# Presentation: 028572

## Security Services

- 						7/31/06

## Web Service Security Risks

**Unauthorized Access to Web Services**
**Unauthorized Information Flow**
**Vandalism and Sabotage**
**Theft and Fraud**
**Violation of Data Integrity**

**Notes:**
Unauthorized Access to Web Services:  This class of threat occurs when a user attempts to invoke a method in a Network Node for which the user has no authorization.  This often happens when a user only has authorization to Node A, but penetrates into Node B.
Unauthorized Information Flow:  This threat occurs when the flow of information between two nodes is not suitably restricted so as not to violate a prescribed set of flow policies or a partner agreement. For instance, a user may submit documents to the CDX Node using the Send interface, but the user may not be authorized to download documents from the CDX Node.  Unauthorized document flows from CDX Node to a user machine are considered dangerous.
Vandalism and Sabotage:  This class of threat is aimed at disrupting normal operation of Node services by destroying software or hardware on the Node server.
Theft and Fraud:  This threat is similar to an unauthorized information flow.  It is however, aimed at stealing other valuable information from a Network Node.  For example, user registration information, database tables, secret keys (private keys). 
Violation of Data Integrity:  This threat occurs when a user sends data or documents to a Network Node, but the data is tampered with while en route to its destination.  The Network Node receives either partial or falsified information as a result.

## Common Attacks

- Replay Attack: Messages intercepted and send back later
- Dictionary Attack: Use commonly used passwords to login a known account
- Message Insertion/Deletion: Compromise message integrity while in transition.
- Man in the Middle: Capture a request message, and replace it with something else.
- Denial of Service (DoS): disable services and prevent legitimate users from using the services

## Four Facets of Security

- Authentication: This provides assurance that the message actually originated at the source from which it claims to have originated.  **Is Bob really Bob?**
- Authorization: The process of granting access of a resource to a principal.  **Can Bob call the Query Method?**
- Confidentiality: it is important that messages are not visible to anyone except the two parties involved. This means traffic will need to be encrypted so that machines in the middle cannot read the messages.
- Message Integrity: This provides assurance that the message received has not been tampered with during transit.

## Security Definitions

**Secure Socket Layer (SSL/TLS):** specifies a mechanism for providing data security during transport.
- There are slight differences between SSL 3.0 and TLS 1.0, but the protocol remains substantially the same.
**Hyper Text Transport Protocol Secure (HTTPS):** This is HTTP using SSL. Using HTTPS in the URL instead of HTTP directs the message to a secure port number rather than the default Web port number of 80 (443).
**Public Key Infrastructure (PKI):** uses a pair of asymmetric digital keys to encrypt transmitted data.  The PKI model also involves certificate authorities issuing certificates with public asymmetric keys and authorities that assert properties other than key ownership (for example, attribute authorities).

**Notes:**
Secure Socket Layer (SSL): specifies a mechanism for providing data security layered between application protocols. It provides data encryption, server authentication, message integrity, and optional client authentication for a TCP/IP connection. The primary goal of SSL is to provide privacy and reliability between two communicating applications.
Public Key Infrastructure (PKI): uses a pair of asymmetric digital keys to encrypt transmitted data.  The PKI model also involves certificate authorities issuing certificates with public asymmetric keys and authorities that assert properties other than key ownership (for example, attribute authorities).  Owners of such certificates may use the associated keys to express a variety of claims, including identity.
Hyper Text Transport Protocol Secure (HTTPS): The protocol for accessing a secure Web server. This is HTTP using SSL. Using HTTPS in the URL instead of HTTP directs the message to a secure port number rather than the default Web port number of 80.

## WS-Security and  Authentication

- The OASIS WS-Security specification is an open standard for Web services security. Its goal is to let applications secure SOAP message exchanges by providing encryption, integrity, and authentication support.
- WS-Security offers a general-purpose mechanism for associating security tokens with message content.
- Three approved token types:
- UsernameToken Profile
- X.509 Certificate Token Profile
- SAML (Security Assertion Markup Language) Token Profile

## Authorization

*Is operation X by principal Y on resource Z permitted?*
*Is Query by Bob on GetFacilityById permitted?*
*Role-based* authorization
- Authorizing the user based on role(s)
- Policy based on roles (operator, admin, etc).
*Identity-based* authorization
- Individually identified user
- Multiple roles per user
- Policy based on user. Alice can perform Execute from 8:00am-4:00pm daily.

## Signature Properties

**Non-Reputation**: Only someone possessing the private key could have created the digital signature.
**Integrity**: Any modification of the signed data invalidates the digital signature.
**Verifiable**: Anyone who has the corresponding public key can verify the digital signature.

## XML Signature Example

## XML Encryption Example

## XML Key Management Service 

- Public key publishing and locating service
- W3C Standard
- Supported operations:
- Register
- Locate
- Validate
- Reissue

## XKMS

- Much Simpler Model – less moving parts
- Methods – Register, Reissue, Validate
- Cost effective
- Denial of service prevention and other attacks are prevented by XKMS
- Dramatic performance
- XKMS is 10 times faster -  parsing keys
- Interoperates with x.509 certs

## Using XKMS

## Network Authentication and Authorization Services (NAAS)

- Web Services based security services
- Based on W3C WS Security Standard
- Authorization policy management
- XML signature and encryption
- Single sign-on
- Secure Socket Layer (SSL/TLS) standard transport encryption
-  Security Assertion Markup Language (SAML) support
- XML Key Management System (XKMS) support

## Security Architecture

## Authentication Methods

**Pin Password:** User ID and secret / password used to authenticate users.
**Digest:** User ID and hash value of the password to authenticate users.
**HMAC Signature:** Sign the authentication message using the password to prove identity.
**Secure Authentication Key(SAK): **Special NAAS security token is created for machine to machine authentication that is encrypted with two secrets and contains IP address information
**Certificate:** Sign the authentication message using a certificate issued by a trusted party
**XKMS :** Sign the authentication message using a key stored in the key management service

## NAAS Security Extensions

- Support WS-Security for authentication .
- Use CAM (Certificate Arbitration Module) for certificate validation.
- Enable OCSP for external certificate authority validation.
- Use XKMS for issuing/validating certificates
- Enhance NAAS to use Active Directory as user identity and security policy store.
- Publish a signature validation service accessible to all nodes and applications.
- Publish a certificate validation service for e-Authentication.

## Node Client Enhancements

- Support XML Encryption for confidential CBI submission (CDC privacy data).
- Support XML Signature for non-repudiation and document integrity.
- Using Integrated key store on user’s machine.
- Wizard-driven document submissions.
- Integrate with XKMS for issuing certificates.

## Secure Node Client Demo