DRAFT

International Middleware Meeting held on 14 and 15 October 2004 at the Lords of the Manor Hotel, Upper Slaughter, Nr Bourton-on-the-Water, Gloucestershire

Attendance:

Host	Malcolm Read, JISC
National Representatives
Australia	Ian Lucas, Department of Education, Science & Training (DEST)
	George McLaughlin, AARNet
CERN	Ian Neilson, CERN
Finland	Leif Laaksonen, CSC, The Finish IT Centre for Science
	Mikael Linden, TUT
Netherlands	Jaap Kuipers, SURF
	Ton Vershuren, SURF
Spain	Diego Lopez, RedIRIS,
Switzerland	Thomas Brunner, SWITCH
	Christoph Graf, SWICH
United Kingdom	Alan Robiette, JISC
United States	Heather Boyles, Internet2
	Ken Klingenstein, Internet2
Facilitators from JISC	Nike Holmes, Ann Lloyd and John Martin

Background

1. The event was organised by the Joint Information Systems Committee (JISC) of the United Kingdom’s higher education funding councils. It was intended to bring together the representatives of a number of countries in Europe and beyond which have already established national programmes for the roll-out of middleware within their education and research communities. The emphasis was on programmes which target the whole population within these communities, typified at present by authentication and authorisation schemes for access to digital content.

Introduction

2. Malcolm Read welcomed the attendees and outlined the purpose of the meeting. The aims of the meeting would be:

· To discuss whether it would be appropriate for national authentication systems to work together;

· To discuss a possible framework for further international collaboration of authentication and authorisation systems that result in more convenient interoperable user mechanisms to support international research and education.

· To discuss how to help other countries develop similar large scale systems.

Summary of Position Papers

3. Each participating country (including CERN) provided a brief position paper in advance of the meeting. Two further papers had been received on mobility and on international bandwidth reservation (part of the UK paper). Copies of these papers are attached at Annex A.

4. John Martin, rapporteur for the meeting, presented a summary of these national position papers, highlighting the common elements and the differences between the programmes. A copy of his presentation is attached at Annex B.

5. The main features in common were:

· Each programme was limited initially to one target community;

· They recognised the need to inter-work with other schemes in the future;

· They were supported by carefully prepared documentation sets

· Little, or no, accounting had so far been implemented;

6. The programmes also showed great diversity. In particular, the ‘key actors’ differed significantly between one country and another. These included university administrations, university IT centres, libraries, researchers, research project managers, and digital content providers (publishers). Whilst there was overlap between the different schemes, each had its own characteristic emphasis and this led to very significant differences in the associated documentation and formal agreements underpinning the schemes. These differences were not technology or systems related; rather they reflected the different administrative paradigms which the schemes were expected to serve.

Overview of the US ‘InCommon’ Program

7. Ken Klingenstein, Internet2, reviewed some of the issues which experience with the current national programmes had brought into focus and which he hoped would be addressed further within the discussion sessions. These are detailed below:

· It would be necessary to look beyond national schemes towards global schemes. In the language of the US InCommon Federation it seemed appropriate to envisage a global research and education framework. This had a number of associated issues, such as the inter-working of existing schemes and the widespread emergence of national schemes to give global coverage;

· The issue of mobility – and the relationships to schemes such as eduRoam. This was strongly echoed by the European agenda for student and researcher mobility.

· How to create a structure which eliminated the necessity for resource providers, such as Elsevier, to be members of multiple federations;

· The experience of InCommon in drawing up the formal and legal agreements between the federation and the credential providers (universities) had shown that indemnification was a particularly difficult issue to deal with;

· Privacy issues – concerns that there was little understanding of the meaning of privacy when applied to attributes not directly associated with identity. There will also be EU privacy issues to be addressed. Different countries’ legal systems will have their own views which will need to be considered in the development of any multi-country agreements.

Supporting Policy Documents

8. The various position papers had identified a large number of supporting documents, such as policy statements, federation agreements, rules of use etc. Copies of a representative sample of these documents were made available at the meeting and are attached at Annex C.

Supporting Development of National AA Schemes in Other Countries

9. Members of the Group discussed the ‘network peering model’ as a possible approach for peering federations, and concluded that there should be a set of criteria for deciding whether to admit new members. It was agreed that it would be appropriate to provide information which could help other countries develop their own national authentication and authorisation schemes and/or which would enable them to ‘join’ this Group.

Why would countries be interested in developing such schemes

10. It was recognised that countries would want to understand the benefits of using any such information and members discussed possible motivational factors which included:

· Enabling countries to build on the experience of others and consequently save time in developing their own schemes.

