1. Web Services Security with WSE 2.0 Muhammad Saqib Ilyas muhammad.saqib@ineta.org

2. Speaker.Bio.ToString() Assistant Professor, N.E.D. University Country Leader, INETA Pakistan MVP IEEE Student Branch Counselor Secretary/Treasurer IEEE Communications Society, Karachi Chapter Member IEEE Karachi Section Executive Committee

3. Agenda Security Basics WSE 2.0 programming model Demos

4. Security Basics Encryption Asymmetric Symmetric Message Digest Digital Signature

5. Public key (asymmetric) Messages encrypted with private key, decrypted with public key Vice versa e.g., RSA, Diffie Hellman Confidentiality and authentication Computationally expensive

6. Symmetric Same key for encryption and decryption e.g., DES Share the key securely

7. Message digest Computes a value unique to a message Hashing Integrity

8. Digital signature Compute a message digest over a message Encrypt the message digest using private key Transmit signature with message Decrypt signature using public key

9. Securing web services Use lower layer security such as SSL Limitations

10. WSE 2.0 Provides support for WS-* standards Includes security Approximately 8 MB download http://msdn.microsoft.com/webservices/downloads/default.aspx http://msdn.microsoft.com/webservices/building/wse/

11. WSE 2.0 Architecture Input and output filters Proxy base class WebServicesClientProtocol SoapContext object records particular options: –Username token –Certificate Security token manager

12. WSE Programming Configured in web.config Using GUI tool Add reference to: –Microsoft.Web.Services2.dll Microsoft.Web.Services2 Microsoft.Web.Services2.Security Microsoft.Web.Services2.Security.Tokens

13. Specifications supported WS-Security WS-SecurityPolicy WS-SecureConversation WS-Trust WS-Referral WS-Addressing WS-Policy DIME (Direct Internet Message Encapsulation) WS-Attachments

14. Demo Implementing a SOAP extension Signing using username/password tokens Installing X.509 certificates Signing using X.509 certificates Encryption using multiple tokens

15. Links http://msdn.microsoft.com/webservices http://msaqib.blogspot.com http://www.saqibilyas.info http://www-128.ibm.com/developerworks/webservices/standards/