




已阅读5页,还剩39页未读, 继续免费阅读
版权说明:本文档由用户提供并上传,收益归属内容提供方,若内容存在侵权,请进行举报或认领
文档简介
serviceorientedarchitecturesoaworkshopstarterkitwebservicessecurity lastupdated july 2006 2 copyright 2006accentureallrightsreserved soaworkshopstarterkit webservicessecurity 3 copyright 2006accentureallrightsreserved contents securityandwebservicesindustrystandardsws indetailplatformsupportrecommendations 4 copyright 2006accentureallrightsreserved businessopportunities newbusinessmodelsserviceprovidersthatprovideidentityrelatedservicesserviceprovidersthatprovide traditional value addedservices e g hrorpayroll whichcanbemoreeasilyintegratedintoacustomer senterprisedriverevenuegrowthimproveandstreamlinetheprocessforidentifyingandacquiringnewcustomersstreamlineabilityforcollaborationwithbusinesspartnerscostsavingsreduceuseradministrationcoststhroughautomationreduceapplicationdevelopment integrationcoststhroughreusabilityimproveuserexperiencehaveasingleidentitythatcanbeusedgloballyimprovetheoverallsecuritythroughthereductionofdatasourcesandduplicatedata significantopportunitiesexistfororganizationstodriverevenuegrowth createnewbusinessmodels realizecostsavings andimprovetheuserexperienceleveragingsecurityconcepts 5 copyright 2006accentureallrightsreserved securityconcernslimitsuse source webservicessecurity marko neil 2003 source scmagazine january2004 source makingsenseofwebservicessecuritystandards gartneraug 03 securityconcernshavehistoricallybeenoneofthekeyreasonsthatbusinesseshavenottakenadvantageofthebenefitsthatwebservicesandserviceorientedarchitectureshavetooffer theprospectofsoftwarefromdifferentcompaniescommunicatingtogether whilepowerful isfraughtwithsecurityconcerns unlesssecurityandmanagementissuesareaddressedeffectivelytheywillholdwebservicesbackfrombecomingatrulymainstreamtechnologywithinenterpriseapplicationintegrationprojects conflictingstandardsmakewebservicessecuritydecisionscomplexanddifficult companiesshould beginwithsimplewebservicesdeploymentsthatsupportonlyyourcurrentbusinessneeds thisisnotjustatechnologyissue 6 copyright 2006accentureallrightsreserved businesschallenges mitigatingriskandensuringqualitybetweenpartiesinthecircleoftrustcanbeperformedthrough definitionofbusinessstandardsdefinitionofminimumrequirementsenforcementthroughcertificationandaudits mutualconfidence trust pooledknowledge sharingofcustomer identityinformation e g ofcustomers customernames etc betweenorwithinenterprises dataprivacyrevocationprocedures increasedrelianceonthirdpartiesforauthenticationfraudprotection broadenedpotentialforfraudifanidentityisevercompromisedsecurityincidentprocedures coordinatedeffortforanalysisandcorrelationofauditlogsamongpartiesinvolved risk whoisatfaultifacriticaltransactionfailedduetofailure towhatextent definitionofliabilitydefinitionofdisputeresolutionprocess liability privacylegislation ensureprivacytermsarenotviolatedwhenfederatinganidentitybetweenenterpriseswhoinitiatedeachtransaction audittrailbacktoinitiatinguser compliance keyfactorsforwidespreadadoptionofwebservicesincludetheidentificationofsoundbusinessmodelsandmoreexperiencewiththecontractualframeworksthatdefinetrustrelationships mostcurrentimplementationsareinternalthoughthisischanging 7 copyright 2006accentureallrightsreserved whatareyoursecurityrequirements non repudiation confidentiality integrity identification authentication administration authorization accountability thereareseveralnewbusinesschallengesthatmustbeaddressedbeforewebservicescanbesecurelydeployed caniensureprivacyofthetransactions sensitivebusiness clientdataregulatorycompliance etc