpoints and users.  “Is the firewall on this machine turned on?”  “Is the user who authenticated using this computer a student?”

13. Copyright© 2009 Trusted Computing Group – Other names and brands are properties of their respective owners. Slide #13 Network Assessment Profile

14. Copyright© 2009 Trusted Computing Group – Other names and brands are properties of their respective owners. Slide #14 Web Assessment Profile

15. Copyright© 2009 Trusted Computing Group – Other names and brands are properties of their respective owners. Slide #15 Conclusions  Federated TNC provides a mechanism to represent and transport information about users and machines between domains.  Federated TNC should be compatible with IETF NEA standards.  Technology was tricky; policy will be harder.  Specification available from the TCG website:  http://www.trustedcomputinggroup.org