WS-SecureConversation

1. WS-SecureConversation Vidya Iyer 3/11/06

2. Web services

4. SecureConversation • End-to-end security • Leverages SSL, and Kerberos • Leverages XMLENC and XMLDSIG • Establishes contexts for convenient multi-message communication • Initial overhead to establish context, then faster communication

5. Terms • Security Token – security related information (ie. X.509 cert, Kerberos ticket, username) • Security Context – established authenticated state, and related keys • Security Context Token – URI representation of Security Context

6. Creating Secure Contexts

7. Changing contexts • Amending, Renewing, Cancel contexts • Requester sends Amend URI http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Amend • And proof of possession of key • Recipients authenticate request and update their context • Same for Renew, Cancel

8. Deriving keys • Common to use SecureContexts to agree on pseudorandom generators to derive keys • Uses DeriveKeyToken syntax • Syntax is agnostic to key derivation scheme • No need to send key material

9. Benefits over SSL • End-to-end security • XML aware • Selective encryption • Easier to nullify existing contexts

10. Questions?