· The facilitation of student mobility

· The building of an infrastructure which effectively serves both the student and researcher

· The ability of countries to trust other countries which develop similar schemes

· Sharing of e-learning

· Access to licenced content

· Research collaborations

Production of Cookbook

11. Members agreed that the most effective way to help other countries to establish national authentication systems would be to produce a cookbook which provided key information and guidelines.

Who Should the Cookbook be Aimed at?

12. It would be important to determine an appropriate audience for the cookbook. Such a document should be aimed at decision-makers with responsibility for resource allocation, although it could be used for different purposes in different countries.

What Should the Cookbook Cover?

13. The guidance within the cookbook should be pragmatic and help countries to build their own schemes.

14. Key areas which would could be covered in the cookbook might include:

· A set of agreed standards

· Protocols for exchanging data

· What data is being exchanged

· What reasons are there to trust the data

· Naming components which should be in place for authentication system.

· What types of participation agreements should be in place to facilitate trust – MoUs?

· How formal do any agreements within countries need to be?

15. In general the cook book should not focus on technological aspects but should look at the benefits of having a national scheme, offer examples of what is working already and provide useful contact information. Where the book needs to refer to technology it should be technology neutral – although some technical issues associated with Shibboleth might need to be addressed. It would be important to manage expectations. The emphasis should be on achieving standards.

16. The cookbook should include where possible existing inter-institutional case studies where the mechanisms already work. The Grid provides excellent examples of institutional use cases. Using examples of what might be practically improved through such activity would also have more significance – ie video conferencing etc.

Research/Grids

17. Some discussion took place regarding the research environment. Members acknowledged that this community had a requirement for peering and consequently was already well developed in some of these areas. Reference should however be made to e-Research and the Grids – and more specifically the support of virtual organisations.

What are different countries’ experiences in combining education systems with other national schemes?

18. Leif Laaksonen, CSC, The Finish IT Centre for Science, introduced the session. He opened with remarks on the experiences encountered in Finland and reported that the process of reaching agreement between different systems had presented a number of challenges. Key challenges had been identifying the problem to be solved and ministers approaching the issue from different perspectives.

19. Members discussed the implications of combining research and education systems with other national schemes and made the following observations:

Maintaining Control Over Own Schemes

20. A key issue would be maintaining control over research and educational schemes. In the UK, for example, it was considered unlikely that developments in the NHS would force changes in the research and education schemes, unless it was perceived to be beneficial to that community. In the US, however, it is expected that InCommon will need to interoperate with government federations. The e-authentication effort is moving to integrate Shibboleth into its software options and is intending to build a federal federation that will peer with InCommon. The federal government is involved with commercial organisations in pursuit of athentication solutions. Concerns for the research and education community are that InCommon and the research and education agenda will not be involved appropriately in developments.

Identity Providers – Commercial/Public Sector

21. Members discussed the varying sources of ‘identity providers’ within their own countries. Countries differed as to the amount of coverage which could be achieved by any one source, ie social security numbers, national registers, national ID cards etc.

22. Banks represented possible identity service providers and some countries already had schemes introduced by the banks. In Finland the coverage of the joint banks scheme is comprehensive and offers high levels of assurance in authentication. However, the level of charge made for each authentication has meant that it has not proved cost effective for the education scheme to make use of an existing authentication service.

23. Jaap Kuipers, SURF, reported on the A-Select Authentication System (http://a-select.surfnet.nl) for authentication of users in a web environment. A-Select is a framework where users can be authenticated by several means with Authentication Service Providers, including banks. The scheme is an example of where the education and government sectors are working well together. This is the result of two factors. The first is the government’s target for e-government to cover 65 per cent of all transactions by 2007 (?). The second is the fact that the education scheme for authentication already offers authentication through multiple mechanisms and at different levels of assurance. Password, internet banking and PKI certificates are all supported and access can be made via the internet or mobile phones. The future government scheme will use the identities collected in the local residence registers, which have excellent coverage and currency. No usage charge is made for accessing the national registers in the Netherlands which is also likely to make this the preferred authentication service for many non-government schemes.

Conclusions

24. Members considered the extent to which they might need/want to take account of or work with other national schemes in the future. Despite the current lack of inter-working between different national schemes, members felt that there was immense potential, and that education schemes should be developed which could exploit this. The key factors would be:

· The education scheme should allow for authentication at multiple levels of assurance;

· The education scheme should allow for the use of third-party authentication services;

· The education scheme should recognise that the identity attributes can be stored separately from the identities. For example, a student could be authenticated via a national register, the education attributes called in from a university service, and these combined to lead to authorisation by a resource provider.

What is Required to Establish the Trust Arrangements Between Different Countries’ Authentication and Authorisation Systems?

