1 / 15

WS-Security Protocol

WS-Security Protocol. Ramkumar Chandrasekharan CS 265. Web Services (WS) . A service available over Internet Standard protocols: HTTP, SMTP, FTP Is based on XML messaging system SOAP (Simple Object Access Protocol), XML-RPC A WS should be self describing

apollo
Download Presentation

WS-Security Protocol

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. WS-Security Protocol Ramkumar Chandrasekharan CS 265

  2. Web Services (WS) • A service available over Internet Standard protocols: HTTP, SMTP, FTP • Is based on XML messaging system SOAP (Simple Object Access Protocol), XML-RPC • A WS should be self describing WSDL: Web Services Description Language • Discoverable UDDI: Universal Description Definition Interface

  3. Consuming a Web Service 1) Client discovers the WS from UDDI registry to which WS has published itself 2) Client retrieves the WSDL file pointed by UDDI 3) Client Creates SOAP packets with the appropriate Web Service calls 4) Invokes Web Service method over HTTP, SMTP etc 5) Response is received from the WS as a SOAP packet as well

  4. WS is not secure • XML messages over the network. Anybody can easily sniff and read the text. • Secure with SSL at transport layer but does not guarantee end to end security. SSL also encrypts everything which could be resource expensive. • Many ways of securing at message layer for WS is possible, WS-Security is a standard way of securing WS.

  5. WS-Security • WS-* Specs Standardizing various pieces of Web Service for e.g., Security, Policy, Messaging etc. • Various Standards Orgs (OASIS, W3C etc.) and corporations (IBM, MS, Verisign etc.) are involved

  6. WS-Security • SOAP header carries security info • XML Encryption standard is used for encryption • XML Signature standard is used for Digital Signature

  7. SOAP Security Header <soap:Envelope xmlns:soap=http://schemas.xmlsoap.ord/soap/envelope xmlns:wsse=”http://schemas.xmlsoap.ord/ws/2002/12/secext”> <soap:Header> <wsse:Security soap:role=”….”> All the security related mechanisms like security tokens, encryption and signatures goes here </wsse:Security>

  8. WS-Security Tokens • Authentication mechanisms: • UsernameToken Plaintext, Hashed (Base64 Encoding (SHA-1 (Nonce + Created + Password)) • Binarysecuritytoken based on Kerberos or X.509 certificates

  9. XML Encryption • Provides End to end security • Selective Encryption • Very simple to do, lets say if there is an XML doc for e.g.,

  10. XML before encryption: <?xml version=‘1.0’?> <CreditCard> <Name>John </Name> <Number> 1234567</Number> <Code>123</Code> <Expiry>0106</expiry> </CreditCard> XML After encryption <?xml version=‘1.0’?> <CreditCard> <Name>John </Name> <EncryptionData> <CipherData> <CipherValue> asdgsd45454 </CipherValue> </CipherData> </EncryptionData> </CreditCard XML Encryption

  11. XML Signature • Standard Schema for digital signature XML docs • Selective Signing of XML docs, that is portions of XML docs can be signed • Its not as simple as XML encryption

  12. XML Signature Schema • <Signature> <SignedInfo> <CanonicalizationMethod /> <SignatureMethod /> <Reference URI=“ “> (0 or more) <Transforms/> <DigestMethod/> <DigestValue/> </Reference> </SignedInfo> <SignatureValue /> - Digest of SignedInfo <KeyInfo/> (Optional) </Signature>

  13. WS-Security Demo Using WSE 2.0

  14. Conclusion • Web service is going to create revolution in distributed computing and with standards like WS-Security helps achieve security into Web Services. • With Web Services the vision of Vint Clif “father of the Internet’ could be achieved. He said “it wont be long before your bathroom scale surreptitiously transmits your weight to your doctor, who might command a stop to the rocky road ice cream your fridge automatically orders for you from www.groceries.com”.

  15. Q&A

More Related