Secure Web Services Akylbek Zhumabayev Rochester Institute of Technologies.

Slides:

Advertisements

Similar presentations

Gridshell Web Services Akylbek Zhumabayev. Content Gridshell Architecture Gridshell Mediator Gridshell Client Gridshell Full Picture Security Patterns.

Advertisements

Security Standards (…and Competing Standards … and Implementations … and Interoperability) Marty Humphrey Assistant Professor Computer Science Department.

Unissons nos Talents T O G E T H E RT A L E N T E D 1 Web Services Security – Challenges & Trends Magan Pal Singh Technical Architect, Sopra Group

0 Web Service Security JongSu Bae. 1  Introduction 2. Web Service Security 3. Web Service Security Mechanism 4. Tool Support 5. Q&A  Contents.

Secure Systems Research Group - FAU 1 Web Services Products and Tools Ingrid Buckley Dept. of Computer Science and Engineering Florida Atlantic University.

Content provided under the terms and conditions of the Eclipse Public License Version Eclipse Foundation - Kathy Chan.

T Network Application Frameworks and XML Service Federation Sasu Tarkoma.

Reliable Messaging in the Real World Paul Fremantle Co-chair, OASIS WS-RX TC VP and Founder, WSO2 Inc OASIS Adoption Forum Ditton Manor, October 29 th.

Latest techniques and Applications in Interprocess Communication and Coordination Xiaoou Zhang.

Web Services Security Multimedia Information Engineering Lab. Yoon-Sik Yoo.

© 2007 Charteris plc20 June Extending Web Service Security with WS-* Presented by Chris Seary MVP Charteris plc, Bartholomew Close, London.

All Contents © 2003 Burton Group. All rights reserved. Federating Identity Management: Standards, Technologies and Industry Trends November 20, 2003 Daniel.

1 WS Technologies III BPEL4WS Roberto Bruni Dipartimento di Informatica Università di Pisa Models and Languages for Coordination and Orchestration IMT-

Module 13: WCF Receive Adapters. Overview Lesson 1: Introduction to WCF Receive Adapters Lesson 2: Configuring a WCF Receive Adapter Lesson 3: Using the.

Secure Systems Research Group - FAU Web Services Standards Presented by Keiko Hashizume.

.NET AND JAVA INTEROPERABILITY. Pooyahttp://blogs.msdn.com/pooyad/

Nikola Dudar Program Manager Microsoft Corporation Session Code: DTL 311.

Web Service Standards, Security & Management Chris Peiris

Web Services and HL7v3 in IHE profiles Vassil Peytchev Epic.

Session 1194 JBuilder 2005 Web Services Designer Ravi Kumar Principal Engineer Borland.

Secure Systems Research Group - FAU 1 WS-ReliableMessaging Pattern Part II Ingrid Buckley Dept. of Computer Science and Engineering Florida Atlantic University.

Enterprise Identity Steve Plank – Microsoft Ivor Bright – Charteris Dave Nesbitt – Oxford Computer Group.

OiCoN 2007Madeira Island Automotive Industry Action Group (AIAG)  Automotive Industry ‘Vertical’ for North American Supply Chain Founded by.

Web Services Security Standards Overview for the Non-Specialist Hal Lockhart Office of the CTO BEA Systems.

An Alternative to WSRF and WS-Notification: WS-Transfer, WS-Eventing, and WS-Enumeration Marvin Theimer Windows Server High Performance Computing Group.

Herndon, VA October 12, 2006 Navigating Web Services Standards NIST Special Publication

Grid Computing and Web Services Marty Humphrey Assistant Professor Computer Science Department University of Virginia.

17 March 2008 © 2008 The University of Edinburgh, European Microsoft Innovation Center and University of Southampton IT Innovation Centre 1 NextGRID Security.

Random Logic l Forum.NET l Web Services Enhancements for Microsoft.NET (WSE) Forum.NET ● October 4th, 2006.

Shibboleth Akylbek Zhumabayev September Agenda Introduction Related Standards: SAML, WS-Trust, WS-Federation Overview: Shibboleth, GSI, GridShib.

Navigating the Standards Landscape Andrew Owen SEARCH.

Secure Systems Research Group - FAU Patterns for Web Services Security Standards Presented by Keiko Hashizume.

Web Services A look to the future By Dr Colin Adam.

EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Security Token Service Valéry Tschopp - SWITCH.

Grid Security: Authentication Most Grids rely on a Public Key Infrastructure system for issuing credentials. Users are issued long term public and private.

Prabath Siriwardena – Software Architect, WSO2. Patterns Standards Implementations Plan for the session.

Mr. Abdelkrim Boujraf, Unisys Mr. Andreas Schaad, SAP Research Mr. Mohammad Ashiqur Rahaman, SAP Research funded by EU Integrated Project R4eGov R4eGov.

Shibboleth Akylbek Zhumabayev September Agenda Introduction Description WS Standards WS-Federation Picture Grid Security GridShib References 2.

Gridshell Security Master Project Akylbek Zhumabayev Rochester Institute of Technology.

© 2004 IBM Corporation ICSOC2004 Panel Discussion: Grid Systems: What is needed from web service standards? Jeffrey Frey IBM.

Advanced Java Session 10 New York University School of Continuing and Professional Studies.

Andrew J. Hewatt, Gayatri Swamynathan and Michael T. Wen Department of Computer Science, UC-Santa Barbara A Case Study of the WS-Security Framework.

Secure Web Services Akylbek Zhumabayev Rochester Institute of Technologies.

Web Services Security Mike Shaw Architectural Engineer.

Web Services Security with WSE 2.0 Muhammad Saqib Ilyas

Presented by: Sonali Pagade Nibha Dhagat paper1.pdf.

