1. Security in ebXML Messaging
CPP/CPA Elements

2. Elements of Security Privacy Authentication Authorization Integrity
Protect against information being disclosed or revealed to any entity not authorized to have that information
Authentication
Authenticate the claimed identity of the originator of a data item
Authorization
Protect against the threat that unknown entities enter into a system and ensures that an entity performs only authorized actions within the system
Integrity
Protect against the threat that the value of a data item might be changed in a way that is inconsistent with the recognized security policy
Non-repudiation
Protect against one party to a transaction or communication later falsely denying that the transaction or communication occurred

3. Security and Computing Infrastructure
Security can be applied to…
Transports (SSL, IPSEC)
Messages (S/MIME, PGP)
Systems

4. Interoperable Messaging: Complex stuff
Processing order
Transports
Certificates & trust
Servers & ports
Processing steps
Servers & ports
Acknowledgements ?
Algorithms & parameters
Usernames & passwords
Supported standards
Certificates & trust
Usernames & passwords
Processing order
Transports
Algorithms & parameters
Supported
Processing steps
standards
Acknowledgements

5. Security Options The More Obvious Stuff The Less Obvious Stuff
Encryption
Signatures
Non-repudiation
The Less Obvious Stuff
Trust
Certificate lifecycle management
Certificate revocation

6. ebXML Delivery Channel Covers the Obvious
Delivery Channel = Document Exchange Layer + Transport Layer
Delivery Channel characteristics
nonrepudiationOfOrigin
nonredupiationOfReceipt
secureTransport
confidentiality
authenticated
authorized

7. How to Deal with the Less Obvious
These are PKI issues that need to be addressed to facilitate interoperability
The key to understanding these issues is an understanding of X.509 certificates
Creation
Issuance
Management
X.509 Certificates – provide a standardized means for binding names and other critical information with public keys. This facilitates flexible and scalable management of public keys.
PKI – defines the computing infrastructure needed for effective use of public key cryptography. This basically helps define the role of a Certificate Authority (CA) that provides a centralized means for requesting, revoking, updating and publishing of X.509 certificates.

8. X.509 Certificate Anatomy

9. Certificate Issuance

10. Certificate Management Includes
Key registration
Key archive and recovery
Centralized revocation information
CRLs
OCSP
Certificate publication to a repository

11. Web Trust Model CA CA CA Root CAs in trust store Intermediate CAs2 3
Root CAs in trust store 1
Intermediate CAs
(when they exist)
End-entities

12. Pulling it All Together: Certificate Path Validation
Trusted Certificates
Certificate 1
Subject = Peter Parker
Subject Public Key
Certificate
Certificate 2
Issuer = Certification Authority B
Subject = Certification Authority B
Certificate
Subject Public Key
Certificate 3
Issuer = Certification Authority A
Subject = Certification Authority A
Subject Public Key
Issuer = Certification Authority A
Certificate
Certificate
Certificate