© 2007 Charteris plc20 June 2015 1 1 Extending Web Service Security with WS-* Presented by Chris Seary MVP Charteris plc, 39-40 Bartholomew Close, London.

© 2007 Charteris plc 18 April 20231

1

Extending Web Service Security with WS-*

Presented by Chris Seary MVP

Charteris plc, 39-40 Bartholomew Close, London EC1A 7JN


2

Vision

• Secure communications– Confidentiality– Integrity– Availability


3

Confusion

• Network protocol security

• Message layer security

???

??


4

Coming up

• Clarification• What are the different types of security

provided by networking protocols?• What does message level security add?• Suggestions on which to choose• How to do it using WCF


5

What is WS-Security?• Message layer security

• Standards based (OASIS)

• WS-*– WS-Security– WS-Addressing– Etc.


6

How do we implement it?

• WCF provides a framework for programming WS-*– Authentication– Encryption– Non-repudiation– Digital signatures– Etc.


7

Message security versus network protocol security

• What do we mean by– Message– Network protocol

• Confusion due to naming!


8

Network protocols• TCP/IP stack

• Refers to network communications


9

Network protocols

SecurityAppliedhere

• TCP/IP stack



10

Network protocols

SecurityAppliedhere

Unsecured data

Unsecured data

• TCP/IP stack



11

Network protocols• Data is only

protected during transit

SecurityAppliedhere

Unsecured data

Unsecured data


12

Network protocols

SecurityAppliedhere

Unsecured data

Unsecured data

HTTPSFTPS


13

Network protocols

SecurityAppliedhere

Unsecured data

Unsecured data

IPSec


14

Network protocols

SecurityAppliedhere

Unsecured data

Unsecured data

PPP usesPAPCHAPMS-CHAPEAP


15

Network protocols• SSL

– Confidentiality– Integrity– Authenticates USERS

• Basic• Windows• Etc.

– Various apps• FTP• SQL Server libraries


16

Network protocols

• IPSec– Confidentiality– Integrity– Authenticates HOSTS

• Kerberos• Shared password (don’t do this in production!)• Certificates

– VPN with L2TP


17

Demo

• SSL in IIS

• IPSec


18

Message security• Protects data that is

sent

SecurityAppliedhere(encrypt)

Secure data

Secure data

SecurityAppliedhere(decrypt)


19

Message security

• More granular

• Can use application level tools

• End to end

SecurityAppliedhere(encrypt)

Secure data

Secure data

SecurityAppliedhere(decrypt)


20

Integrity

• Integrity– Message not altered in transit– WS-*, SSL, IPSec all give this


21

Non-repudiation

• Digital signatures– Gives assurance that message was sent by the

signer– WS-* gives digital signature– SSL and IPSec do not


22

Confidentiality• Encryption

– Only recipient can read message– Both SSL, IPSec and WSE provide this– WS-* provides more granular functionality

• Custom policy assertion can encrypt/sign specific parts of a message

• Intrusion Detection Systems may disallow SSL or IPSec


23

Authentication

• IPSec– Kerberos, shared key, certificates

• SSL– Basic, Windows, Digest, Certs

• WS-*– Username/password, Certs, Custom, Kerberos


24

Policy

• WS-* can be applied via

– Configuration– Code– A mixture of configuration and code

• Policy is configuration


25

Policy

• WCF offers readymade policy objects– ‘turnkey’ approach that began with WSE 3.0


26

Demo

• SOAP

• WS-Security

• Encryption

• Digital Signature


27

Security and encryption

Message

Message

Jhbsx^8

Encrypt

Decrypt


28


Message

Message

Jhbsx^8

Encrypt

Decrypt

Public

Private


29


Message

Message

Jhbsx^8

Encrypt

Decrypt

Public

Private

Usually includes encryption of symmetric key!


30

Certificates

Subject nameSerial numberIssuerPublic keyCA signatureAttribute 1Attribute 2Attribute 3..