caniguaranteethattransactionsarenottamperedwith caniensurethatonlyauthorizedtransactionsarebeingperformedonthesystem caniensurethattherewillbeadequatecontrols recordstoguaranteetheresultsofaprocessedtransaction caniquicklydeploynewserviceswithoutcompromisingmyinternalbusinessprocesses caniensurethattransactionsareonlybeingperformedbytrustedparties sendorreceive 8 copyright 2006accentureallrightsreserved overcomingthesecuritybarriers accenturehasproventhatnewstandardsandnewproductsarenowabletoprovidecustomizedsolutionstoovercomethesecuritychallenges 9 copyright 2006accentureallrightsreserved whatiswebservicesecurity thew3cdefinesawebserviceasthefollowing awebserviceisasoftwaresystemdesignedtosupportinteroperablemachine to machineinteractionoveranetwork ithasaninterfacedescribedinamachine processableformat specificallywsdl othersystemsinteractwiththewebserviceinamannerprescribedbyitsdescriptionusingsoap messages typicallyconveyedusinghttpwithanxmlserializationinconjunctionwithotherweb relatedstandards webservicesecurityencompassesthefollowingareas transportationlayersecurity providingconfidentialityandintegrityintransit messagelayersecurity ensuringthatmessagesareaccordingtospecification identityandaccessmanagement providingauthentication authorizationandidentification securityadministrationofwebservices enablingaudittrailsandsecurityadministration intrusiondetectionandprevention protectingagainstcommonwsthreats 10 copyright 2006accentureallrightsreserved withoutpropercontrolswebservicescanbevulnerable oneofthemostenticingaspectsofwebservicesisthatalargedegreeofcomplexityisabstractedawayfromtheviewofthedeveloper makingtheservicesveryeasy andcheap todevelop addinga webmethod parametertoamethodallowsforalmostinstantpublishing net similarpossibilitiesinjava processingofhttprequests serializationofxmlandparsingofsoapmessageistotallyinvisibletothedeveloper soaplayerwilltakecareofdataserializationandde serialization easyisdangerous makingawebserviceissoeasythatyoueasilyforgetthatsecurityisnotapartofthesoapstack noauthenticationorauthorization outoftheboxanyonewithaccesstoyourwebservercanexecuteyourwebmethods inputdatanotcleansed butneatlypackedincomplexclassstructures alotofprocessingisdonebeforereachingthedeveloper protectingtheunderlyingstackcannotbedonefromwithinthecode richfunctionalityisoncemoreprovidedforaccessfromoutsideofthefirewall 11 copyright 2006accentureallrightsreserved howtosecurewebservices tosecurewebserviceswehavetoensurethat onlyproperlyauthenticatedandauthorizedusersareallowedtoexecuteourwebmethods messagesareprotectedbothwithregardstointegrityandconfidentiality duringtransportandstorage sothatthirdpartiescannotaltermessagesorreadconfidentialcontentsofmessages applicationserversareprotectedagainstthecommonthreatstosoap xmlstacks webserviceapplicationsarewrittenwithsecurityinmindtopreventcommonsecuritythreatstonetworkawareapplications tomeettheaboverequirementswewillhavetodeployprotectionalongtwomainaxes technicalsecurityfunctionalsecurity 12 copyright 2006accentureallrightsreserved technicalsecurityoverview whatdowemeanbytechnicalsecurityforwebservices protectionagainstmaliciousmessageformatsthatmayleadtoacompromiseofsecurityinthesoapandxmllayersoftheapplicationserver protectionagainstmaliciouscontentsthatdoesnotconformtothedefinedmessagingstandardforthewebservice protectionagainstdifferentformsofdenialofserviceattacks therearethreemainavenuesofattackthatcanbeusedwhenattackingawebserviceapplicationstack application anyexposedbusinesslogicispronetoerrors eitherbydesignorbycodingerror webservicesareasvulnerableasotherapplications