Florida Atlantic University Department of Electrical and Computer Engineering &Computer Science ( ECECS ) &Computer Science ( ECECS ) Security Systems Research Group Fall 2009 Web Services “Web Services Policy Standard ” Ola Ajaj Security Systems Research Group Fall 2009 Web Services “Web Services Policy Standard ” Ola Ajaj Security Systems Research Group Copyright © 2009 Ola Ajaj

Q: What are WS Specifications?   Specifications have been developed or are currently being developed to extend Web Services capabilities. These specifications are generally referred to as WS-*.   Specifications may complement, overlap, and compete with each other.   The current status of Web Services Standards is discussed and classified on the paper :  "Web services security: Standards and products"  [Fer09]E. B. Fernandez, K. Hashizume, I. Buckley, M. M. Larrondo-Petrie, and M. VanHilst, "Web services security: Standards and products", to appear in "Web Services Security Development and Architecture: Theoretical and Practical Issues", Carlos A. Gutierrez, Eduardo Fernandez-Medina, and Mario Piattini (Eds.), IGI Global Security Systems Research Group Copyright © 2009 Ola Ajaj

WS-Federation WS- SecureConversation WS-Authorization WS-PolicyWS-TrustWS-Privacy XKMS XML Encryption XML Digital Signature SOAP Foundation WS-Security SAMLXACMLSPML Security Systems Research Group Copyright © Ola Ajaj Security Standards

Transactions WS-Coordination WS-AtomicTransaction WS-BusinessActivity Metadata WS-Policy WS-PolicyAssertions WS-PolicyAttachment WS-SecurityPolicy WS-Discovery WS-MetadataExchange Messaging WS-Addressing WS-Eventing MTOM (Attachments) Reliability WS-ReliableMessaging Security WS-Security WS-Trust WS-SecureConversation WS-Federation WS-Privacy Q: What are WS Specifications ?? Security Systems Research Group Copyright © 2009 Ola Ajaj

XML Encryption Security Systems Research Group Copyright © 2009 Ola Ajaj Symmetric Encryption Asymmetric Encryption XSAML XML Signature Digital Signature With Hashing WS-Security WS- Policy WS-Federation WS- Trust WS-Secure Conversation

Security Systems Research Group Copyright © 2009 Ola Ajaj OLA REGISTRAR

Starting Point   Web Services Standards can be : Lengthy documents. Too many details. Difficult for vendors to develop products. Difficult for users to decide what product to use.   Also, several organizations that have different goals have developed standards that may overlap and even conflict to each other.   We develop patterns for these standards to have a better understanding of them. Security Systems Research Group Copyright © 2009 Ola Ajaj

CreatePurchaseOrderRequest CreatePurchaseOrderResponse Provider Consumer Broker (UDDI) Create Purchase Order SOAP/HTTP PublishService FindService PublishServiceMetadata FindServiceResponse FindServiceRequest Q: What is WS-Policy Model?

  WSDL   Policy references are made via global attributes or PolicyReference element as defined in WS-Policy   Policy references can be made to policy expressions defined inline, e.g. in wsdl:definitions section   UDDI   Policy references are made via UDDI categorization mechanism   Policy expressions are always remote to UDDI entities   Reusable policy expressions can be registered as distinct tModels   Policy-based discovery is limited to policy expression URIs Policy WSDL P UDDI Policy UDDI Policy Security Systems Research Group Copyright © Ola Ajaj Q: How to Attache Policy to WSDL and UDDI?

Q: How to achieve Policy Exchange?  Peer-to-peer  Consumer retrieves policy from provider (e.g. WS- MetadataExchange)  Brokered approach  Provider publishes policy to broker (e.g. UDDI)  Consumers subscribe to Web services used  Broker notifies consumers in case changes occur ProviderConsumer P Broker Consumer P' Security Systems Research Group Copyright © Ola Ajaj

Agenda  Introduction  Domain Terminology  Policy Expressions  Policy Assertions  Policy Attachments  Conclusion  Policy In Action Security Systems Research Group Copyright © 2009 Ola Ajaj

WS-Policy  Why?  To integrate software systems with web services.  What?  Provides a flexible and extensible grammar for expressing the capabilities, requirements, and general characteristics of Web Service entities  How?  Defines a model to express these properties as policies  Without this standard, developers need docs. Security Systems Research Group Copyright © 2009 Ola Ajaj

 Goal:  Provide the mechanisms needed to enable Web Services applications to specify policies  WS-Policy specifies:  An XML-based structure called a policy expression containing policy information  Grammar elements to indicate how the contained policy assertions apply Security Systems Research Group Copyright © 2009 Ola Ajaj

