Presentation on theme: "An Analysis of SOAP Security Vinod Pandarinathan Vijay Asokan Parthiv Nayak."— Presentation transcript:
An Analysis of SOAP Security Vinod Pandarinathan Vijay Asokan Parthiv Nayak
Agenda Introduction Skeleton SOAP Message SOAP Message Format and Transmission Why Message Layer Security? CIA in MLS Current Problems and Trends Conclusion ???
Introduction SOAP 1.1 Simple Object Access Protocol SOAP 1.2 A “wrapper” protocol Written in XML Independent of Platform, OS, Programming Language Independent of the wrapped data Independent of the transport protocol A uni-directional message exchange paradigm Simple and Extensible N4S -
Skeleton SOAP Message SOAP Envelope SOAP Header SOAP Body Header Block... Body Block...
Message Transmission Typical Binding - Serl.cs.colorado.edu/downloads/serl-talks/ SOAP.ppt Sender Receiver HTTP Request HTTP Body XML Syntax SOAP Envelope SOAP Body SOAP Body Block Textual Integer 0x0b66
Remote Procedure Call To invoke a SOAP RPC, the following information is needed: The address of the target SOAP node. The procedure or method name. The identities and values of any arguments to be passed to the procedure or method together with any output parameters and return value. A clear separation of the arguments used to identify the Web resource which is the actual target for the RPC, as contrasted with those that convey data or control information used for processing the call by the target resource. The message exchange pattern which will be employed to convey the RPC, together with an identification of the so-called "Web Method" (on which more later) to be used. Optionally, data which may be carried as a part of SOAP header blocks. - Serl.cs.colorado.edu/downloads/serl-talks/ SOAP.ppt
Example Request Code 5 AB123CD Parthiv Nayak /12 -
Example Response Code 5 AB123CD -
Message Layer Security Why do we need another layer of security ? End to end security Transport layer independence Common Infrastructure Security for stored messages
Confidentiality with MLS 0rqGM/nMhGNHY0U6ZhbkuPDEpYaqD/nwqtt0iw361RLeVGvJgn37GeNkd aVY+JizNWsqR//TDeOG=
Authentication - Digitally signed messages MC0CFFrVLtRlk=...
Authorization - MLS ……
Current Problem SOAP uses HTTP,and can transfer binart files HTTP traffic is not blocked by Firewalls Network Security is breached. "SOAP goes through firewalls like a knife through butter." -http://www.prescod.net/rest/security.htmlhttp://www.prescod.net/rest/security.html Possible Solution: Parsing XML data. CPU intensive, and lower performance. Also hard to find patterns because of XML’s dynamic nature.
Current Trend Axis 2 – Apache Software Foundation Provides web service engines designed for SOAP and XML with emphasis on security, and modularization.
Cont… SOAP Security Extensions - W3C Provides SOAP Security Extensions. Currently we have the “SOAP Security Extensions: Digital Signatures” WS-Security (Web Service Security) - OASIS Provides the mechanism for Security tokens within SOAP messages, and also detail the use of Kerberos, X.509 certificate with SOAP.
Cont… Current Goal of OASIS ( ): Multiple security token formats Multiple trust domains Multiple signature formats Multiple encryption technologies End-to-end message content security and not just transport-level security The OASIS consortium would come up with the security guidelines, and after an approval/ implementation phases would ratify it as a standard.
Conclusion SOAP is new. More standardization required. Needs modularization is security. Going in the right direction.