SlideShare uma empresa Scribd logo
1 de 105
Baixar para ler offline
Santa Clara , CA




Secured SOA
By Prabath Siriwardena ~ WSO2
Securing a Web Service..???
People Can SEE What You Send
People Can ALTER What You Send
People Can ALTER What You Send
Anyone Can CALL Your Service
People SEE What’s On
People Can ALTER What’s On
People Can ALTER What’s On
HTTP is NOT Secured
S
HTTP
HTTPS is Transport Level
Security inherited
from the transport channel
Safe only while on the transport
Parts of the message
       CANNOT
         BE
      encrypted
Authenticating with HTTPS ?
BasicAuth
Mutual Authentication
SSL Handshake
CLIENT_HELLO
   Highest SSL Version,
    Ciphers Supported,
Data Compression Methods,
      SessionId = 0,
       Random Data
SERVER_HELLO
       Selected SSL Version,
         Selected Cipher,
Selected Data Compression Method,
       Assigned Session Id,
           Random Data
CERTIFICATE
      Public Key,
Authentication Signature
CLIENT_CERT_REQUEST
      [Optional]
CLIENT_CERT
  [Optional]
CLIENT_KEY_EXCHANGE
CERTIFICATE_VERIFY
       [Optional]
CHANGE_CIPHER_SPEC
FINISHED
CHANGE_CIPHER_SPEC
FINISHED
MONDAY Morning
NOT Happy With HTTPS
Requires END To END Security
Parts of message
need to be Encrypted
<soap:Envelope >
      <soap:Body>
            <ns1:withdrawMoney >
                   <param1></ param1>
                   <param2></ param2>
                   <param3></ param3>
            </ ns1:withdrawMoney >
      </soap:Body>
</soap:Envelope>
<soap:Envelope >
      <soap:Body>
            <ns1:withdrawMoney >
                   <param1></ param1>
                   <param2></ param2>
                   <param3></ param3>
            </ ns1:withdrawMoney >
      </soap:Body>
</soap:Envelope>
Message Level Security
XML Encryption
XML Signature
WS - Security
Confidentiality
Integrity
NON - Repudiation
Authentication
UsernameToken
<wsse:UsernameToken wsu:Id="Example-1">
     <wsse:Username> ... </wsse:Username>
     <wsse:Password
          Type="..."> ... </wsse:Password>
     <wsse:Nonce
          EncodingType="..."> ... </wsse:Nonce>
      <wsu:Created> ... </wsu:Created>
</wsse:UsernameToken>
NOBODY Can See the Message
   in Clear Text Other
than the Intended Recipient
NOBODY In the Middle
Can ALTER the Message
Only the Authenticated
Users Can Invoke the Service
Sign & Encrypt OR Encrypt & Sign
Sign & Encrypt

             MessgaeSignture
XML Signature defines
        THREE
 types of signatures
<Message>

  <Signature>

 </Signature>
</Message>
<Signature>

   <Message>
   </Message>

</Signature>
<Signature>

</Signature>

<Message>

</Message>
<Envelope>
   <Header>
       <Signature>

      </Signature>
   </Header>
   <Body>
       <Message>

       </Message>
   </Body>
</Envelope>
Sign & Encrypt
     With
 WS-Security
1


    <Envelope>
       <Body>
           <Message>

           </Message>
       </Body>
    </Envelope>
2 <Envelope>
     <Header>
         <Signature>

         </Signature>
     </Header>
     <Body>
         <Message>

         </Message>
     </Body>
  </Envelope>
3 <Envelope>
     <Header>
         <Signature>

         </Signature>
     </Header>
     <Body>
         <EncryptedData>

         </EncryptedData>
     </Body>
  </Envelope>
Encrypt & Sign
             MessgaeSignture
1


    <Envelope>
       <Body>
           <Message>

           </Message>
       </Body>
    </Envelope>
2


    <Envelope>
       <Body>
           <EncryptedData>

           </EncryptedData>
       </Body>
    </Envelope>
3 <Envelope>
     <Header>
         <Signature>

