Security technology, the latest
Transcript of Security technology, the latest
Security technology, the latest & Security technology, the latest & greatest(?)greatest(?)
Security technology, the latest & Security technology, the latest & greatest(?)greatest(?)
March 23, 2004March 23, 2004
Alan Harbitter, Ph.D.Alan Harbitter, Ph.D.CTO, PEC Solutions, Inc.CTO, PEC Solutions, [email protected]@pec.com
• Security issues in a service-oriented Security issues in a service-oriented architecturearchitecture
• GJXDM 3.0 security metadataGJXDM 3.0 security metadata• Underlying need for PKIUnderlying need for PKI
2
Service Oriented Architecture—Whut tha?
Internal Network
Sheriff’sdatabase Hey, What do you
know about thisguy who was
arrested?
Hey, What do youknow about this
guy who wastried?
Courtdatabase
3
Service Oriented Architecture—Whut tha?
Internet or Intranet
Sheriff’sdatabase
Courtdatabase
SOAP/XML over HTTP
Registry of Services
1. ---
2. ---
I haveinfo
you mightbe interested
in!
So do I!
UD
DI
WS
DL
UD
DI
WS
DL
4
Security Demands for the SOA
Confidentiality: Protect specific fields and documents in XML
Integrity: Information is valid and undisturbed Availability: Critical services remain up and
running Authentication: Know who you’re talking to on
a enterprise-wide basis
5
What’s Available and Why It’s Lacking
SSL Indiscriminately covers an entire session and on a
user to server basis Digital Signature
Good but relies on interoperable PKIs Dumb Firewalls
Only looks at the network level and misses the threat UserID/Password
Still the most common way to get access No enterprise wide standardization No accommodation for role based access control Lightweight security
6
What We Need
Fine grained encryption in web services Enterprise standards for digital
credentials—a law enforcement standard for digital credentials
“Application aware” firewalls Cooperation among PKI owner-operators Mature standards and tools for
developers Peace on Earth
7
Standards-based approaches: SAML
OASIS standard based on XML
Includes assertions for Authentication (e.g., I
authenticated thru RISS or ARJIS, …)
Attributes (e.g. I’m a member of ATIX)
Authorization Extensible Incorporates XML digital
signature standards It’s pretty new (version
1.1 is under consideration)Source: Assertions and Protocol for the OASIS Security Assertion
Markup Language (SAML), OASIS Standard, 5 November 2002
8
Security in GJXDM 3.0SecurityMetadata SecurityMetadataType
extends SuperTypeDescribes security information and classification on information.
SecurityClassificationInitial ClassificationTypeextends SuperType
Details about the original classification of information.
SecurityClassificationCurrent ClassificationTypeextends SuperType
Details about the current classification of information.
SecurityDeclassification ClassificationTypeextends SuperType
Details about the declassification of information.
SecurityClassificationDowngrade ClassificationTypeextends SuperType
Details about downgrading the level of classification of information.
SecurityClassificationUpgrade ClassificationTypeextends SuperType
Details about upgrading the level of classification of information.
SecurityControlText TextType A SCI control system or systems that may be applicable to a document, e.g., SI, TK, NONE.
SecurityFGIText TextType Foreign government distribution information or country codes included in a United States controlled document, e.g., "FGI, AUS, DEU", "FGI, DEU, GBR, NATO", "FGI".
SecurityFGICode j-iso_3166:CountryAlpha3CodeTypeA code that identifies foreign government distribution information included in a United States controlled document.
SecurityDisseminationText TextType Dissemination control markings as designated by CAPCO Classification Markings Register, e.g., NOFORN, ORCON, FOUO, SETTEE.
SecurityForeignReleasabilityText TextType The foreign releasability of information.SecurityLevelText TextType A level of security of information, e.g., personal, supplier proprietary.
SecurityLevelCode j-dod:SecurityLevelCodeType A code identifying a level of security of information, e.g., personal, supplier proprietary.
SecurityNonICMarkingsText TextType Non-Intelligence Community markings authorized for use by entities outside of the Intelligence Community as designated by CAPCO Classification Markings Register., e.g., SPECAT, SIOP-ESI, SENSITIVE INFORMATION, LIMDIS.
“New” Role for Public Key Infrastructure (PKI)
10
PKI: A Complex mixtures of people, process, and computers
CertificationAuthority
RegistrationAuthority
EndUser
Key Exchange
Enrollment (bind people to digital certificates)
Key, CRL Requests
Directory Updates
Certification Authority Facility
Directory
Revocation
11
“You’re all going to need PKI”
SAMLAssertions
WS SecurityXML message
[s01] <Signature Id="MyFirstSignature" xmlns="http://www.w3.org/2000/09/xmldsig#"> [s02] <SignedInfo> [s03] <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/> [s04] <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/> [s05] <Reference URI="http://www.w3.org/TR/2000/REC-xhtml1-20000126/"> [s06] <Transforms> [s07] <Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/> [s08] </Transforms> [s09] <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> [s10] <DigestValue>j6lwx3rvEPO0vKtMup4NbeVu8nk=</DigestValue> [s11] </Reference> [s12] </SignedInfo> [s13] <SignatureValue>MC0CFFrVLtRlk=...</SignatureValue> [s14] <KeyInfo> [s15a] <KeyValue> [s15b] <DSAKeyValue> [s15c] <P>...</P><Q>...</Q><G>...</G><Y>...</Y> [s15d] </DSAKeyValue> [s15e] </KeyValue> [s16] </KeyInfo> [s17] </Signature>
[s01] <Signature Id="MyFirstSignature" xmlns="http://www.w3.org/2000/09/xmldsig#"> [s02] <SignedInfo> [s03] <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/> [s04] <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/> [s05] <Reference URI="http://www.w3.org/TR/2000/REC-xhtml1-20000126/"> [s06] <Transforms> [s07] <Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/> [s08] </Transforms> [s09] <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> [s10] <DigestValue>j6lwx3rvEPO0vKtMup4NbeVu8nk=</DigestValue> [s11] </Reference> [s12] </SignedInfo> [s13] <SignatureValue>MC0CFFrVLtRlk=...</SignatureValue> [s14] <KeyInfo> [s15a] <KeyValue> [s15b] <DSAKeyValue> [s15c] <P>...</P><Q>...</Q><G>...</G><Y>...</Y> [s15d] </DSAKeyValue> [s15e] </KeyValue> [s16] </KeyInfo> [s17] </Signature>
“Trustable” signatures needed here and here
12
Summary and Closing Remarks
If there’s one thing that’s secure, it’s my job Increased emphasis on sharing complicates security Assurance level is still not measurable
Security tools and standards are emerging, but struggling to keep up Fear not, there are ways to implement good security
solutions PKI: Now, more than ever References:
http://www.ijis.org/library/reports/infosec4ijis3-19-02.pdf