1 WS-Security Yosi Taguri Microsoft Israel

Security in OPC Unified Architecture (UA) Dick Oyen IndustrialSysDev, Inc.

August 3, 2004WSRP Technical Committee WSRP v2 leveraging WS-Security 1. Motivation 2. WS-Securtiy Roadmap and Status 3. WSRP Use Cases 4. Strawman/Issues.

August 3, 2004WSRP Technical Committee WSRP v2 leveraging WS-Security Discussion 1. WS-* Standards 2. WS-Securtiy Interop&Implementations 3. Customer demands.

ESRIN, 15 July 2009 Slide 1 Web Service Security support in the SSE Toolbox HMA-T Phase 2 FP 14 December 2009 S. Gianfranceschi, Intecs.

Security Problems (and Solutions) for Service Oriented Applications

OWASP Web Services Project

Presentation transcript:

Secure Web Services Akylbek Zhumabayev Rochester Institute of Technologies

Legend Implemented Standard Implemented in additional product Security Layer Existing Standard Implemented in part of solutions

Security Standards for WS XML XML Signature (W3C) XML Encryption (W3C) SOAP WS-Addressing (W3C) WS-Security (OASIS) Resource Trust Secure Context Policy SAML Kerberos REL X.509 WS-SecureConversation (IBM) XACML (OASIS) RBAC (NIST) EPAL (IBM) WS-Policy (W3C) WS-Security Policy (OASIS) WS-Trust (OASIS) XKMS (W3C) WS-Federation (IBM) IDFF Shibboleth Reliability WS-Reliable Messaging (OASIS) WS-Reliability (OASIS) U/P

Popular Solutions Microsoft WCF Sun Metro (JAX-WS + JAXB + WSIT) Apache Axis2 (Rampart + Rahas + Sandesha2) Apache CXF (based on JAX-WS) More: IBM WebSphere WSO2 Web Service Framework BEA WebLogic

Microsoft WCF XML XML Signature (W3C) XML Encryption (W3C) SOAP WS-Addressing (W3C) WS-Security (OASIS) Resource Trust Secure Context Policy SAML Kerberos REL X.509 WS-SecureConversation (IBM) XACML (OASIS) RBAC (NIST) EPAL (IBM) WS-Policy (W3C) WS-Security Policy (OASIS) WS-Trust (OASIS) XKMS (W3C) WS-Federation (IBM) IDFF Shibboleth Reliability WS-Reliable Messaging (OASIS) WS-Reliability (OASIS) U/P

Sun Metro XML XML Signature (W3C) XML Encryption (W3C) SOAP WS-Addressing (W3C) WS-Security (OASIS) Resource Trust Secure Context Policy SAML Kerberos REL X.509 WS-SecureConversation (IBM) XACML (OASIS) RBAC (NIST) EPAL (IBM) WS-Policy (W3C) WS-Security Policy (OASIS) WS-Trust (OASIS) XKMS (W3C) WS-Federation (IBM) IDFF Shibboleth Reliability WS-Reliable Messaging (OASIS) WS-Reliability (OASIS) U/P

Apache Axis2 XML XML Signature (W3C) XML Encryption (W3C) SOAP WS-Addressing (W3C) WS-Security (OASIS) Resource Trust Secure Context Policy SAML Kerberos REL X.509 WS-SecureConversation (IBM) XACML (OASIS) RBAC (NIST) EPAL (IBM) WS-Policy (W3C) WS-Security Policy (OASIS) WS-Trust (OASIS) XKMS (W3C) WS-Federation (IBM) IDFF Shibboleth Reliability WS-Reliable Messaging (OASIS) WS-Reliability (OASIS) U/P

Apache CXF XML XML Signature (W3C) XML Encryption (W3C) SOAP WS-Addressing (W3C) WS-Security (OASIS) Resource Trust Secure Context Policy SAML Kerberos REL X.509 WS-SecureConversation (IBM) XACML (OASIS) RBAC (NIST) EPAL (IBM) WS-Policy (W3C) WS-Security Policy (OASIS) WS-Trust (OASIS) XKMS (W3C) WS-Federation (IBM) IDFF Shibboleth Reliability WS-Reliable Messaging (OASIS) WS-Reliability (OASIS) U/P

Common WS-* Stack WS-Addressing WS-Security: Username/Password, SAML, X.509 SAML includes XML Encryption and XML Signature WS-Trust (except Apache CXF) WS-Security Policy (except Apache) WS-Policy (except Apache Axis2) WS-Secure Conversation (except Apache CXF) WS-Reliable Messaging

1-MS, 2-Sun, 3-Axis2, 4-CXF XML XML Signature XML Encryption SOAP WS-Addressing WS-Security Resource Trust Secure Context Policy SAML Kerberos (1,2) REL X.509 WS-SecureConversation (1,2,3) XACML RBAC EPAL WS-Policy (1,2,4) WS-Security Policy (1,2) WS-Trust (1,2,3) XKMS WS-Federation IDFF Shibboleth Reliability WS-Reliable Messaging WS-Reliability (2) U/P

GSI XML XML Signature (W3C) XML Encryption (W3C) SOAP WS-Addressing (W3C) WS-Security (OASIS) Resource Trust Secure Context Policy SAML Kerberos REL X.509 WS-SecureConversation (IBM) XACML (OASIS) RBAC (NIST) EPAL (IBM) WS-Policy (W3C) WS-Security Policy (OASIS) WS-Trust (OASIS) XKMS (W3C) WS-Federation (IBM) IDFF Shibboleth Reliability WS-Reliable Messaging (OASIS) WS-Reliability (OASIS) U/P