         </Signature>
     </Header>
     <Body>
         <EncryptedData>

         </EncryptedData>
     </Body>
  </Envelope>
WS - Security




                   XML            Username       X.509 Token
XML Signature
                Encryption       Token Profile      Profile
DONE with My First Assignment
BUT… Paul NOT Happy 
Authentication LIMITED
          to
  INTERNAL Users ONLY
Users OUT SIDE Our
Domain Need ACCESS
We DON’T Have Their
    Credentials
We Can’t Use
UsernameToken 
Delegate Authentication
to the External Domain
        itself
They Should Know How to
Authenticate Their Own
         Users
We TRUST What the
External Domain Says
WS-TRUST
<s:Envelope>
       <s:Header>
              <wsa:Action>
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue
              </wsa:Action>
       </s:Header>
       <s:Body>
              <wst:RequestSecurityToken>
                     <wst:TokenType>
                          http://example.org/mySpecialToken
                     </wst:TokenType>
                     <wst:RequestType>
http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue
                     </wst:RequestType>
              </wst:RequestSecurityToken>
       </s:Body>
</s:Envelope>
<s:Envelope>
       <s:Header>
              <wsa:Action>
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/Issue
              </wsa:Action>
       </s:Header>
       <s:Body>
              <wst:RequestSecurityTokenResponseCollection>
              <wst:RequestSecurityTokenResponse>
                     <wst:RequestedSecurityToken>
                       <xyz:CustomToken xmlns:xyz="...">
                       </xyz:CustomToken>
              </wst:RequestedSecurityToken>
              </wst:RequestSecurityTokenResponse>
              </wst:RequestSecurityTokenResponseCollection>
       </s:Body>
</s:Envelope>
WS - Trust




                 WS - Security



                          Username   X.509
   XML        XML
                            Token    Token
Signature   Encryption
                           Profile   Profile
Another Problem on
      HAND…
How Do We Communicate
    our Security
   Requirements to
     Outsiders ?
The Encryption
Algorithm We Use…
Key Size…
Token Types…
Elements to be Signed…
Elements to be
  Encrypted…
Use Symmetric Key or
  Asymmetric Key…
WS-Security Policy
Finally… all on the
   White Board…
http://wso2.com
http://wso2.com/about/contact
bizdev@wso2.com

prabath@wso2.com
Thank You…!!!

Mais conteúdo relacionado

Semelhante a Secured SOA

Petar Vucetin Soa312 Building Secure Web Services Using Windows Communica...
Petar Vucetin   Soa312   Building Secure Web Services Using Windows Communica...Petar Vucetin   Soa312   Building Secure Web Services Using Windows Communica...
Petar Vucetin Soa312 Building Secure Web Services Using Windows Communica...
petarvucetin2
 
PCI Security Requirements - secure coding
PCI Security Requirements - secure codingPCI Security Requirements - secure coding
PCI Security Requirements - secure coding
Haitham Raik
 
Summer School - Security in SOA
Summer School - Security in SOASummer School - Security in SOA
Summer School - Security in SOA
WSO2
 

Semelhante a Secured SOA (20)

WS - Security
WS - SecurityWS - Security
WS - Security
 
Identity, Security and XML Web Services
Identity, Security and XML Web ServicesIdentity, Security and XML Web Services
Identity, Security and XML Web Services
 
Séminaire Web Services
Séminaire Web ServicesSéminaire Web Services
Séminaire Web Services
 
1205 bhat pdf-ssl
1205 bhat pdf-ssl1205 bhat pdf-ssl
1205 bhat pdf-ssl
 
DEF CON 27 - ALVARO MUNOZ / OLEKSANDR MIROSH - sso wars the token menace
DEF CON 27 - ALVARO MUNOZ / OLEKSANDR MIROSH - sso wars the token menaceDEF CON 27 - ALVARO MUNOZ / OLEKSANDR MIROSH - sso wars the token menace
DEF CON 27 - ALVARO MUNOZ / OLEKSANDR MIROSH - sso wars the token menace
 
XML Encryption
XML EncryptionXML Encryption
XML Encryption
 
Uniface Lectures Webinar - Application & Infrastructure Security - Hardening ...
Uniface Lectures Webinar - Application & Infrastructure Security - Hardening ...Uniface Lectures Webinar - Application & Infrastructure Security - Hardening ...
Uniface Lectures Webinar - Application & Infrastructure Security - Hardening ...
 
Secure Code Warrior - Insufficient data encoding
Secure Code Warrior - Insufficient data encodingSecure Code Warrior - Insufficient data encoding
Secure Code Warrior - Insufficient data encoding
 
Security: Odoo Code Hardening
Security: Odoo Code HardeningSecurity: Odoo Code Hardening
Security: Odoo Code Hardening
 
Web Attacks - Top threats - 2010
Web Attacks - Top threats - 2010Web Attacks - Top threats - 2010
Web Attacks - Top threats - 2010
 
Man in the Middle Attack on Banks
Man in the Middle Attack on BanksMan in the Middle Attack on Banks
Man in the Middle Attack on Banks
 
Ssl in a nutshell
Ssl in a nutshellSsl in a nutshell
Ssl in a nutshell
 
Building Secure User Interfaces With JWTs (JSON Web Tokens)
Building Secure User Interfaces With JWTs (JSON Web Tokens)Building Secure User Interfaces With JWTs (JSON Web Tokens)
Building Secure User Interfaces With JWTs (JSON Web Tokens)
 
Petar Vucetin Soa312 Building Secure Web Services Using Windows Communica...
Petar Vucetin   Soa312   Building Secure Web Services Using Windows Communica...Petar Vucetin   Soa312   Building Secure Web Services Using Windows Communica...
Petar Vucetin Soa312 Building Secure Web Services Using Windows Communica...
 