25. George McLaughlin introduced the session about what might be required to trust different countries’ authentication and authorisation systems. He presented five key areas for consideration, including:

· Pre-authentication process

· Required identity attributes stored with digital identity

· Secure AAI

· Appropriate access policies

· Relevant audit and accountability proceses

To federate or not to federate?

26. Members discussed whether a federation (or authentication hub or exchange) should be established, or, whether countries would independently enter into bilateral agreements with other countries.

27. If a federation was the agreed way forward then a likely scenario would be an ‘overarching’ federation which included different countries’ schemes or federations. Individual federations within the overarching federation would need to have their own mechanisms for establishing trust. The role of the overarching federation would be to ensure that member federations were providing appropriate information in a manner which would allow other member countries to judge whether they were trustworthy. A key issue would then be to decide what type of information institutions would need to provide to facilitate this.

Hierarchy of Federations

28. Members considered that it would be advisable for the overarching federation to generally only admit one federation per country. This should be from the research and education community. Each federation may have any number or type of arrangements with other federations within their host country. This could be reviewed on an exceptional basis should countries want to deviate from this principle. It would also need to be reviewed on an ongoing basis to ensure its continued appropriateness.

Management of the Overarching Federation

29. A key issue for the federation would be how it would manage its own affairs. A structure or mechanism would need to be in place to enable its management. Others joining the federation would need to have access to information about its mission and governance.

Key Issues for the Establishment of a Federation

30. Key issues which would therefore need to be addressed included:

· Internal federation issues – internal management and governance structures, business plans etc

· Inter federation issues

· Multiple/union federation issues

Conclusions

31. The members had briefly considered some key issues relevant to the establishment of a federation. However they agreed that substantial work was required to develop these issues further and to ultimately establish some form of working agreement.

32. They recognised that this activity applied to the HE schemes and agreed it would be essential to refer to the grid community and to be explicit about the intention to support virtual organisations.

The Way Ahead

33. Members agreed the following:

· A ‘cookbook’ should be produced

· A vehicle for inter-linking authentication systems together should be developed

The Production of the Cookbook

34. The cookbook, as discussed earlier in the meeting, should provide practical guidance on what countries should consider when establishing authentication and authorisation systems. It might contain collective experiences and references to useful contacts. It should be aimed at funding bodies and managers of services. It should be disseminated as widely as possible.

35. Members AGREED a person should be employed to produce this cookbook. The person employed should be able to communicate with varying organisations and tap into existing relevant bodies, such as TERENA. The appointment should be made as quickly as possible in order that the cookbook could be produced as a matter of urgency. Alan Robeitte (JISC) and Ken Klingenstein (Internet2) suggested two possible candidates. Alan Robiette would manage the selection process for this appointment.

36. JISC (UK), SURF (NL) and DEST (Australia) AGREED to provide funding for this post. Other countries AGREED to consider making funding available if possible. SWITCH (Switzerland) AGREED to co-ordinate receipt of these funds and to manage the payment of the person employed.

The Development of a Vehicle for Linking Authentication Systems Together

37. Members AGREED a person should be employed to continue the debate already begun at this meeting regarding inter-working of national schemes. The postholder should be responsible for the production of principles governing the interoperability of national research and education authentication infrastructures. The person appointed should be capable of leading strategic policy debates globally and be motivated to achieve the desired outcomes. It was AGREED that this person should act as Secretary in supporting and taking forward the activities of the group.

38. Since this task was more substantive than the production of the cookbook it was AGREED that it would require a longer term appointment. The post would therefore require an appropriate level of funding to facilitate this. Members considered the post should be funded for one year in the first instance and would require 0.5 commitment. JISC would manage the selection process.

39. Members AGREED:

· To notify Alan Robiette (JISC) of any potential candidates for this post. They AGREED to forward their suggestions by Friday 26 November 2004.

· To discuss the decision to appoint the Secretary to the Group with their own organisations and to investigate the possibility of contributing funds towards the cost of the post. They AGREED to inform Malcolm Read, JISC, of the outcomes of these discussions by the end of December 2004.

40. It was AGREED that further funding from new members joining this Group should be via a subscription model.

Dissemination

41. Members AGREED that the dissemination of the outcomes of this group was important. They AGREED that the members of the group should take responsibility for raising awareness of the proposed activities at relevant groups and meetings. John Martin, Secretary to the European Network Policy Group (ENPG) would present the outcomes to their next meeting in November.

42. Members acknowledged that the eInfrastructures Reflection Group (eIRG) should be made aware of these activities. They AGREED to brief their relevant member. John Martin would brief Kyriakos Baxevanidis, EU Research Infrastructure Unit, responsible for supporting the eIRG.