Web Services Security INFOSYS 290, Section 3 Web Services: Concepts, Design and Implementation Adam Blum

Agenda Security Issues with Web Services WS-Security –XML Signature –XML Encryption Tool Support

Security Issues Addressed by WS-Security Identity –Authentication –Authorization Integrity Confidentiality

Terms Proof-of-possession – data to demonstrate knowledge by sender that should only be known by claimed sender Integrity – process to guarantee no modification in transit Confidentiality - process by which data is protected such that only authorized actors can view data Digest - cryptographic checksum of content Signature - binding of proof of possession and digest

Message with Token Zoe

…a Digital Signature LyLsF0Pi4wPU... DJbchm5gK...

…and a Body – QQQ –

Identity

Message Security Model Security tokens - assert claims Signatures –Provide mechanism for proving sender’s knowledge of key –Associate signature with claims in the security token Endorsed Claims –Represented as security tokens signed by a trusted authority –X.509 certificate claims a binding between one’s identity and a public key Unendorsed claims –Can be trusted if there is trust relationship between sender and receiver –Proof of possession claim – e.g. username/password

Username Token Example... ablum lauren......

Security Tokens Binary Security Tokens MIIEZzCCA9CgAwIBAgIQEmtJZc or X509 (note that there is thus no guarantee of interoperability) Security Token References

Integrity

Signatures determine whether a message was altered in transit Verify that message was sent by possessor of particular security token

XML Signature ( ( )? )+ ( )? ( )*

CanonicalizationMethod A way to guarantee that two equivalent bits of XML are represented the same so that they can be signed Algorithms used for this Identifier for REQUIRED Canonical XML (omits comments): – Identifier for Canonical XML with Comments: – An example of an XML canonicalization element is:

SignatureMethod Algorithm used to create digital signature Required –Secure Hash Algorithm-1 with Digital Signature Algorithm

Reference Element Digest algorithm Digest value Optional identifier of object being signed Optional transforms applied prior to digesting With SOAP –Signed parts of SOAP message –Base64-encoded –SHA1 algorithm

Elements Outside SignedInfo SignatureValue –Base64 encoded bytes making up digital signature KeyInfo –Indicates what key should be used to validate signature –Can be embedded, referenced or left out entirely

Signature Example [s02] [s10] j6lwx3rvEPO0vKtMup4NbeVu8nk= MC0CFFrVLtRlk=... [s15c]

Confidentiality

Encryption Components xenc:ReferenceList –Manifest of encrypted elements in message xenc:EncryptedData –Contains encrypted elements

Encryption Example (Shared Secret) CN=Hiroshi Maruyama, C=JP...

Encrypting Keys Encrypt elements with key Encrypt key with recipient’s key Embed in header E.g. encrypting with randomly generated symmetric key that is encrypted with recipients public key

Encrypting with Encrypted Key CN=Hiroshi Maruyama, C=JP... /wsse:Security> CN=Hiroshi Maruyama, C=JP...

WS-Security Specs WS-Security – 128.ibm.com/developerworks/webservices/libr ary/ws-secure/ 128.ibm.com/developerworks/webservices/libr ary/ws-secure/ XML Signature –

Microsoft WSE 3.0 Turnkey Security Scenarios –Username over Transport –Username over Certificate –Anonymous over Certificate –Mutual Certificate –Kerberos (Windows)

WSE 3.0 Named Policies [WebService(Namespace = " [Policy("ServerPolicy")] public class WSSecurityUsernameService : System.Web.Services.WebService { – public WSSecurityUsernameService() { } –[WebMethod] public List StockQuoteRequest([XmlArray(), XmlArrayItem("Symbol"] string[] symbols) { // Business logic here –} }