1. Security in ebXML Messaging CPP/CPA Elements

2. Elements of Security P rivacy –Protect against information being disclosed or revealed to any entity not authorized to have that information A uthentication –Authenticate the claimed identity of the originator of a data item A uthorization –Protect against the threat that unknown entities enter into a system and ensures that an entity performs only authorized actions within the system I ntegrity –Protect against the threat that the value of a data item might be changed in a way that is inconsistent with the recognized security policy N on-repudiation –Protect against one party to a transaction or communication later falsely denying that the transaction or communication occurred

3. Security and Computing Infrastructure Security can be applied to… –Transports (SSL, IPSEC) –Messages (S/MIME, PGP) –Systems

4. Interoperable Messaging: Complex stuff Transports Servers & ports Usernames & passwords Certificates & trust Algorithms & parameters Processing order Supported standards Acknowledgements Processing steps Transports Servers & ports Usernames & passwords Certificates & trust Algorithms & parameters Processing order Acknowledgements Processing steps Supported standards ?

5. Security Options The More Obvious Stuff –Encryption –Signatures –Non-repudiation The Less Obvious Stuff –Trust –Certificate lifecycle management –Certificate revocation

6. ebXML Delivery Channel Covers the Obvious Delivery Channel = Document Exchange Layer + Transport Layer Delivery Channel characteristics –nonrepudiationOfOrigin –nonredupiationOfReceipt –secureTransport –confidentiality –authenticated –authorized

7. How to Deal with the Less Obvious These are PKI issues that need to be addressed to facilitate interoperability The key to understanding these issues is an understanding of X.509 certificates –Creation –Issuance –Management

8. X.509 Certificate Anatomy

9. Certificate Issuance

10. Certificate Management Includes Key registration Key archive and recovery Centralized revocation information –CRLs –OCSP Certificate publication to a repository

11. Web Trust Model CA 1 2 3 Root CAs in trust store Intermediate CAs (when they exist) End-entities

12. Pulling it All Together: Certificate Path Validation Subject Public Key Subject = Peter Parker Issuer = Certification Authority B Certificate 1 Subject Public Key Subject = Certification Authority B Issuer = Certification Authority A Certificate 2 Subject Public Key Subject = Certification Authority A Issuer = Certification Authority A Certificate 3 Trusted Certificates Certificate