Applying Security Assertion Markup Language (SAML) to non SOAP protocols

Award Information
Department of Defense
Award Year:
Phase I
Agency Tracking Number:
Solicitation Year:
Solicitation Topic Code:
Solicitation Number:
Small Business Information
D-Tech, LLC
43462 Mechanicsville Glen Street, Ashburn, VA, -
Hubzone Owned:
Minority Owned:
Woman Owned:
Principal Investigator:
Kevin Smith
Chief Technology Advisor
(703) 829-5386
Business Contact:
Nick Duan
(703) 574-5837
Research Institution:

ABSTRACT: D-Tech is pleased to submit this proposal in response to the SBIR solicitation under topic AF112-030 titled"Applying Security Assertion Markup Language (SAML) to non SOAP Protocols". D-Tech will develop a prototype to demonstrate the feasibility and flexibility of user authentication and authorization for web applications, implementing an OpenID Identity Provider as a proxy to integrate RESTful services with a SAML-based Attribute Service compliant with NCES standard. We will extend the OpenID"s single sign-on capability with OAuth, an emerging standard for fine-grained user authorization. A survey and analysis comparing different standards, their applicability, and techniques for RESTful single sign-on will be provided. A new software framework to bind SAML with light-weight protocols will be presented in the final technical report, along with potential security applications in DoD and the commercial sector. We have formed a top-notch research team for this project, including DoD security veterans and university researcher with a solid track record in computer security and information assurance. We have a collaborative partnership with the Center of Secure Information Systems of GMU and will bring the latest R & D findings to benefit this project. The D-Tech team is confident in completing this research with the best quality and customer satisfaction. BENEFIT: Benefits: - Provide the DoD and the Federal Government at large with a simplified framework for web-based single sign-on, utilizing user attributes stored and maintained by standard enterprise directory service (e.g. LDAP) - Establish a new standard and approach for deploying web-based single sign-on and user authentication in a flexible, cost-effective way, integrating SAML with OpenID and OAuth - Gain valuable knowledge and experience in various technologies and best practices, with the potential of enhancing related open industry standards, and contributing the knowledge back to the DoD and the IT security community via publications and conference presentations based on Phase I research - Generate new intellectual properties out of this research if such opportunities arise Potential Commercial Applications - Online Service Provider to use SAML attribute service to provide trust services (e.g. Secure Token Service) for RESTful applications - Online Service provider to use SAML in combination with OpenID and OAuth to achieve attribute-based access control - Mobile Service Provider to use lightweight protocol to perform user access control in difference mobile platforms

* information listed above is at the time of submission.

Agency Micro-sites

SBA logo

Department of Agriculture logo

Department of Commerce logo

Department of Defense logo

Department of Education logo

Department of Energy logo

Department of Health and Human Services logo

Department of Homeland Security logo

Department of Transportation logo

Enviromental Protection Agency logo

National Aeronautics and Space Administration logo

National Science Foundation logo
US Flag An Official Website of the United States Government