1. Prashanth Kumar Muthoju
WEB SERVICES SECURITY
Prashanth Kumar Muthoju

2. Agenda
Web Services
Web Services Security
Examples
WSE 2.0
DEMO
Q & A

3. Web Service ?
1. A Web Service is a software component that is described via WSDL and is capable of being accessed via standard network protocols such as but not limited to SOAP over HTTP.
2. A Web service is an application that:
Runs on a Web server
Exposes Web methods to interested callers
Listens for HTTP requests representing commands to invoke Web methods
Executes Web methods and returns the results
-for more info…
What web services can do for you (video presentation):

4. Web Services In a Nutshell
Transport (TCP/IP, UDP,…)
Transfer (HTTP, SMTP, …. )
XML + Namespaces
+ Information Set
SOAP WS
Routing
Referral
Security
XML Schema
RDF?, DAML?...
Subscribe
Search
Register
WSCI
BPEL4WS
WSDL
WS messaging
WS descriptions
WS discovery
Envelope (MIME, DIME, BEEP, …. )
Canonical XML
XML Encryption
XML Signature
WS Coordination
WS Transaction
UDDI
WS-Inspection
SAML
License

5. Web Services As usage grows, need for Security increases
Interoperability
Ease of consumption
Use of Standard protocols
As usage grows, need for Security increases

6. Web Services Security Authentication Protocol level Security
Message level Security

7. Authentication – types:
Direct
Brokered

8. Message Protection: Data Confidentiality:
Encryption
Keys
Preventing a hacker from manipulating messages in transit
Data Origin Authentication:
Data Integrity – data tampered?
Authenticity – is it from original sender?

9. XML messages convey security information
Credentials
Digital signatures
Messages can be encrypted
Client
Transport
Service
Any Transport
XML
Security is independent from transport protocol

10. Protocol Level Security:
Security implemented in protocol itself
SSL

11. Web Services Enhancements (WSE 2.0):
It is a supported add-on for Microsoft VS.NET and .NET framework
Provides advanced Web Service capabillities
Download at
For easy development of secure web services according to specifications by Microsoft

12. WS-* Specifications:

13. Security Specification:
WS-Security: SOAP Message Security
WS-Security: UsernameToken Profile
WS-Security: X.509 Certificate Token Profile
WS-SecureConversation
WS-SecurityPolicy
WS-Trust
WS-Federation
WS-Federation Active Requestor Profile
WS-Federation Passive Requestor Profile
WS-Security: Kerberos Binding
Web Single Sign-On Interoperability Profile
Web Single Sign-On Metadata Exchange Protocol   
More info:

14. Username Tokens: Simple method of conveying username
Password is used to generate a secret key for signing and encrypting
Password can be sent as plaintext or digest
Digest uses timestamp value valid within a time window
WSE provides built-in replay detection mechanism
WSE automatically creates Windows Principal for plain-text passwords

15. DEMO Web Service Security using:
1. Windows Integrated Authentication
2. Windows Basic Authentication
3. SOAP header based authentication
Using WSE 2.0:
Using Username Tokens
Using Kerberos Tokens (only code)

16. CONCLUSION:
With use of Enhanced add-ons like WSE, .NET can provide more secure web services.

17. REFERENCES:
Wrox: Beginning ASP.NET

18. Q & A

19. Thank you !