# Presentation: 823974

## Web Services and E-Authentication

- Adele Marsh, AES
- Charlie Miller, RIHEAA

***Session 35***

## Web Services

- Web applications that use programmatic interfaces for application to application communications.  Data is usually collected from multiple servers and presented in a comprehensive view.
- Most definitions include these technologies:
- Extensible Markup Language (XML)
- Simple Object Access Protocol (SOAP)
- Web Services Description Language (WSDL)
- Universal Description Discovery Interface (UDDI)

## Web Services

- Using web services for basic system integration and XML interfaces is relatively stable
- Largest concern today is on securing web services

## Security Requirements

- Three capabilities must exist for secure web services:
- Secure Credential Transfer
- Ensure Message Integrity
- Ensure Message Confidentiality

## SOAP and Security

- SOAP is simply a standard for sending messages over HTTP using XML
- The SOAP specification does not address security at all.
- SOAP contains no protocol limitations
- Can use HTTP or HTTPS
- Can use just about any known protocol

## Security Assertion Markup Language (SAML)

- SAML defines an XML framework for exchanging security information and attributes.
- SAML communicates this information in the form of Assertions.
- Assertions contain information about subjects (people or computers) which have an identity in the network.
- Assertions are issued by SAML authorities -  authentication authorities, attribute authorities, and policy decision points.

## SAML Assertions

- Authentication
- Previous authentication acts
- Assertions should not usually contain passwords
- Attributes
- Profile information
- Preference information
- Authorization
- Given the attributes, should access be allowed?

## Typical Assertion

**Issuer ID and issuance timestamp **
**Assertion ID **
**Subject **
**Name and security domain **
**Conditions under which the assertion is valid **
**Assertion validity period **
**Audience restrictions **
**Target restrictions (intended URLs for the assertion) **
**Application specific conditions**

## Securing SAML Assertions with XML Signatures

- The SAML assertion is signed by the entity that created it.
- When signed, all irrelevant white-space is removed.
- Once signed, the document may not be modified without invalidating the XML signature.

## Planning an Implementation

- When planning your own Web Services:
- Gain a detailed understanding of the potential risks (viruses, hackers, natural disasters).
- Make a proactive analysis of the consequences and countermeasures in relation to risks.
- Create an implementation strategy for integrating security measures into your enterprise network.

## Provide a flexible, easy to implement authentication system that meets the needs of your organization and your clients.

Ensure compliance with the Gramm-Leach-Bliley Act (GLBA), federal guidelines, and applicable state privacy laws.

- Ensure compliance with the Gramm-Leach-Bliley Act (GLBA), federal guidelines, and applicable state privacy laws.

- E-Authentication Objectives

## Assure data owners that only appropriately authenticated end users have access to data.

Ensure compliance to internal security and privacy guidelines.

- Ensure compliance to internal security and privacy guidelines.

- E-Authentication Objectives

## E-Authentication

- Worked with Shibboleth - Shibboleth, a project of Internet2/Mace, is developing architectures, policy structures, practical technologies, and an open source implementation to support inter-institutional sharing of web resources subject to access controls. In addition, Shibboleth will develop a policy framework that will allow inter-operation within the higher education community.
- Shibboleth project participants include Brown University, Ohio State, Penn State and many other colleges and universities.

## User must be required to provide an ID and a shared secret. 
Assignment and delivery of shared secret must be secure.
Assignment of shared secret is based on validated information.
Reasonable assurances that the storage of the IDs shared secrets are secure.

- Assignment and delivery of shared secret must be secure.
- Assignment of shared secret is based on validated information.
- Reasonable assurances that the storage of the IDs shared secrets are secure.

- Requirements for Secure e-Authentication

## Evaluating E-Authentication Policies

- A central authority must exist for evaluating network participants E-Authentication Policies
- Participants must ensure appropriate authentication for each end user
- Participants must provide authentication policy to central authority
- Participants must provide central authority with 30 day advance notice of changes to authentication policy

## Evaluating E-Authentication Policies

- Participants must agree to appropriate use of data
- Once accepted, participant is added to a Central Registry of all valid network participants.
- Additional requirements may be defined in current or future State or Federal Legislation.
- Additional requirements may be imposed by Central Authority.