Certificate


31

Certificate store

Certificate store

Subject nameSerial numberIssuerPublic keyCA signatureAttribute 1Attribute 2Attribute 3..

Certificate

Private key


32

Certificate store

• Local machine– Certificates used by system

• Demo uses Network Service

• Current user– Logged on user – Windows test harness

• X509 Certificate Tool– Grants permissions for accessing private keys


33

demo

• Certificate store


34

WCF

• Windows Communication Foundation


35

WCF

• Address

• Binding

• Contract


36

WCF

• Address– Endpoint– URL

• http://localhost/site/service


37

WCF

• Binding– How do we communicate?

• WS-*• HTTP• HTTPS• Etc.


38

WCF

• Contract– What have we agreed?

• Methods• Parameters

– Interface


39

WCF

Client ServiceCBA

CBA

CBA

ABC

AddressWhere?

ContractWhat?

BindingHow?

Behavior Behavior

Endpoints:


40

demo

• Wcf and ws-*


41

WS-* Evolution

• WSE– Tactical– WSE 2.0 - .Net 1.x– WSE 3.0 - .Net 2.0

• WCF– Future of communications for Microsoft

technologies


42

WS-* Interoperability

• WSE 3.0 WCF

• WSE 2.0 WCF


43

WCF

• http://www.netfx3.com/

• http://msdn2.microsoft.com/en-us/netframework/aa663324.asp


44

WS-Federation

• Single Sign On

• Identity Providers

• 7 laws of identity – Kim Cameron– http://www.microsoft.com/technet/technetmag/

issues/2006/07/7Laws/default.aspx


45

WS-Federation

www.site1.com www.IdentityProvider.com www.site2.com

1

2

3

LogInLogIn

4 Server sees that no cookie is presented

Server sees that no cookie is presented

5

User attempts to access site 1

Site 1 serverRedirects userTo IP

IP supplies User withLogin form To entercredentials


46

WS-Federation


6

7 Credentialsvalidated

8

User submitscredentials

IP supplies User withForm containingSigned Security Token.Cookie is includedWith response

HIDDENFIELD

8

IP cookie


47

WS-Federation


JavaScript submitsForm with hidden fieldto site 1

HIDDENFIELD

IP cookie

9

10 Site 1 assesseswhether the user inthe Signed SecurityToken should beallowed access

WelcomeWelcome

11Site 1 responds witha welcome page, and a cookie is included in the response

Site 1cookie

11


48

WS-Federation


IP cookie

User navigates to site 2

Site 1cookie

1

2 No cookie forSite 2

3 User redirectedto IP, thussending IPcookie

4IP picks upIP cookiefrom user


49

WS-Federation


IP cookie

JavaScript submitsthe form to site 2

Site 1cookie

6

5 IP respondswith a form containing aSigned SecurityToken

HIDDENFIELD

HIDDENFIELD


50

WS-Federation


IP cookie Site 1cookie

7

Site 2 checksSigned SecurityToken and chooseswhether to grant access

WelcomeWelcome

8 Site 2 respondswith a welcome page and a cookie

Site 2cookie


51

WS-Federation


IP cookie Site 1cookie

Previous PagePrevious Page

1User navigates back to site 1,Including site 1 cookie in the request

Site 2cookie

2 Site 1 application checks validity of cookie

3 Site 1 responds with page fromprevious transaction


52

WS-Federation


53

WS-Federation

• http://technet2.microsoft.com/WindowsServer/en/Library/b0f029cb-65ab-44fb-bcfc-5aa02314e06e1033.mspx?mfr=true


54

Summary

• Protocol – TCP/IP

• Message – WS-Security

• Single Sign On – WS-Federation

• Rapidly advancing technology


55

Thank you

• Presentation and slides– http://blog.searyblog.com/

© 2007 Charteris plc20 June 2015 1 1 Extending Web Service Security with WS-* Presented by Chris Seary MVP Charteris plc, 39-40 Bartholomew Close, London.

Documents

charteris plc20

message security

network protocols security

network communications

wssecurity ws

end security

transit security

unsecured data slide