soap themessagingprotocolhasambiguitiesthatcanbechallengedbyanattacker xml parsingofcomplexxmlmessagescancreatesecurityvulnerabilities 13 copyright 2006accentureallrightsreserved applicationattacks theopenwebapplicationsecurityprojectliststhetoptenthreatsagainstwebapplications mostareequallyvalidagainstwebserviceapplications fourarespecifictotheapplicationlevel unvalidatedinputbufferoverflowsinjectionflawsimpropererrorhandling 14 copyright 2006accentureallrightsreserved soapattacks thesoapprotocolwhichistheunderlyingprotocolformostwebservicestodayhasnobuilt insecurity allmethodcallsareunprotected apiispubliclyavailablethroughdynamicallycreatedwsdlfiles soapisstateless 15 copyright 2006accentureallrightsreserved xmlattacks xmlisthebasisofwebservices successfulattacksonwebservicesgenerallymeanscraftingavalidxmlfilethatismisinterpretedbyeitherparserordeveloper invalidxmldroppedbyparserearlyon xmldocumentsarevalidatedagainsttheirpublishedschema tamperingwiththeschemaisacommonapproach 16 copyright 2006accentureallrightsreserved solutionstrategy validateyourinput mostattacksagainstawebservicearebasedonpoorlyvalidatedinput wellcontrolledinputwillenableyoutogainfullcontroloverthedatathatispassedontotheapplicationlayer duetotheobfuscationpossibilitiesitishighlyrecommendedtovalidateusinganxmlawarevalidator enablestrictschemavalidation andutilizeonlyschemasthataredefinedbyyouandthatarestoredlocallyonyourdevice xmlschemascandefinedetailedrequirementsperfield thisallowsyoutodefineallowedcharactersandfieldlengths challengesschemavalidationisprocessorintensiveandrequiresalargeamountofmemory leavesapplicationservervulnerabletodenialofserviceattacks validationwillbecomeapartoftheapplicationserverstack introducesmanageabilityissues 17 copyright 2006accentureallrightsreserved solutionproducts xmlsecuritygatewayseitherserverdeployedsoftwareorappliance functionsasasoapproxy firewallbetweenclientandapplicationserver mainfeaturesinclude xmlschemavalidationsslconnectionterminationstateawareroutingofxmlmessages denialofserviceprotection centralizedsecurityauditingforwebservices mostproductssupportbeingclusteredforincreaseperformance someproductsincludehardwaresecuritymodulesforimprovedsslandws securityperformance soapstackenhancementsvendorsprovidesomeofthesamefunctionalityasextensionstotheirbasicsoapstack 18 copyright 2006accentureallrightsreserved functionalsecurityoverview wehavetalkedaboutsecuritythreatsagainstanunprotectedsoapwebservice protectingagainstsoapattackswithanxmlgatewayorsimilarproductswillprotectagainstmaliciousmessagesanddenialofserviceattacks itwillnotgiveyouaccesscontrol confidentialityormessageintegrity itwillnotgiveyoueasysecurityadministrationofyourwebservices whatarethechallenges nativesoapdoesnotincludeanysecurityfeatures earlyadoptersusedtransportationlayerprotectionmechanisms eitherhttporssl thisdoesnotprotectmessageswhentransportedoverothermediums e g smtp 19 copyright 2006accentureallrightsreserved solutionavailabilitymatrix transportlayersecurityworksonlypeer to peer willhavetobere establishedifmessageisrelayed protectsentireconversation sessionawarenessavailable messagelayersecurityprotectsmessageandcontentsofmessage protectionpersistsacrossmultiplehops nosessionawareness 20 copyright 2006accentureallrightsreserved securityrecommendations webservicesstandardsarestillemerging howeverpreparationandimplementationofbasicfederatedbuildingblocksshouldbeconsiderednow accesscontrol identifywhoyouwantinyourcircleoftrustandhowmuchyoutrustthem maintainidentity whoinitiatedthetransaction audit connectedtrailofactivities