Web Services Security Requirements Stephen T. Whitlock Security Architect Boeing
Outline Disclaimer n n Requirements are from a user perspective to cover the use of web services in our environment Some of these requirements are met by existing technologies Requirements n n n WS data/transaction/orchestration Infrastructure General Examples
WS Transaction/Orchestration Protection Requirements Data protection n Integrity Confidentiality Privacy support Attack resistant to n n n Replay attacks Person in the middle attacks Orchestration hijacking Evidence to support non-repudiation n Signature Timestamp Audit trail
Infrastructure Protection Requirements Transport n n Integrity Confidentiality Authentication n Multiple mechanisms – certificates, shared secrets, Kerberos/AD Application authentication User authentication Access control n n Multiple mechanisms – RBAC, directory based Credential propagation Credential caching Transaction level granularity – resource or application access authorized separately from individual transaction authorization
More Infrastructure Protection Requirements Resource protection n Server and network isolation Server resource control Network bandwidth control Centralized n n n Policy administration Provisioning Access control Auditing Monitoring
General Requirements User transparent (AMAP) Standards based n n n Vendor neutral Interoperable – no proprietary value-added extensions IPR Free Compatible with existing security technology n n n VPNs – IPSec, TLS PKI LDAP Performance n n n Support for real time applications Reliable Redundancy Extensible Development environment that enables and promotes the creation of secure web services
Future Requirements Secure context passing between different web services Pass a security context through an integration broker including support for: n n End to end access The ability to switch between environments such as J 2 EE and. NET
Example 1: Web Single Sign On (WSSO) based end to end security WSSO accepts user credentials n n Account, password, X. 509 certificate Front end to multiple applications Using the same approach to provide web service to web service application security
WSSO – Desired Service Requesting web service 1. Client request 2. Application request 3. Service response 2 Service 1 3
WSSO – Needed Security Requesting web service Application authentication User authentication Enterprise protection Confidentiality Message integrity Audit trail Signature Service protection Access control 2 Service 1 2
WSSO – Existing Security Requesting web service 5. Check for revocation 1. Client logon 2. Client request 3. Application certificate 8. Application request SSL/TLS Perimeter to protect application Authentication Service 7. Credential cache 9. Service response Validation Service 4. Authentication Request 2 Service 1 2 Directory 6. Directory attribute check
Example 2: Engineering Drawing Application (EDA) Supports engineering drawings and parts lists Total database size = 1. 5 TB, About 15 M documents, Average document size = 100 KB Query to retrieval time < 2 seconds Supports 1500 concurrent users, average of 1000 TPM, peak of 2000 TPM Currently undergoing an expansion and conversion to web services
EDA Architecture User Internet User Intranet L o a d B a l For SOAP objects HTTP Server Web Server EJB Container For web pages Other systems and data New Datastore Manager SOAP Messages Legacy Datastore
EDA Needed Security Enterprise protection Confidentiality User authentication Internet L o a d HTTP Server Web Server EJB Container B a l User authentication User Intranet Confidentiality Message integrity Audit trail Signature Service resource protection Access control New Datastore Other systems and data Datastore Manager Legacy Datastore Application authentication
EDA Existing Security User Internet User Intranet F i r e w a l l R e v P r o x y L o a d B a l HTTP Server Web Server EJB Container Directory based Authentication And access Control Service New Datastore Other systems and data Datastore Manager Legacy Datastore
Centralized Parts Inventory (CPI) Descriptions of parts Current parts stock level information Originally a collection of disparate web sites linked to different databases In the process of being converted to a centralized service that provides a common look and feel and navigation services
CPI Architecture Object Database Common Look And Feel Services Navigation Services Descriptions Access Rules Descr. Obj 1 Obj 2 … Access Rules Database Descr. Obj n Parts Descriptions Inventory Access Rules Inv. Obj 1 Obj 2 … Inv. Obj n Parts Inventory Status …
CPI Needed Security Enterprise protection User authentication User Authorization Object Database Common Look And Feel Services Navigation Services Descriptions Access Rules Descr. Obj 1 Obj 2 … Confidentiality Message integrity Audit trail Signature Application access control Access Rules Database Descr. Obj n Parts Descriptions Inventory Access Rules Inv. Obj 1 Obj 2 … Inv. Obj n Parts Inventory Status …
Directory and Certificate based Authentication And access Control Service CPI Existing Security Perimeter Services Object Database Common Look And Feel Services Navigation Services Descriptions Access Rules Descr. Obj 1 Obj 2 … Access Rules Database Descr. Obj n Parts Descriptions Inventory Access Rules Inv. Obj 1 Obj 2 … Inv. Obj n Parts Inventory Status …
Conclusions We need data protection for web services messages n SSL/TLS is insufficient because it only provides integrity at the packet level, not at the XML message level We need interoperable, multivendor solutions Security solutions need to integrate with existing security technologies Security solutions must work between enterprises as well as within them
Скачать презентацию Web Services Security Requirements Stephen T Whitlock Security
e40c3c47f7d869d2518e955b6f686b15.ppt