{"id":834,"date":"2007-07-06T09:22:57","date_gmt":"2007-07-06T17:22:57","guid":{"rendered":"\/?p=834"},"modified":"2007-07-06T09:24:43","modified_gmt":"2007-07-06T17:24:43","slug":"the-cardspace-dimensions","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=834","title":{"rendered":"The CardSpace dimensions"},"content":{"rendered":"

Axel Nennker from T-Systems in Germany now has a blog called ignisvulpis <\/a>(OK, no translation found in search engines – I had to crack open my latin dictionary to be reminded that ignis<\/em> means ‘fire’ and vulpes<\/em> means ‘fox’…   Yikes, Axel!)  Axel is a contributor to the openinfocard<\/a> project started by Chuck Mortimore<\/a> and Ian Brown<\/a>.<\/p>\n

In a bizarre case of Information Card Fever sweeping through Germany, he writes<\/a>:<\/p>\n

Yesterday I learned that the team of the new<\/font><\/a> java CardSpace<\/font><\/a> project jinformationcard<\/font><\/a> works in the same building<\/font><\/a> as I do. As I am a contributor to the openinfocard<\/font><\/a> project we now have two independent java CardSpace projects “in the house”. <\/p><\/blockquote>\n

That's amazing.<\/p>\n

Anyway, I heard Axel speak at a meeting a while ago and was fascinated by the way he conceptualized his “information card dimensions”.   Now I can share it with you because he posted it <\/a>to his blog:<\/p>\n

While thinking about how Windows CardSpace<\/font><\/a> could be used and extended I came up with this graphic.<\/p>\n

<\/p>\n

Thus the dimensions of Windows CardSpace are:<\/p>\n

    \n
  1. Cardstore<\/strong>: Where is the cardstore?
    \nService Providers store the information cards and facilitate the use through different devices.<\/li>\n
  2. CredentialStore<\/strong>: Where are the credentials?
    \nStorage of credentials and engine for cryptographic operations.<\/li>\n
  3. UI Generation<\/strong>: Where is the UI generated?
    \nThe UI could be generated on a server but be displayed on one of the user\u00e2\u20ac\u2122s devices.<\/li>\n
  4. Identity Selector (UI)<\/strong>: Where is the UI displayed and where is the Information Card selected?<\/li>\n
  5. STS<\/strong>: Where is the STS?<\/li>\n
  6. STS Authentication<\/strong>: Authentication Technology<\/li>\n
  7. Browser<\/strong>: On which device is the authentication needed?<\/li>\n<\/ol>\n

    Now imagine all the combinations of the coordinates which span “use case space”.  My colleague Jochen Klaffer designed and implemented a tool which helped us a lot to find relevant use cases in our “CardSpace for Telcos” project which we are doing for Deutsche Telekom Laboratories’<\/font><\/a> J\u00c3\u00b6rg Heuer<\/font><\/a>.<\/p>\n

    This is of course only a selection of possible dimensions.  Others were excluded for simplicity and because there are strong indications that they will never be relevant.  Kim Cameron<\/font><\/a> said e.g. about using different protocols instead of WS-*: “This will not happen”.<\/p>\n

    So the “Trust Protocol” dimension is not shown in this graphic.<\/p>\n

    Other dimensions missing are new transport protocols like SIP instead of HTTP to transport the RST\/RSTR. So the “Transport Protocol” dimension is not shown in this graphic.<\/p>\n

    You will probably notice that there are points on the axis that are not part of CardSpace version 1.0…<\/p>\n

    Let us look at CardSpace 1.0.<\/p>\n

    <\/p>\n

      \n
    1. Cardstore<\/strong>: local (secure desktop).<\/li>\n
    2. CredentialStore<\/strong>: local (secure desktop).<\/li>\n
    3. UI Generation<\/strong>: local (secure desktop).<\/li>\n
    4. Identity Selector (UI)<\/strong>: local (secure desktop)<\/li>\n
    5. STS<\/strong>: local or network<\/li>\n
    6. STS Authentication<\/strong>: fixed set of four technologies<\/li>\n
    7. Browser<\/strong>: PC<\/li>\n<\/ol>\n

      So this the current state, but the universe is expanding, right?<\/p>\n

      Interpretation of the axes and the new points the axes is left to the reader \ud83d\ude09<\/p><\/blockquote>\n

      I think this is really brilliant and have been amazed at the methodologies being used.  I hope Axel will also report on the work by Jochen Klaffer to which he refers.<\/p>\n

      One small correction – we already support a simple RESTful http post of a token to a relying party – in other words, no need for WS.  So there is a protocol dimension.  In terms of the highly trusted connection between identity selector and identity provider, I would much rather avoid introducing alternate protocols that would drastically increase our attack surface and test matrix.<\/p>\n","protected":false},"excerpt":{"rendered":"

      Axel invites us to imagine all the combinations of the coordinates which span “use case space”<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[45,8,7,9,4],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/834"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=834"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/834\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=834"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=834"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=834"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}