Web Services Security Challenges Trends Magan

Web Services Security – Challenges & Trends Magan Pal Singh Technical Architect, Sopra Group mpsingh@in. sopragroup. com - www. sopragroup. com +91 120 4056100 Unissons nos Talents TALENTED TOGETHER 1

Agenda n Web Services Introduction n Web Services Security Elements n Web Services Security Dimensions n Web Services Security Standards n Threats Facing Web Services n Threats Mitigation 2

Web Services Introduction n Increasingly becoming SOA implementation of choice n Distributed stand alone services n n n Platform independence Heterogeneous environments and technologies Spread across geographies n Publicly published interfaces – Service Contract n Discoverable universally – UDDI Rate Service 1 UDDI 2 Loan Service 3 3

Web Services Introduction n Web services Messaging – SOAP Web Portal End User 1 6 Loan Service 2 3 Rate Service 4 5 Credit Service 4

Web Services Introduction n Web Services Coordination n n Orchestration – Within the Organization (BPEL) Choreography – Between Organizations Loan Service Credit Bureau Service Rate Service Internal Rate Service 1 Credit Service Federal Rate Service Internal Rate Service 2 Internal Rate Service 3 5

Web Services Security Elements Applications must be secure and reliable to truly meet SOA goals n Web Services rely on HTTP and common web based architecture n Key security elements are: n n n Identification and Authentication Verification of Identity of the requestor service Authorization Ascertaining the authority of the requestor service to access the resources Integrity Ensuring that un-authorized alterations do not happen to the data, while in transit, processing or storage Non-repudiation The provider is able to ascertain the identity of the requestor and gets the proof of the delivery from requestor Confidentiality Preserving authorized access and disclosure of sensitive information; e. g. personal or proprietary information Privacy Restricting the resources access in accordance to the organization policy or Federal laws 6

Web Services Security Dimensions n Security dimensions encompass the security elements n Each dimension affects a different layer of web service n Five Security Dimensions n n n Secure Messaging SOAP messages traversing over networks are not viewed/ modified by attackers Protecting Resources Ensure that individual web service is adequately protected through appropriate identification, authentication and access control mechanism Negotiation of Contracts Web services should be capable of negotiating the business contracts as well as Qo. P and Qo. S Trust Relationships Entities involved in a business transaction must trust each other Security Properties Ensure effective enforcement of service policy, security policy and availability of services 7

Web Services Security Standards Dimension Requirement Confidentiality & Integrity Messaging Specifications WS-Security SSL/ TLS Authentication WS Security Tokens SSL/TLS X. 509 Certificates Authorization XACML Xr. ML Resource RBAC, ABAC Privacy EPAL XACML Accountability None Registries UDDI eb. XML Negotiation Semantic Discovery SWSA OWL-S Business Contract eb. XML 8

Web Services Security Standards Dimension Requirement Establishment Specifications WS-Trust XKMS X. 509 Trust Proxying SAML WS-Trust Federation WS-Federation Liberty IDFF Shibboleth Policy Security Properties WS-Policy Security Policy WS-Security. Policy Reliability WS-Reliable. Messaging WS-Reliability 9

Threats Facing Web Services n Message Alteration Un-authorized insertion/ deletion/ modification of information in message in transit to deceive the receiver n Loss of Confidentiality Un-authorized discloser of message information to un-intended recipient n Falsified Messages Fictitious messages that are intended to make the receiver to believe are sent by valid sender n Man in the Middle Un-authorized interception and forwarding of message to third party n Principal Spoofing Malicious message that is constructed with credentials that appear to be from a different, authorized principal n Forged Claims Message created with false credentials that appear to be valid to the receiver n Replay of Messages Attacker resends a previously sent message n Replay of Message Parts Attacker includes part of previously sent message(s) in a new message n Denial of Service Attacker causes the system to expand its resources disproportionately so that valid requests can not be honored 10

Threats Mitigation n W 3 C XML Encryption Used to encrypt and provide confidentiality of part or all of SOAP message n W 3 C XML Signature Used to digitally sign the SOAP message and provide message integrity and senders authentication n WS Security Tokens Used to include senders credentials to aid the receiver to authenticate the sender n User Name/ Password n OASIS SAML Assertion n IETF X. 509 certificate n ISO Rights Expression Language n W 3 C WS-Addressing IDs Allows message sender to supply a unique identifier for each message n IETF SSL/TLS Secures HTTP protocol that is used to exchange SOAP messages n SSL/TLS with client authentication n n Both sender and receiver should authenticate each other before securing HTTP protocol IETF HTTP authentication Allows user name and password or password digest to be sent as part of HTTP header 11

Threats Mitigation Threats Addressed By Current Web Services Standards Forged Claims Replay of Message Part X X X X WS-Security Tokens X X WS-Addressing Denial of Service Principal Spoofing X X Replay of Message Man in the Middle Falsified Message Loss of Confidentiality Message Alteration XML Signature X X XML Encryption X X SSL/ TLS X X X* X* X SSL/ TLS with Client Certificates X X X X X HTTP Authentication X 12

Conclusions n Variety of specifications and standards available – Mostly developed by individual/ group of organizations n Specifications contradict to each other n Certain areas of concern, like Contract Negotiation and Trust Management etc, are still not addressed fairly n Web Services standards organizations like OASIS and W 3 C are working to standardize the specifications n Coordinated effort and research is needed to define commonly acceptable specifications and to provide their implementations 13

Q&A 14

Thank You 15