Enabling Interoperable Secure Web Services Bret Hartman Data

Enabling Interoperable Secure Web Services Bret Hartman, Data. Power Technology 1 July, 2004

THE CONTEXT Businesses need to innovate at an ever increasing pace Success requires broad interoperability 4 Within an enterprise 4 Between business partners 4 Across a heterogeneous set of platforms, applications and programming languages Internet technologies are assumed, interoperability is required 2

THE CONTEXT The shift to Web services is underway 4 An Internet-native distributed computing model based on XML standards has emerged 4 Early implementations are solving problems today and generating new requirements 4 The Web services standards stack is increasing in size and complexity to meet these requirements The fundamental characteristic of Web services is interoperability 3

WHAT IS NEEDED? Guidance 4 A common definition for Web services 4 Implementation guidance and support for Web services adoption Interoperability 4 Across platforms, applications, and languages 4 Consistent, reliable interoperability between Web services technologies from multiple vendors 4 A standards integrator to help Web services advance in a structured, coherent manner 4

ABOUT WS-I An open industry effort chartered to promote Web Services interoperability across platforms, applications and programming languages. A standards integrator to help Web services advance in a structured, coherent manner Approximately 150 member organizations 470% vendors, 30% end-user organizations 480% North America with active worldwide membership 5

WS-I GOALS Achieve Web services interoperability 4 Integrate specifications 4 Promote consistent implementations 4 Provide a visible representation of conformance § Accelerate Web services deployment 4 Offer implementation guidance and best practices 4 Deliver tools and sample applications 4 Provide a implementer’s forum where developers can collaborate § Encourage Web services adoption 4 Build industry consensus to reduce early adopter risks 4 Provide a forum for end users to communicate requirements 4 Raise awareness of customer business requirements 6

WORKING GROUPS Basic Profile 4 Addresses the core set of specifications (e. g. , SOAP, WSDL, UDDI, attachments, etc. ) that provide the foundation for Web services Basic Security Profile (New!) 4 Addresses transport security, SOAP messaging security, and other security considerations Requirements Gathering 4 Captures business requirements to drive future profile selection Sample Applications 4 Illustrate best practices for implementations on multiple vendor platforms Testing Tools and Materials 4 Develops self-administered tests to very conformance with WS-I profiles 7

WS-I, STANDARDS AND INDUSTRY Standards Specifications Requirements Implementation Guidance Requirements Businesses, Industry Consortia, Developers, End Users 8

MILESTONES Basic Profile 1. 0 Package 4 Delivered Basic Profile 1. 0, and associated sample applications and test tools as Final Material 4 More than 200 interoperability issues resolved in Basic Profile 1. 0 4 Conventions around messaging, description and discovery 4 Vendors are incorporating the Basic Profile 1. 0 into products and services 4 End-users are requiring conformance 9

CURRENT WORK: BASIC PROFILES Basic Profile 1. 1 4 Derived from the Basic Profile 1. 0 incorporating any errata to date and separating out requirements related to the serialization of envelopes and their representation in messages Attachments Profile 1. 0 4 Complements Basic Profile 1. 1 to add support for interoperable SOAP messages with attachments Simple SOAP Binding Profile 1. 0 4 Derived from those Basic Profile 1. 0 requirements related to the serialization of the envelope and its representation in the message, incorporating any errata to date Board Approval Drafts of these profiles were delivered June 3 10

CURRENT WORK: BASIC SECURITY PROFILE Security Scenarios 4 Identifies security challenges and threats in building interoperable Web services and countermeasures for these risks Basic Security Profile 4 Addresses transport security, SOAP messaging security and other security considerations 4 References existing specifications used to provide security, including the OASIS Web Services Security 1. 0 specification 4 HTTP over TLS 4 SOAP with Attachments 4 WS-Security with Username and X. 509 token profiles 4 SAML Token Profile and REL (XRML) Token Profile are being considered 11

SECURITY SCENARIOS WORKING DRAFT Addresses 4 Security Challenges 4 Threats 4 Security Solutions and Mechanisms 4 Scenarios February, 2004 draft for public comment 4 http: //ws-i. org/Profiles/Basic. Security/2004 -02/Security. Scenarios-0. 15 WGD. pdf Final Security Scenarios expected in August, 2004 12

SECURITY CHALLENGES Peer Identification and Authentication Data Origin Identification and Authentication Data Integrity 4 Transport Data Integrity 4 SOAP Message Integrity Data Confidentiality 4 Transport Data Confidentiality 4 SOAP Message Confidentiality Message Uniqueness Out of Scope 4 Credentials Issuance 13

