© 2007 Charteris plc20 June Extending Web Service Security with WS-* Presented by Chris Seary MVP Charteris plc, Bartholomew Close, London EC1A 7JN
© 2007 Charteris plc20 June Vision Secure communications –Confidentiality –Integrity –Availability
© 2007 Charteris plc20 June Confusion Network protocol security Message layer security ? ?? ? ?
© 2007 Charteris plc20 June Coming up Clarification What are the different types of security provided by networking protocols? What does message level security add? Suggestions on which to choose How to do it using WCF
© 2007 Charteris plc20 June What is WS-Security? Message layer security Standards based (OASIS) WS-* –WS-Security –WS-Addressing –Etc.
© 2007 Charteris plc20 June How do we implement it? WCF provides a framework for programming WS-* –Authentication –Encryption –Non-repudiation –Digital signatures –Etc.
© 2007 Charteris plc20 June Message security versus network protocol security What do we mean by –Message –Network protocol Confusion due to naming!
© 2007 Charteris plc20 June Network protocols TCP/IP stack Refers to network communications
© 2007 Charteris plc20 June Network protocols Security Applied here TCP/IP stack Refers to network communications
© 2007 Charteris plc20 June Network protocols Security Applied here Unsecured data TCP/IP stack Refers to network communications
© 2007 Charteris plc20 June Network protocols Data is only protected during transit Security Applied here Unsecured data
© 2007 Charteris plc20 June Network protocols Security Applied here Unsecured data HTTPS FTPS
© 2007 Charteris plc20 June Network protocols Security Applied here Unsecured data IPSec
© 2007 Charteris plc20 June Network protocols Security Applied here Unsecured data PPP uses PAP CHAP MS-CHAP EAP
© 2007 Charteris plc20 June Network protocols SSL –Confidentiality –Integrity –Authenticates USERS Basic Windows Etc. –Various apps FTP SQL Server libraries
© 2007 Charteris plc20 June Network protocols IPSec –Confidentiality –Integrity –Authenticates HOSTS Kerberos Shared password (don’t do this in production!) Certificates –VPN with L2TP
© 2007 Charteris plc20 June Demo SSL in IIS IPSec
© 2007 Charteris plc20 June Message security Protects data that is sent Security Applied here (encrypt) Secure data Security Applied here (decrypt)
© 2007 Charteris plc20 June Message security More granular Can use application level tools End to end Security Applied here (encrypt) Secure data Security Applied here (decrypt)
© 2007 Charteris plc20 June Integrity –Message not altered in transit –WS-*, SSL, IPSec all give this
© 2007 Charteris plc20 June Non-repudiation Digital signatures –Gives assurance that message was sent by the signer –WS-* gives digital signature –SSL and IPSec do not
© 2007 Charteris plc20 June Confidentiality Encryption –Only recipient can read message –Both SSL, IPSec and WSE provide this –WS-* provides more granular functionality Custom policy assertion can encrypt/sign specific parts of a message Intrusion Detection Systems may disallow SSL or IPSec
© 2007 Charteris plc20 June Authentication IPSec –Kerberos, shared key, certificates SSL –Basic, Windows, Digest, Certs WS-* –Username/password, Certs, Custom, Kerberos
© 2007 Charteris plc20 June Policy WS-* can be applied via –Configuration –Code –A mixture of configuration and code Policy is configuration
© 2007 Charteris plc20 June Policy WCF offers readymade policy objects –‘turnkey’ approach that began with WSE 3.0
© 2007 Charteris plc20 June Demo SOAP WS-Security Encryption Digital Signature
© 2007 Charteris plc20 June Security and encryption Message Jhbsx^8 Encrypt Decrypt
© 2007 Charteris plc20 June Security and encryption Message Jhbsx^8 Encrypt Decrypt Public Private
© 2007 Charteris plc20 June Security and encryption Message Jhbsx^8 Encrypt Decrypt Public Private Usually includes encryption of symmetric key!
© 2007 Charteris plc20 June Certificates Subject name Serial number Issuer Public key CA signature Attribute 1 Attribute 2 Attribute 3. Certificate
© 2007 Charteris plc20 June Certificate store Subject name Serial number Issuer Public key CA signature Attribute 1 Attribute 2 Attribute 3. Certificate Private key
© 2007 Charteris plc20 June Certificate store Local machine –Certificates used by system Demo uses Network Service Current user –Logged on user – Windows test harness X509 Certificate Tool –Grants permissions for accessing private keys
© 2007 Charteris plc20 June demo Certificate store
© 2007 Charteris plc20 June WCF Windows Communication Foundation
© 2007 Charteris plc20 June WCF Address Binding Contract
© 2007 Charteris plc20 June WCF Address –Endpoint –URL
© 2007 Charteris plc20 June WCF Binding –How do we communicate? WS-* HTTP HTTPS Etc.
© 2007 Charteris plc20 June WCF Contract –What have we agreed? Methods Parameters –Interface
© 2007 Charteris plc20 June WCF ClientService CBA CBA CBA A BC Address Where? Contract What? Binding How? Behavior Endpoints:
© 2007 Charteris plc20 June demo Wcf and ws-*
© 2007 Charteris plc20 June WS-* Evolution WSE –Tactical –WSE Net 1.x –WSE Net 2.0 WCF –Future of communications for Microsoft technologies
© 2007 Charteris plc20 June WS-* Interoperability WSE 3.0WCF WSE 2.0WCF
© 2007 Charteris plc20 June WCF us/netframework/aa asphttp://msdn2.microsoft.com/en- us/netframework/aa asp
© 2007 Charteris plc20 June WS-Federation Single Sign On Identity Providers 7 laws of identity – Kim Cameron – es/2006/07/7Laws/default.aspx
© 2007 Charteris plc20 June WS-Federation
© 2007 Charteris plc20 June WS-Federation
© 2007 Charteris plc20 June WS-Federation
© 2007 Charteris plc20 June WS-Federation
© 2007 Charteris plc20 June WS-Federation
© 2007 Charteris plc20 June WS-Federation
© 2007 Charteris plc20 June WS-Federation
© 2007 Charteris plc20 June WS-Federation
© 2007 Charteris plc20 June WS-Federation ver/en/Library/b0f029cb-65ab-44fb-bcfc- 5aa02314e06e1033.mspx?mfr=true
© 2007 Charteris plc20 June Summary Protocol – TCP/IP Message – WS-Security Single Sign On – WS-Federation Rapidly advancing technology
© 2007 Charteris plc20 June Thank you Presentation and slides –