1. Web Services Security INFOSYS 290, Section 3 Web Services: Concepts, Design and Implementation Adam Blum ablum@good.com

2. Agenda Security Issues with Web Services WS-Security –XML Signature –XML Encryption Tool Support

3. Security Issues Addressed by WS-Security Identity –Authentication –Authorization Integrity Confidentiality

4. Terms Proof-of-possession – data to demonstrate knowledge by sender that should only be known by claimed sender Integrity – process to guarantee no modification in transit Confidentiality - process by which data is protected such that only authorized actors can view data Digest - cryptographic checksum of content Signature - binding of proof of possession and digest

5. Message with Token Zoe

6. …a Digital Signature LyLsF0Pi4wPU... DJbchm5gK...

7. …and a Body – QQQ –

8. Identity

9. Message Security Model Security tokens - assert claims Signatures –Provide mechanism for proving sender’s knowledge of key –Associate signature with claims in the security token Endorsed Claims –Represented as security tokens signed by a trusted authority –X.509 certificate claims a binding between one’s identity and a public key Unendorsed claims –Can be trusted if there is trust relationship between sender and receiver –Proof of possession claim – e.g. username/password

10. Username Token Example... ablum lauren......

11. Security Tokens Binary Security Tokens MIIEZzCCA9CgAwIBAgIQEmtJZc0... - or X509 (note that there is thus no guarantee of interoperability) Security Token References

12. Integrity

13. Signatures determine whether a message was altered in transit Verify that message was sent by possessor of particular security token

14. XML Signature ( ( )? )+ ( )? ( )*

15. CanonicalizationMethod A way to guarantee that two equivalent bits of XML are represented the same so that they can be signed Algorithms used for this Identifier for REQUIRED Canonical XML (omits comments): –http://www.w3.org/TR/2001/REC-xml-c14n-20010315http://www.w3.org/TR/2001/REC-xml-c14n-20010315 Identifier for Canonical XML with Comments: –http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithCommentshttp://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments An example of an XML canonicalization element is:

16. SignatureMethod Algorithm used to create digital signature Required –Secure Hash Algorithm-1 with Digital Signature Algorithm

17. Reference Element Digest algorithm Digest value Optional identifier of object being signed Optional transforms applied prior to digesting With SOAP –Signed parts of SOAP message –Base64-encoded –SHA1 algorithm

18. Elements Outside SignedInfo SignatureValue –Base64 encoded bytes making up digital signature KeyInfo –Indicates what key should be used to validate signature –Can be embedded, referenced or left out entirely

19. Signature Example [s02] [s10] j6lwx3rvEPO0vKtMup4NbeVu8nk= MC0CFFrVLtRlk=... [s15c]............

21. Confidentiality

22. Encryption Components xenc:ReferenceList –Manifest of encrypted elements in message xenc:EncryptedData –Contains encrypted elements

23. Encryption Example (Shared Secret) CN=Hiroshi Maruyama, C=JP...

24. Encrypting Keys Encrypt elements with key Encrypt key with recipient’s key Embed in header E.g. encrypting with randomly generated symmetric key that is encrypted with recipients public key

25. Encrypting with Encrypted Key CN=Hiroshi Maruyama, C=JP... /wsse:Security> CN=Hiroshi Maruyama, C=JP...

27. WS-Security Specs WS-Security –http://www- 128.ibm.com/developerworks/webservices/libr ary/ws-secure/http://www- 128.ibm.com/developerworks/webservices/libr ary/ws-secure/ XML Signature –http://www.w3.org/TR/xmldsig-core/http://www.w3.org/TR/xmldsig-core/

28. Microsoft WSE 3.0 Turnkey Security Scenarios –Username over Transport –Username over Certificate –Anonymous over Certificate –Mutual Certificate –Kerberos (Windows)

29. WSE 3.0 Named Policies [WebService(Namespace = "http://stockservice.contoso.com/wse/samples/2005/10")] [Policy("ServerPolicy")] public class WSSecurityUsernameService : System.Web.Services.WebService { – public WSSecurityUsernameService() { } –[WebMethod] public List StockQuoteRequest([XmlArray(), XmlArrayItem("Symbol"] string[] symbols) { // Business logic here –} }