3.2 Core Security Standards
3.2.1 XML Security Standards
The World Wide Web Consortium (W3C) defined two standards for XML security which are employed by web service security standards; XML en- cryption and XML signature. As the names imply, these standards define methods for encryption and signing of XML documents. The standards can be combined and applied with a high degree of flexibility, and one can, for instance, sign or encrypt only certain parts of an XML document.
XML Encryption
The XML Encryption standard [25] specifies how to encrypt arbitrary parts of XML documents using well-known encryption algorithms such as triple DES [26] and AES [27]. The standard also defines methods for key agreement and key exchange. The operation of XML Encryption is shown in Appendix B.1.
XML Signature
Complementing the encryption standard, the XML Signature standard [28] specifies how to ensure integrity and authenticity of XML messages using standards such as SHA-1 [29] and HMAC [30]. Sender authenticity is en- sured using digital signatures (RSA [31] or DSS [32]). The operation of XML Signature is shown in Appendix B.2.
3.2.2 WS-Security
A central standard for web services security is WS-Security. It was originally developed by Microsoft, Verisign, and IBM, and was published in April 2002 [33]. It was later submitted to the Organization for the Advancement of Structured Information Standards (OASIS), which continues to work on the standard. OASIS released version 1.0 in April 2004, and version 1.1 was approved in February 2006.
22 3. Securing Web Services
Microsoft, IBM and other cooperating organizations have later devel- oped a set of security specifications building on WS-Security. Among these are WS-Policy and WS-SecurityPolicy, which will be covered later in the chapter. Many of these specifications have been submitted to OASIS for standardization.
The standard specifies XML document details, and leaves most infor- mation related to implementation (such as algorithms used) up to the im- plementors. As Bhargavan et. al. point out, it “focuses on interoperability details rather than security” [34].
Basically, WS-Security is an extension of SOAP, adding support for au- thentication, integrity and confidentiality to SOAP messages. Confidential- ity and integrity are achieved using the aforementioned XML Encryption and XML signatures, respectively. WS-Security also specifies how to con- vey authentication information in an XML message using what is called a security token.
According to the WS-Security standard [35], a security token is a col- lection of claims, which are declarations made by an entity regarding name, identity, etc. A signed security token is a security token that has been cryptographically signed by an authority. A security token may contain au- thentication information, but may also be used for authorization details, for instance.
When it comes to authentication, there exist specifications of several kinds of security tokens, some which can be found in additional profiles. There is support for user name/password, X.509 certificates, and Kerberos authentication, but the model is generic and extensible and allows for other authentication mechanisms as well.
Security Policy 23
3.3
Security Policy
The security policy is a very important part of the security of any informa- tion system. The SANS Institute defines a security policy as [36]:
A set of rules and practices that specify or regulate how a system or organization provides security services to protect sensitive and critical system resources.
In a web services context, a security policy may define who can access the web service and how information is protected to and from the web service. Building on WS-Security, several web services security policy specifications and standards have been developed. These allow web service developers to formalize and communicate the web service policy. The mechanisms also let clients discover web service policy requirements and to make decisions on which services to use and how to use them, based on their associated security policies. A generic model can be seen in figure 3.5 (adapted from [37, p131]).
Figure 3.5: A Generic Security Policy Model
3.3.1 WS-Policy
WS-Policy was developed by a group of companies including Microsoft, IBM, and VeriSign, and specifies a generic model for describing web services se- curity policies [38]. It defines a policy as a set of alternatives, and a client
24 3. Securing Web Services
has to satisfy one of these alternatives. Each alternative in turn consists of a set of assertions that specify requirements that the client has to meet. An illustration of this model is shown in figure 3.6.
Figure 3.6: Policy as Defined by WS-Policy
3.3.2 WS-SecurityPolicy
Work on WS-SecurityPolicy was initiated by VeriSign, IBM, Microsoft, and RSA Security [39]. It was later handed over to OASIS, and as of February 2006 it has status as a working draft1.
WS-Policy specifies a policy structure. However, it does not define any particular types of assertions, and leaves this for other specifications. WS- SecurityPolicy is such a specification, and extends WS-Policy by defining a set of security-related assertions. Hence, WS-Policy and WS-SecurityPolicy jointly constitute a framework for creating web services security policies. The assertions specified by WS-SecurityPolicy can be grouped into two groups:
• Protection Assertions (signing, encryption, required elements) • Token Assertions (username, X.509, Kerberos, etc.)
The protection assertions state requirements for which parts of the SOAP messages that must be signed, encrypted, and present. Token assertions are used to specify authentication information.
1As the OASIS version of WS-SecurityPolicy is still on the draft stage, this paper is
Summary 25 In addition to specifying security assertions, WS-SecurityPolicy also de- velops WS-Policy further and adds some flexibility regarding nesting of poli- cies and assertions.
3.4
Summary
This chapter, the second of three background chapters, introduced web ser- vices security aspects. First, it was discussed why it is sometimes desirable to apply security on the messaging layer, instead or in addition to security on the transport layer. Then, three fundamental XML and web services security standards - XML Encryption, XML Signature, and WS-Security - were introduced. Last, the thesis discussed security policies in a web services context, and presented the WS-Policy and WS-SecurityPolicy standards.
In the following chapter, we focus on a central topic for this thesis, namely input validation. Different approaches and concepts are introduced, and the chapter concludes the background part.
27
Chapter 4
Input Validation
Accepting unvalidated input from the user is considered the greatest threat of a web application by several influential organizations and scientists [2, 40]. By validating input data, one wants to prevent unexpected input data from harming the web service application execution.
Although web services differ from regular web applications in many ways, input validation is similar for both. While traditional web application input is input from users who download a form and post it back to the server, web services receive input from applications. In other words, web applications receive input from users, while web services receive input from machines.
In practice, this difference does not change the need for input validation, as there is no difference between input from machines and input from users. Malicious applications exist as well as malicious users. Thus, one cannot trust web service input more than web application input.
Before defining the requirements for the input validator solution in the next chapter, a brief introduction to key input validation concepts is pro- vided in this chapter.
28 4. Input Validation
4.1
Web Service Input
Input to web services can be divided into two categories. The first category is what is usually meant by input, namely input parameters received through the web service interface.
The second category is input from subsystems. Web service applications often communicate with subsystems and receive input from these systems. An example of such subsystems can be a database. To ensure that all input data is valid, web services should also validate database input. This validation can be challenging, especially when several applications write to the same database.