THREATS 14 Message alteration Attachment alteration Confidentiality Falsified messages Man in the middle Principal spoofing Repudiation Forged claims Replay of message parts Replay Denial of service - amplifier

SECURITY SOLUTIONS AND MECHANISMS Integrity, confidentiality, authentication, attributes Transport layer (HTTP/HTTPS) 4 HTTP and SSL/TLS mechanisms Message layer 4 WSS mechanisms 4 Securing SOAP with Attachments Combinations 4 Large number of theoretically possible combinations 4 Identified nine believed to be of practical utility Security considerations 4 Properties, threats addressed, limitations 15

SCENARIOS Generic requirements 4 Peer authentication 4 Integrity 4 Confidentiality 4 Origin authentication Scenario descriptions 4 One-way 4 Synchronous request / response 4 Basic callback 4 Others? 16

WS-I BASIC SECURITY PROFILE (BSP) 1. 0 Methodology 4 Reviewed WSS Documents (WSS core, username, X. 509) 4 Comments to WSS TC 4 Generated potential profiling points (captured as issues) 4 Reviewed underlying documents 4 IETF RFCs covering TLS 4 XML Signature, XML Encryption Identified 90+ potential profiling points by looking for anything other than MUST (e. g. options in specifications) 4 Many have since been dropped First public Working Draft published May, 2004 4 http: //ws-i. org/Profiles/Basic. Security. Profile-1. 0 -2004 -05 -12. html Final BSP expected in September, 2004 17

BSP 1. 0 QUESTIONS AND ANSWERS Cover SSL? 4 Yes, mentioned in WS-I Basic Profile 1. 0 Address SOAP intermediaries? 4 Yes, must be considered because of security implications What will document look like? 4 Identify constraints by category, as in Basic Profile If and how to handle security considerations? 4 Added security considerations section even though it is not testable One profile or several? 4 BSP 1. 0 will be one document 4 Subsequent token profiles can be published separately How to secure Attachment Profile 1. 0? 4 Decided to use WSS and to request OASIS TC to do this work 18

EXAMPLE REQUIREMENT 4. Transport Layer Security This section of the Profile incorporates the following specifications by reference, and defines extensibility points within them: 4 HTTP over TLS Extensibility points: 4 E 0001 - Ciphersuites - Additional ciphersuites may be specified. 4. 1 SSL and TLS The following specifications (or sections thereof) are referred to in this section of the Profile; HTTP over TLS: Section 2. 2. 1 SSL and TLS are both used as underlying protocols for HTTP/S. This profile places the following constraints on those protocols: 4. 1. 1 Use of SSL 2. 0 has known security issues and all current implementations of HTTP/S support more recent protocols. Therefore this profile prohibits use of SSL 2. 0. R 2001 A SENDER MUST NOT use SSL 2. 0 as the underlying protocol for HTTP/S R 2002 A RECEIVER MUST NOT use SSL 2. 0 as the underlying protocol for HTTP/S 19

OTHER BSP 1. 0 DELIVERABLES scenarios and sample use cases usage scenarios applications web services profile basic security profile testing tools and materials 20 testing tools other test materials sample applications

TESTING AND DEMONSTRATING BSP 1. 0 How to test Basic Security Profile 1. 0? 4 Basic Profile 1. 0 testing tools used a man in the middle testing strategy 4 Will this work for BSP 1. 0 since one of its objectives is to stop man in the middle attacks? 4 What level does the testing take place at? 4 Highest level message syntax? 4 After parts of the message have been decrypted? BSP sample applications and usage scenarios 4 Based on sample application for Basic Profile 1. 0 adding security aspects 21

FUTURE WORK PLANS Additional token profiles 4 Candidates include Kerberos, REL (XRML), SAML 4 Depends on progress by OASIS TC 4 Final material ETA: November, 2004 22

QUESTIONS Today Later 4 E-mail bhartman@datapower. com Comments on BSP documents 4 E-mail wsi_secprofile_comment@lists. ws-i. org Security Scenarios published February, 2004 4 http: //ws-i. org/Profiles/Basic. Security/2004 -02/Security. Scenarios-0. 15 WGD. pdf BSP 1. 0 WD published May, 2004 4 http: //ws-i. org/Profiles/Basic. Security. Profile-1. 0 -2004 -05 -12. html Thanks to Paul Cotton, chair of WS-I Basic Security Profile Working Group for much of the material in this presentation! 24