## End user authenticates at member site
Member creates authentication assertion (SAML)
Member signs authentication assertion with digital certificate (XML Signature)
Control is passed to partner site

- Member creates authentication assertion (SAML)
- Member signs authentication assertion with digital certificate (XML Signature)
- Control is passed to partner site

- Secure E-Authentication Process

## Partner site verifies assertion using the member’s public key stored in the registry.

End user is provided access to appropriate web service

- End user is provided access to appropriate web service

- E-Authentication Process

## What is Meteor?

- Web-based universal access channel for financial aid information
- Aggregated information to assist the FAP with counseling borrowers and with the aid process in general
- Collaborative effort
- A gift to schools and borrowers

## The Meteor Process

- One

- Two

- Access Providers

- Data Providers

- Financial Aid Professional/Student

- Three

- Index Providers

## How does Meteor Work?

- Meteor uses the concepts of **Access Providers,  Data Providers **and** Index Providers**.
- A Meteor **Access Provider** allows inquirers to obtain information through its web site by hosting a copy of the Meteor software, which generates the request to the Data Providers for the borrower’s information.
**Access providers can be Schools, Guarantors, Lenders, Servicers, or Secondary Markets.**

## Current Access Providers

- AES/PHEAA
- EAC
- Connecticut
- Florida
- KHEAA
- Montana
- NELA
- Rhode Island
- SLMA
- TGSLC

## How does Meteor Work?

- A Meteor **Data Provider** hosts a copy of the Meteor software that enables them to respond to the Access Provider’s request for information, supplying data from their system.
**Data Providers are typically Lenders, Servicers, Guarantors, and Secondary Markets.**
- In the future, the Dept. of ED, State Grant authorities, Schools, and others could become Data Providers.

## Current Data Providers

- AES/PHEAA
- Arkansas
- Connecticut
- EAC
- Florida
- Georgia
- Great Lakes
- Illinois (Default Information)
- Kentucky
- Louisiana
- Maine

- Michigan
- Montana
- NELA
- New Mexico
- North Dakota
- Oklahoma
- Rhode Island
- Sallie Mae
- Texas
- USAF

## How does Meteor Work?

- A Meteor **Index Provider** is used to identify the location(s) of the requested student/borrower information.
- The current Meteor Index Provider is the** National Student Clearinghouse**
- In the future, other indices will be added based on the type of data to be incorporated into the network.

## Each participant will be required to register, sign a participation agreement, and submit policies and procedures surrounding their authentication process.

- Registry

## Registry

- Meteor uses a centralized LDAP server to contain:
- Public keys of all participants
- Network status information (active, pending, suspended)
- Contact Information

## Role of end user

Social Security Number

Authentication Process ID

Level of Assurance

Opaque ID

- Social Security Number
- Authentication Process ID
- Level of Assurance
- Opaque ID

- Additional Assertion Attributes

## Authentication

- Each Access Provider uses their existing authentication model (single sign-on)
- Level of assurance assigned at registration
- Level 0 (Unique ID)
- Level 1 (Unique ID & 1 piece of validated public data)
- Level 2 (Unique ID & 2 pieces of validated public data)
- Level 3 (Unique/User ID & shared secret)

## Meteor Security

- All security in Meteor is through the use of  industry standard technologies.
- Centralized registry
- SAML
- XML Signatures
- SSL

## Encryption

- Meteor does not use XML Encryption
- The Specification was not available when we began development
- Plan to move to this as the technology matures
- Currently all communication is over SSL

## Meteor Security Requirements

- Three capabilities must exist for secure web services:
- Credential Transfer
**SAML Assertions**
- Message Integrity
**XML Signatures and SSL**
- Message Confidentiality
**SSL**

##    Building Trust and Integrity

- The Meteor Advisory Team sought input and expertise regarding privacy and security from the sponsoring organizations and the NCHELP Legal Committee.
- Analysis was provided in relation to GLB and individual state privacy laws.
- The analysis revealed that Meteor complied with both GLB and known state privacy provisions.

## Meteor Screens

## FAA Screens

## Slide 36

## Slide 37

## Slide 38

## Slide 39

## Slide 40

## Slide 41

## Slide 42

## Slide 43

## Slide 44

## Slide 45

## Slide 46

## Slide 47

## Slide 48

## Student/Borrower Screens

## Slide 50

## Slide 51

## Slide 52

## Slide 53

## Slide 54

## Slide 55

## Slide 56

## Slide 57

## Slide 58

## Technical Assistance

- We appreciate your feedback and comments.
-     We can be reached:
- 	**Adele Marsh**
**	****	****Phone:  717-720-2711**
**	****	****Email:  amarsh@aessuccess.org**
- 	**Charlie Miller**
**	****	****Phone:  401-736-1175**
**	****	****Email:  cmiller@riheaa.org**