1. 19 December 1998EMGnet meeting INRIA Rhône-Alpes1 An Overview of Security Issues in the Web José KAHAN OBLATT W3C/INRIA jose@w3.org 19 December 1998

2. EMGnet meeting INRIA Rhône-Alpes2 Disclaimer The following slides represent the author’s personal opinion and not necessarily that of the W3C or of INRIA.

3. 19 December 1998EMGnet meeting INRIA Rhône-Alpes3 Outline Architecture Web Security problems Security measures Conclusion

4. 19 December 1998EMGnet meeting INRIA Rhône-Alpes4 Hypertext information model (linking of documents) Client/Server consultation protocol ? documentsserver usertransaction Internet Architecture of the Web

5. 19 December 1998EMGnet meeting INRIA Rhône-Alpes5 Unauthorized release of information Security problems : confidentiality ? ? Internet pirate user

6. 19 December 1998EMGnet meeting INRIA Rhône-Alpes6 Security problems: integrity Unauthorized modification of information ? Internet pirate user

7. 19 December 1998EMGnet meeting INRIA Rhône-Alpes7 Security measures authentication authorization firewalls encryption Access control

8. 19 December 1998EMGnet meeting INRIA Rhône-Alpes8 Mathematical transformation of a message -Document confidentiality -Document integrity -Server authentication -Client authentication EncryptDecrypt Hello Hel Hello plaintextcyphertextplaintext encryption key decryption key Encryption: principles

9. 19 December 1998EMGnet meeting INRIA Rhône-Alpes9 Symmetric (secret key) cryptography Same key used for encryption and decryption Asymmetric (public key) cryptography Different keys used for encryption and decryption Supported by commercial browsers: SSL, TLS BUT: legal problems in some countries Encryption: mechanisms

10. 19 December 1998EMGnet meeting INRIA Rhône-Alpes10 Reference Monitor user resources request operation noeuds deny authorize security database guard consult security administrator update Access control model

11. 19 December 1998EMGnet meeting INRIA Rhône-Alpes11 Access control: authentication Verifying the identity of a user identity, proof of identity security database

12. 19 December 1998EMGnet meeting INRIA Rhône-Alpes12 Web authentication mechanisms

13. 19 December 1998EMGnet meeting INRIA Rhône-Alpes13 Access control: authorization Verifying the access rights of a user identity, proof of identity security database ?

14. 19 December 1998EMGnet meeting INRIA Rhône-Alpes14 Web authorization mechanisms Access control lists (ACL) Roles, groups : simple user administration Capabilities : exchange of access control information in the request

15. 19 December 1998EMGnet meeting INRIA Rhône-Alpes15 Personal experience Existing security mechanisms can solve most of the problems of confidentiality and integrity Difficult part: defining a security policy set of rules describing the behavior of users in a system Choice of security mechanisms: performance versus simple user administration User education is important

16. 19 December 1998EMGnet meeting INRIA Rhône-Alpes16 Some security issues in EMGnet Encryption of data exchanges? Which authentication mechanism? Distribution or centralization of security database? Set of access rights? ACLs, capabilities, or both? User administration! Tip: reuse existing technology when possible