importantforcomplianceefforts identityandaccessmanagement i am integratedintoyourserviceorientedarchitecturetosupporttheabove othertechnologycontrols integrityandconfidentialityasrequired preparation consumerportalsshouldlooktoareaslikelibertyandsamltoseeiftherearegainstobeachievedfromsupportingsomeoftheexistingfederatedsolutionsinareaswhereportal to portalsinglesign onhasalreadybeencustom built replacethesewithpointtopointsamlsolutionsusesamlforallnewsinglesign oninitiativesthatcrossorganizationalboundaries implementation 21 copyright 2006accentureallrightsreserved contents securityandwebservicesindustrystandardsws indetailplatformsupportrecommendations 22 copyright 2006accentureallrightsreserved ws vs libertyalliance ws moregenericframeworkdevelopedbymicrosoft ibmandselectedvendors e g verisign oblix noworacle sap rsa etc subjecttoasomewhatambiguousroyaltyfree rf process libertyalliancemorepurpose specificsolutions identityfederation insteadofagenericframeworkdevelopedbyindustry lessvendor centric sun vodaphone ibm fidelityinvestmentsamericaonline nokia ericsonmoreopenprocess competingandsomewhatoverlappingstandardsexpectdusttosettleinoasisandws i 23 copyright 2006accentureallrightsreserved standards ws security thews securityinitiativeisdrivenbytheoasisstandardsorganization andledbymicrosoft ibmandverisign thegoalofws securityistoconstructsecuresoapmessageexchanges initialspecifications follow onspecifications 24 copyright 2006accentureallrightsreserved libertyallianceproject federatednetworkidentityandidentity basedservicesid ff1 2 final november2003 cross domainsinglesign onaccountlinkingmainlybrowserbasedinteractionsid wsf1 1 final may2004 discoveryserviceinteractionserviceauthenticationserviceid sis1 1personalprofileemployeeprofilecontactbookgeolocationservicepresenceservice purpose specific deeplydefinedspecifications 25 copyright 2006accentureallrightsreserved standardslifecycle developing notastandard earlyadopters mature ssl tls saml2 0march2005 saml1 1august2003 ws securitymarch2004 xml encryptionxml signaturedec2002 ws securityextensions indicatesthedatethataspecificationbecameanofficialstandard usage acceptance 26 copyright 2006accentureallrightsreserved contents securityandwebservicesindustrystandardsws indetailplatformsupportrecommendations 27 copyright 2006accentureallrightsreserved interactionmodel 2001 2002internationalbusinessmachinescorporation microsoftcorporation 28 copyright 2006accentureallrightsreserved standards ws soap ws security ws secureconversation ws federation ws authorization ws policy ws trust ws privacy w3cfoundationstandardwidelysupported oasisstandardwidelysupported royaltyfreespecsunderdevelopmentpossiblemovetooasisinthefuture undevelopedandunpublished 29 copyright 2006accentureallrightsreserved standards ws security soap ws security ws secureconversation ws federation ws policy ws trust soapsecurityenvelopemessageintegrity confidentiality authenticationofendpointsatmessagelevelmultipletokenssupported x509certs saml kerberos etc 30 copyright 2006accentureallrightsreserved standards ws secureconversation soap ws security ws secureconversation ws federation ws policy ws trust providessecuritycontextforseriesofsoapmsgssecuritycontextestablishmentsessionkeynegotiation 31 copyright 2006accentureallrightsreserved standards ws policy soap ws security ws secureconversation ws federation ws policy ws trust providesmechanismsforcommunicatingpolicyrequirements confidentiality authentication etc 32 copyright 2006accentureallrightsreserved standards ws trust soap ws security ws secureconversation ws federation ws