Web - based business and XML security. Dagmar Brechlerova

Problems of security Problems of security Security: important in the business world the integrity of content and transactions privacy and confidentiality to make sure information is used appropriately. In today's web-based business environment, the means for providing that security have changed. The Old Instruments for security work badly Physical security no works as well as in the past. Nice old times: all the computing resources were locked in a central computing room with all jobs submitted locally.

Problems of security To create a single security infrastructure do not scale effectively to the Internet The heterogeneous nature of HW and SW systems and to conflicting administrative, application and security requirements. There is too much to administer, too many applications, too many variations Standards are required that can adapt to changing requirements, that can incorporate new technologies while continuing to work with legacy technologies, and that can be deployed modularly. These standards should work well together.

XML security XML security defines XML vocabularies for representing security information Use other XML standards if it is possible It may be applied to end- end security ( SSL not) XML security reuse existing cryptography It uses XML technology ( XML schema..)

XML Security standards Integrity and signatures - XML Digital Signature Confidentiality - XML Encryption Key Management - XML Key Management Specification (XKMS) Authentication and Authorization Assertions - Security Assertion Markup Language (SAML) Authorization Rules - XML Access Control Markup Language (XACML) as well as major XML Security applications: Web Services Security - Roadmap and WS- Security Privacy - Platform for Privacy Preferences (P3P) Digital Rights Management - eXtensible Rights Markup Language 2.0 (XrML)

Signature element <CanonicalizationMethod Algorithm=" <SignatureMethod Algorithm=" /> j6lwx3rvEPO0vKtMup4NbeVu8nk= <Reference URI=" example.xml"> UrXLDLBIta6skoV5/A8Q38GEw44= MC0E~LE= CN=EdSimon, O=XMLSecInc.,ST=OTTAWA,C=CA MIID5jCCA0+gA...lVN

Encryption- Book book visa

all notes/iana/assignments/media- types/text/xml A23B45C56

Information about card book A23B45C564587

SAML – Security Assertion Markup SAML defines XML vocabulary for sharing security assertions Authentication and authorization assertions Single sign on

XACML

Policy from XACML

SampleServer

Policy from XACML 17:00:00

?????