Comparing the Security Architectures of Sun ONE and Microsoft .NET

Platforms for web services have been reduced to two basic approaches: Microsoft .NET and Sun ONE (J2EE). We compare here these two platforms with respect to the security they provide to the web services that use them. We arrive to the conclusion that although the basic security architectures are fairly similar, their actual implementations differ. Microsoft’s approach appears weaker because of their self-contained approach and not following good principles of software and secure systems design. INTRODUCTION Several companies have announced strategies for supporting web services. They all use one of two basic architectures: Microsoft’s .NET or Sun ONE. Microsoft’s architecture is also an implementation, while Sun ONE is an architecture with several implementations based on Java. Comparisons of these architectures barely mention security [Mou01, Ses01]. We believe this aspect is one of the most fundamental factors in their success or failure and we look here at the security features in Microsoft .NET and Sun ONE web services architectures. The basic purposes of an architecture to support web services are: • Store the web service programs on shared systems, where users can find and access them. • Some systems also need to store the user’s data on these shared systems. • Some systems store web services repositories or catalogs. This brings up the typical security issues, which now have the following objectives: • Confidentiality: The web service data may only be accesses by authorized users. • Integrity: Web services data, code, or descriptions may only be altered by authorized users. • Code control: The program code must not be able to perform illegal actions when invoked. • Access control: Only paying subscribers can use the service. • Availability: Code and data stored on the server must be available when needed. Some of these issues should be resolved in the upper layers, where web services are defined.These layers are based on standards under development and we do not discuss these aspects here because they apply to both architectures. A survey of security aspects of web services is given in [Fer02]. Because both the Microsoft .NET and Sun ONE architectures are quite new, there are many aspects still not tested in practice. These two platforms are still evolving and some of our specific conclusions may not be true anymore, but unless there is a change in their fundamental design our main conclusions should still hold. The next section provides a general overview of both architectures. We then consider in detail the security architectures of Sun ONE and .NET, relating them to the standard work on security models. We end with a general discussion of both approaches. A GENERAL COMPARISON OF MICROSOFT .NET AND SUN ONE Both the Sun and the Microsoft frameworks are based on specific programming languages, object models, and virtual machines, but the design approaches of their runtime environments are quite different. We summarize here a few aspects, several papers compare them in detail [Far01, Mou01, Ses01, Vaw01]. Sun ONE is based on Sun’s J2EE (Java 2 Enterprise Edition) specification, which implies that you’ll have to use Java as programming language, but the programs can (in theory) run on any platform without recompiling. The Microsoft .NET framework builds on Microsoft’s Common Object Model (COM), that has been improved significantly, including additions such as ActiveX, distributed computing, database connections, etc. Microsoft has also produced a new programming language, C# and a new runtime environment called Common Language Runtime (CLR), that provides garbage collection and some security features similar to the Java Virtual Machine (JVM). J2EE accesses data sources using the JDBC API, which requires vendor specific drivers. These are available for most commercial and open-source databases. Another approach to persistent objects is Java Data Objects (JDO) [jdo]. Java uses JNDI (Java Naming and Directory Interface) in order to access directory services. Support for various directory services, such as Novell NDS, and Directory Services Markup Language (DSML), among others, is available. Some XML data sources use drivers that are similar to the JDBC drivers. Microsoft’s first data access service was DAO (Data Access Objects), that later led to ActiveX Data Objects (ADO) which provides access to both relational data and directory services. The .NET framework with ADO.NET improves on some of the limitations of ADO (e.g., lack of scalability). Another change is that the data transmission format has been replaced by XML, which gives the opportunity for components to act as data sources for each other. Although Sun ONE is based on Java, which is said to be platform independent, some implementations are not exactly cross-platform independent. On his part, Microsoft has made some attempts to make the .NET framework platform independent, such as submitting the CLR specification and the C# language for standardization, but more realistically, Sun ONE is dependent on Java, and Microsoft .NET incorporates Windows as a central unit. Furthermore the .NET language independence is somewhat incomplete, since you’ll have to add some extensions to the languages in order to make them comply with the CLR requirements, thereby making them COBOL#, Eiffel#, Perl#, etc. Microsoft has been very active in the XML field for the past few years, and .NET provides strong XML support. As mentioned earlier, XML is used for data transmission, but also for general-purpose document handling. Web services can be exported as SOAP interfaces (Simple Object Access Protocol). Sun has also been active in the XML field, and XML has been incorporated into their framework. Table 1 shows a basic comparison of these approaches. SUN ONE SECURITY ARCHITECTURE Overview Let’s take a look at a service request. A request for a protected resource goes through standard Internet protocols, such as HTTP (Figure 1). Microsoft .NET Sun ONE Programming Language Any (but extensions needed) Java Runtime environment CLR, code is compiled into native code before execution JVM, Java bytecodes, either interpreted or compiled ondemand Component sharing IL, CLR JVM with Corba and ORB Data interchange protocol XML, SOAP on HTTP XML, SOAP on HTTP Table 1. .NET and ONE side by side Request to protected resource Web Client Web Server Figure 1. A service request The web server detects that the new request has not yet been authenticated so the appropriate authentication mechanism for the resource is invoked. This may be done by returning a form where the user can fill out a user name and a password, but there are several other options (see below). The data is transferred to the web server that validates the data, and sets the credential for the user (Figure 2). Authentication data Web Client Web Server