Security technology, the latest & Security technology, the latest & greatest(?)greatest(?)

Security technology, the latest & Security technology, the latest & greatest(?)greatest(?)

March 23, 2004March 23, 2004

Alan Harbitter, Ph.D.Alan Harbitter, Ph.D.CTO, PEC Solutions, Inc.CTO, PEC Solutions, Inc.alan.harbitter@pec.comalan.harbitter@pec.com

• Security issues in a service-oriented Security issues in a service-oriented architecturearchitecture

• GJXDM 3.0 security metadataGJXDM 3.0 security metadata• Underlying need for PKIUnderlying need for PKI

2

Service Oriented Architecture—Whut tha?

Internal Network

Sheriff’sdatabase Hey, What do you

know about thisguy who was

arrested?

Hey, What do youknow about this

guy who wastried?

Courtdatabase

3

Service Oriented Architecture—Whut tha?

Internet or Intranet

Sheriff’sdatabase

Courtdatabase

SOAP/XML over HTTP

Registry of Services

1. ---

2. ---

I haveinfo

you mightbe interested

in!

So do I!

UD

DI

WS

DL

UD

DI

WS

DL

4

Security Demands for the SOA

Confidentiality: Protect specific fields and documents in XML

Integrity: Information is valid and undisturbed Availability: Critical services remain up and

running Authentication: Know who you’re talking to on

a enterprise-wide basis

5

What’s Available and Why It’s Lacking

SSL Indiscriminately covers an entire session and on a

user to server basis Digital Signature

Good but relies on interoperable PKIs Dumb Firewalls

Only looks at the network level and misses the threat UserID/Password

Still the most common way to get access No enterprise wide standardization No accommodation for role based access control Lightweight security

6

What We Need

Fine grained encryption in web services Enterprise standards for digital

credentials—a law enforcement standard for digital credentials

“Application aware” firewalls Cooperation among PKI owner-operators Mature standards and tools for

developers Peace on Earth

7

Standards-based approaches: SAML

OASIS standard based on XML

Includes assertions for Authentication (e.g., I

authenticated thru RISS or ARJIS, …)

Attributes (e.g. I’m a member of ATIX)

Authorization Extensible Incorporates XML digital

signature standards It’s pretty new (version

1.1 is under consideration)Source: Assertions and Protocol for the OASIS Security Assertion

Markup Language (SAML), OASIS Standard, 5 November 2002

8

Security in GJXDM 3.0SecurityMetadata SecurityMetadataType

extends SuperTypeDescribes security information and classification on information.

SecurityClassificationInitial ClassificationTypeextends SuperType

Details about the original classification of information.

SecurityClassificationCurrent ClassificationTypeextends SuperType

Details about the current classification of information.

SecurityDeclassification ClassificationTypeextends SuperType

Details about the declassification of information.

SecurityClassificationDowngrade ClassificationTypeextends SuperType

Details about downgrading the level of classification of information.

SecurityClassificationUpgrade ClassificationTypeextends SuperType

Details about upgrading the level of classification of information.

SecurityControlText TextType A SCI control system or systems that may be applicable to a document, e.g., SI, TK, NONE.

SecurityFGIText TextType Foreign government distribution information or country codes included in a United States controlled document, e.g., "FGI, AUS, DEU", "FGI, DEU, GBR, NATO", "FGI".

SecurityFGICode j-iso_3166:CountryAlpha3CodeTypeA code that identifies foreign government distribution information included in a United States controlled document.

SecurityDisseminationText TextType Dissemination control markings as designated by CAPCO Classification Markings Register, e.g., NOFORN, ORCON, FOUO, SETTEE.

SecurityForeignReleasabilityText TextType The foreign releasability of information.SecurityLevelText TextType A level of security of information, e.g., personal, supplier proprietary.

SecurityLevelCode j-dod:SecurityLevelCodeType A code identifying a level of security of information, e.g., personal, supplier proprietary.

SecurityNonICMarkingsText TextType Non-Intelligence Community markings authorized for use by entities outside of the Intelligence Community as designated by CAPCO Classification Markings Register., e.g., SPECAT, SIOP-ESI, SENSITIVE INFORMATION, LIMDIS.

“New” Role for Public Key Infrastructure (PKI)

10

PKI: A Complex mixtures of people, process, and computers

CertificationAuthority

RegistrationAuthority

EndUser

Key Exchange

Enrollment (bind people to digital certificates)

Key, CRL Requests

Directory Updates

Certification Authority Facility

Directory

Revocation

11

“You’re all going to need PKI”

SAMLAssertions

WS SecurityXML message

[s01] <Signature Id="MyFirstSignature" xmlns="http://www.w3.org/2000/09/xmldsig#"> [s02] <SignedInfo> [s03] <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/> [s04] <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/> [s05] <Reference URI="http://www.w3.org/TR/2000/REC-xhtml1-20000126/"> [s06] <Transforms> [s07] <Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/> [s08] </Transforms> [s09] <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> [s10] <DigestValue>j6lwx3rvEPO0vKtMup4NbeVu8nk=</DigestValue> [s11] </Reference> [s12] </SignedInfo> [s13] <SignatureValue>MC0CFFrVLtRlk=...</SignatureValue> [s14] <KeyInfo> [s15a] <KeyValue> [s15b] <DSAKeyValue> [s15c] <P>...</P><Q>...</Q><G>...</G><Y>...</Y> [s15d] </DSAKeyValue> [s15e] </KeyValue> [s16] </KeyInfo> [s17] </Signature>

[s01] <Signature Id="MyFirstSignature" xmlns="http://www.w3.org/2000/09/xmldsig#"> [s02] <SignedInfo> [s03] <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/> [s04] <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/> [s05] <Reference URI="http://www.w3.org/TR/2000/REC-xhtml1-20000126/"> [s06] <Transforms> [s07] <Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/> [s08] </Transforms> [s09] <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> [s10] <DigestValue>j6lwx3rvEPO0vKtMup4NbeVu8nk=</DigestValue> [s11] </Reference> [s12] </SignedInfo> [s13] <SignatureValue>MC0CFFrVLtRlk=...</SignatureValue> [s14] <KeyInfo> [s15a] <KeyValue> [s15b] <DSAKeyValue> [s15c] <P>...</P><Q>...</Q><G>...</G><Y>...</Y> [s15d] </DSAKeyValue> [s15e] </KeyValue> [s16] </KeyInfo> [s17] </Signature>

“Trustable” signatures needed here and here

12

Summary and Closing Remarks

If there’s one thing that’s secure, it’s my job Increased emphasis on sharing complicates security Assurance level is still not measurable

Security tools and standards are emerging, but struggling to keep up Fear not, there are ways to implement good security

solutions PKI: Now, more than ever References:

http://www.ijis.org/library/reports/infosec4ijis3-19-02.pdf