Agenda  Introduction  Domain Terminology (Web Services Policy 1.5 – Framework)  Policy Expressions  Policy Assertions  Policy Attachments  Conclusion  Policy In Action Security Systems Research Group Copyright © 2009 Ola Ajaj

Terminology  Policy: an empty collection of policy alternatives.  Policy alternative an empty collection of policy assertions.  Policy Assertion: represents a requirement, a capability, or other property of a behavior.  Policy Expression: set of one or more policy assertions.  Policy Subject: is an entity (e.g., an endpoint, message, resource, operation) with which a policy can be associated. Security Systems Research Group Copyright © 2009 Ola Ajaj

Policy Normal Form Policy Expression Collection of alternatives („pick one“) Policy Alternative Collection of assertions („do all“) Policy Assertion Domain-specific behavior Security Systems Research Group Copyright © Ola Ajaj Q: What is WS-Policy Model? Security Systems Research Group Copyright © 2009 Ola Ajaj

 Claim: A security statement about a subject.  Subject: An item, e.g. a Web Service, about which the claims expressed in the security token apply.  Security token: A representation of a security statement.  Web Service endpoint policy: The claims and related information that Web Services require in order to process messages.

Security Systems Research Group Copyright © 2009 Ola Ajaj OLA REGISTRAR

Terminology  Policy Attachment : the mechanism for associating policy expressions with one or more subjects. Security Systems Research Group Copyright © 2009 Ola Ajaj

Agenda  Introduction  Domain Terminology  Policy Expressions  Policy Assertions  Policy Attachments  Conclusion  Policy In Action Security Systems Research Group Copyright © 2009 Ola Ajaj

Policy Expressions  A Policy Expression is the XML representation of a policy  XML facilitates interoperability between a heterogeneous platforms. Security Systems Research Group Copyright © 2009 Ola Ajaj

Agenda  Introduction  Domain Terminology  Policy Expressions  Policy Assertions  Policy Attachments  Conclusion  Policy In Action Security Systems Research Group Copyright © 2009 Ola Ajaj

Policy Assertions  A policy assertion:  Represents an individual preference, requirement, capability, or other characteristic  Is the basic building block of a policy expression  an XML element with a well-known name and meaning Security Systems Research Group Copyright © 2009 Ola Ajaj

 What does this Assertion state?  The subject requires  The UTF-8 character encoding  Any form of the English language  SOAP version 1.1 General Assertion Example <wsp:SpecVersion wsp:Usage="wsp:Required" URI=" />... Security Systems Research Group Copyright © 2009 Ola Ajaj

Policy Reference  Mechanism to share policy assertions across policy expressions  Uses the naming conventions discussed above... <wsp:PolicyReference URI="..." Ref="..." Digest="..." DigestAlgorithm="..." />... Security Systems Research Group Copyright © 2009 Ola Ajaj

Policy Reference Example <wsp:Policy wsu:Id="tokensWithSignature" xmlns:wsp="..." xmlns:wsse="...">... <wsp:Policy wsu:Id="tokensWithEncryption" xmlns:wsp="..." xmlns:wsse="...">... Security Systems Research Group Copyright © 2009 Ola Ajaj

Agenda  Introduction  Domain Terminology  Policy Expressions  Policy Assertions  Policy Attachments  Conclusion  Policy In Action Security Systems Research Group Copyright © 2009 Ola Ajaj

Policy Attachments  WS-PolicyAttachment defines mechanisms to associate expressions with subjects  Specifically defines mechanisms for:  XML elements  WSDL definitions  UDDI entries  Uses attributes  wsp:PolicyURIs – list of URIs  wsp:PolicyPrefs – list of QNames Security Systems Research Group Copyright © 2009 Ola Ajaj

Policy Attachments  The attribute wsp:PolicyAttachment binds an endpoint to a policy expression  Requires no change to the web service s:SomePortType s:SomeService... Security Systems Research Group Copyright © 2009 Ola Ajaj

Agenda  Introduction  Domain Terminology  Policy Expressions  Policy Assertions  Policy Attachments  Conclusion  Policy In Action Security Systems Research Group Copyright © 2009 Ola Ajaj

Conclusion of WS-Policy  The policy specifications define a standard framework  Developers can:  express requirements, capabilities, and preferences in an interoperable way.  select web services more meaningfully.  Policies provide support for standard assertions. Security Systems Research Group Copyright © 2009 Ola Ajaj

Policy In Action  Web Service Enhancements (WSE) 2.0 for.NET 2.0 provides basic support for WS-Policy Security Systems Research Group Copyright © 2009 Ola Ajaj