Petar Vucetin Soa312 Building Secure Web Services Using Windows Communica...
Petar Vucetin   Soa312   Building Secure Web Services Using Windows Communica...Petar Vucetin   Soa312   Building Secure Web Services Using Windows Communica...
Petar Vucetin Soa312 Building Secure Web Services Using Windows Communica...
 
Security Avalanche
Security AvalancheSecurity Avalanche
Security Avalanche
 
PCI Security Requirements - secure coding
PCI Security Requirements - secure codingPCI Security Requirements - secure coding
PCI Security Requirements - secure coding
 
Summer School - Security in SOA
Summer School - Security in SOASummer School - Security in SOA
Summer School - Security in SOA
 
Web Service Security
Web Service SecurityWeb Service Security
Web Service Security
 
Secure Gate / Reverse Proxy - WAF 1ere génération / Datelec
Secure Gate / Reverse Proxy - WAF 1ere génération / DatelecSecure Gate / Reverse Proxy - WAF 1ere génération / Datelec
Secure Gate / Reverse Proxy - WAF 1ere génération / Datelec
 

Mais de Prabath Siriwardena

Mais de Prabath Siriwardena (20)

Microservices Security Landscape
Microservices Security LandscapeMicroservices Security Landscape
Microservices Security Landscape
 
Cloud Native Identity with SPIFFE
Cloud Native Identity with SPIFFECloud Native Identity with SPIFFE
Cloud Native Identity with SPIFFE
 
API Security Best Practices & Guidelines
API Security Best Practices & GuidelinesAPI Security Best Practices & Guidelines
API Security Best Practices & Guidelines
 
Identity is Eating the World!
Identity is Eating the World!Identity is Eating the World!
Identity is Eating the World!
 
Microservices Security Landscape
Microservices Security LandscapeMicroservices Security Landscape
Microservices Security Landscape
 
OAuth 2.0 Threat Landscape
OAuth 2.0 Threat LandscapeOAuth 2.0 Threat Landscape
OAuth 2.0 Threat Landscape
 
GDPR for Identity Architects
GDPR for Identity ArchitectsGDPR for Identity Architects
GDPR for Identity Architects
 
Blockchain-based Solutions for Identity & Access Management
Blockchain-based Solutions for Identity & Access ManagementBlockchain-based Solutions for Identity & Access Management
Blockchain-based Solutions for Identity & Access Management
 
OAuth 2.0 Threat Landscapes
OAuth 2.0 Threat LandscapesOAuth 2.0 Threat Landscapes
OAuth 2.0 Threat Landscapes
 
OAuth 2.0 for Web and Native (Mobile) App Developers
OAuth 2.0 for Web and Native (Mobile) App DevelopersOAuth 2.0 for Web and Native (Mobile) App Developers
OAuth 2.0 for Web and Native (Mobile) App Developers
 
Identity Management for Web Application Developers
Identity Management for Web Application DevelopersIdentity Management for Web Application Developers
Identity Management for Web Application Developers
 
API Security Best Practices & Guidelines
API Security Best Practices & GuidelinesAPI Security Best Practices & Guidelines
API Security Best Practices & Guidelines
 
Open Standards in Identity Management
Open Standards  in  Identity ManagementOpen Standards  in  Identity Management
Open Standards in Identity Management
 
Securing Single-Page Applications with OAuth 2.0
Securing Single-Page Applications with OAuth 2.0Securing Single-Page Applications with OAuth 2.0
Securing Single-Page Applications with OAuth 2.0
 
API Security : Patterns and Practices
API Security : Patterns and PracticesAPI Security : Patterns and Practices
API Security : Patterns and Practices
 
Best Practices in Building an API Security Ecosystem
Best Practices in Building an API Security EcosystemBest Practices in Building an API Security Ecosystem
Best Practices in Building an API Security Ecosystem
 
Connected Identity : The Role of the Identity Bus
Connected Identity : The Role of the Identity BusConnected Identity : The Role of the Identity Bus
Connected Identity : The Role of the Identity Bus
 
Connected Identity : Benefits, Risks & Challenges
Connected Identity : Benefits, Risks & ChallengesConnected Identity : Benefits, Risks & Challenges
Connected Identity : Benefits, Risks & Challenges
 
The Evolution of Internet Identity
The Evolution of Internet IdentityThe Evolution of Internet Identity
The Evolution of Internet Identity
 
Next-Gen Apps with IoT and Cloud
Next-Gen Apps with IoT and CloudNext-Gen Apps with IoT and Cloud
Next-Gen Apps with IoT and Cloud
 

Último

Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 

Último (20)

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
🐬 The future of MySQL is Postgres 🐘
🐬  The future of MySQL is Postgres   🐘🐬  The future of MySQL is Postgres   🐘
🐬 The future of MySQL is Postgres 🐘
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024
 

Secured SOA