policy ws trust providesmethodsforissuingandexchangingsecuritytokenssupportsabilitytoissue renew validateanddelegatetokensindependentoftokenformat 33 copyright 2006accentureallrightsreserved standards ws federation soap ws security ws secureconversation ws federation ws policy ws trust leveragesws trust enablingssoincludesownsinglelog outmessageprofilesforfrontchannel browser andbackchannel ws useattributeandpseudonymservices 34 copyright 2006accentureallrightsreserved webservicessecuritystandards authorization verifythatanentityisallowedtoperformarequestedaction authentication verifythatanentityiswhotheyclaimthattheyare integrity verifythatthecontentsofamessagehavenotbeentamperedwith confidentiality hidethecontentofamessagefromeveryoneexcepttheintendedrecipient non repudiation theabilitytocorrelateamessagebacktoaspecificpersonorentitywithoutdeniability administrationandmanagement theabilitytocentrallymanagesecurityservicesforusersandapplications keysecurityconcepts 35 copyright 2006accentureallrightsreserved webservicessecurityarchitecture internaladministrationandprovisioning externallymanagedservices policystorestores webbrowserapplications wirelessapps enterpriseasp webservicesconsumers clientapps ws securitystandards httpcommunicationchannel sslprotected accesscontrol w3cxmlstandards authorizationstores identitymanagement businesspartners ws securityextensions saml algorithms signatures sha1 hmac encryption xacml xml digitalsignature xml encryption authenticationstores identitymanagement rsa enterpriseprovisioningsolution pki xkms webservicessecuritylayers accessmanagement provisioning supportingservices pki webservicecommunicationscanbesecuredatthetransportlayerusingssl ws securityleveragesxml sigandxml enctosignandencryptpartofthesoapmessages xkmsisusedtodistributekeystothinclientapplications samlandxacmlareusetodefineauthorizationrulesfortheprocessingofsoapmessages managementsystemsareusedtocontrolthedatathatisusedbythewebservicesecuritystandards thesemanagementsystemsmaybein houseorout sourced securityarchitecturelayer howmightalloftheavailablesecurityfeaturesfittogether 36 copyright 2006accentureallrightsreserved webservicessecurityarchitecture internalpolicyenforcementandaccesscontrol protectedenterprisedata enterpriseapplicationservers transportlayersecuritythroughws security extensions andssl transportlayersecuritythroughssl lightweightpkiandkeydistributiontoamobileuser managementandadministration enterprisesecurityarchitecture asamplediagramofhowsecuritywouldfitintoatypicalwebservicesapplicationarchitecture 37 copyright 200
温馨提示
- 1. 本站所有资源如无特殊说明,都需要本地电脑安装OFFICE2007和PDF阅读器。图纸软件为CAD,CAXA,PROE,UG,SolidWorks等.压缩文件请下载最新的WinRAR软件解压。
- 2. 本站的文档不包含任何第三方提供的附件图纸等,如果需要附件,请联系上传者。文件的所有权益归上传用户所有。
- 3. 本站RAR压缩包中若带图纸,网页内容里面会有图纸预览,若没有图纸预览就没有图纸。
- 4. 未经权益所有人同意不得将文件中的内容挪作商业或盈利用途。
- 5. 人人文库网仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对用户上传分享的文档内容本身不做任何修改或编辑,并不能对任何下载内容负责。
- 6. 下载文件中如有侵权或不适当内容,请与我们联系,我们立即纠正。
- 7. 本站不保证下载资源的准确性、安全性和完整性, 同时也不承担用户因使用这些下载资源对自己和他人造成任何形式的伤害或损失。
最新文档
- 晋城市人民医院牙周基础治疗技能考核
- 通辽市人民医院核心期刊发表医务管理论文水平专家评议
- 2025妇幼保健院放射科年度质量与安全评估
- 2025年信息化平台建设可行性报告
- 晋城市中医院电极阻抗控制专项考核
- 2025年海南油气钻采设备项目可行性研究报告模板参考
- 2025至2030年中国黑色提花台布行业发展研究报告
- 自费出版图书合同书6篇
- 2024年“江南十校”新高三第一次综合素质检测历史试题答案
- 中国助燃节煤剂项目创业计划书
- 2023年8月26日全国事业单位联考A类《职业能力倾向测验》真题+解析
- 【初中物理】《跨学科实践:为家庭电路做设计》课时教案-2025-2026学年人教版九年级全册物理
- 2025年国企中层干部竞聘考试试题及答案解析
- 2025年京东自营初级售前客服考试及答案2
- 江浙皖高中(县中)发展共同体2025-2026学年高三上学期10月联考化学试题(含答案)
- 压力容器教育培训知识课件
- 安全生产费用投入台账明细
- 【初中数学】期中(第13-15章)综合自检卷-2025-2026学年数学八年级上册(人教版2024)
- 防爆安全教育培训记录课件
- 精神发育迟滞的护理查房
- 配电箱配电柜专项施工方案
评论
0/150
提交评论