Abstract
Introduction
1. Web service: definition
2. Web services security models: description
2.1. Transport-level security: SSL
2.2. Transport-level security: TLS
2.3. Message-level security: XML Encryption
2.4. Message-level security: XML Signature
2.5. Message-level security: SAML
2.6. Message-level security: WS-Security
3. Web services security models: limitations
3.1. Transport-level security
3.1.1. Point-to-point security
3.1.2. Document-wise encryption
3.2. Message-level security
Conclusion
Abstract defining web services and some six web services security models which the least they solve the basic security problems, i.e., authentication and authorization, message encryption, and message integrity .
Introduction
Web services might be modeled in accordance with six security models. Communication, in web services, is usually made through exchange of SOAP messages, which are XML documents, over HTTP or HTTPS transport medium. Over the past years, web services become widely used, productively, by organizations . Their widespread usage over the internet, naturally, revealed a need for security. There was a need of private communication (or confidentiality) between parties. The receiver should be able to verify the identity of the sender (or authenticate the sender) and the originality of the data (or integrity of the data, i.e., the data has not been tempered with). These Security requirements were especially crucial when conducting online business, such as, e-Commerce. Altair Valasek (2003) introduced three basic security problems, with web services, which need to be addressed: authentication and authorization, message encryption, and message integrity. Unfortunately, web services originally lacked default security features to deal with these problems. It was the responsibility of the developer to address and solve the security problems. Still, implementing the security was greatly facilitated by the usage of XML in the web services messaging process. This is because XML allows the unlimited addition of security extension to the messages themselves. Depending on the security necessities, a developer can choose one from many available security models to solve the security problems. This paper presents six common web services security models. These models are arranged in two categories: transport-level security and message-level security. The first category includes two models: Secure Sockets Layer (SSL) and Transport Layer Security (TLS). The second category includes four models: XML encryption, XML signature, Security Assertion Markup Language (SAML), and WS-Security . Next, before providing short descriptions for these models, it is essential to provide a formal definition of a web service.
1. Web service: definition
A web service is a network software component that provides specific functions and is able to publish its capabilities to other network components. Microsoft defines it as “a loosely-coupled, language-neutral, platform-independent way of linking applications within organizations, across enterprises, and across the internet”. A web service relies on Web Service Definition Language (WSDL), an eXtensible Markup Language (XML) based, to acknowledge its interfaces and capabilities. The World Wide Web Consortium (W3C) describes WSDL as “an XML grammar for describing network services as collection of communication endpoints capable of exchanging messages”. A web service uses the Universal Description, Discovery, and Integration (UDDI), a system and a set of XML protocols, to allow others to know about it. UDDI.org puts the following definition: “UDDI is a specification for distributed web-based information registries of web services. UDDI is also a publicly accessible set of implementations of the specification that allow businesses to register information about the web services they offer so that other businesses can find them”. Finally, a web service communicates with other web services by using the Simple Object Access Protocol (SOAP), an XML protocol commonly transported over HTTP or HTTPS. W3C says that “SOAP provides the definition of an XML document, which can be used for exchanging structured and typed information between peers in a decentralized, distributed environment. It is fundamentally a stateless, one-way message exchange paradigm”.
2. Web services security models: description
2.1. Transport-level security: SSL
SSL is a cryptography protocol for secure communication over the internet. This protocol is commonly used to secure financial transactions. It is based on the public-private key system of encryption. SSL operates in mid-layer above TCP/IP and below HTTP. The term sockets, in its name, refers to a method of communication, which uses secure pipes, between client and server (see, Figure1 ) to provide data confidentiality, authentication, and Integrity.
2.2. Transport-level security: TLS
TLS is relatively new protocol and it is the successor of the SSL protocol. The Internet Engineering Task Force (IETF) defines TLS as a “protocol [that] provides communications security over the Internet. The protocol allows client/server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery” .
2.3. Message-level security: XML Encryption
XML encryption security model ensures data confidentiality through, of course, encryption.
2.4. Message-level security: XML Signature
XML signature is a technique for wrapping digital signature within XML format. It secures messages through providing data authentication and Integrity.
2.5. Message-level security: SAML
The Organization for the Advancement of Structured Information Standards (OASIS) defines SAML as “an XML-based framework for exchanging security information. This security information is expressed in the form of assertions about subjects, where a subject is an entity (either human or computer) that has an identity in some security domain.” Basically, SAML security model provides authentication and authorization.
2.6. Message-level security: WS-Security
WS-Security was released by OASIS standards Organization in 2004. To secure the SOAP messages, WS-Security uses a combination of security tokens and digital signatures. A security token can represent the sender identity. Authenticated occurs when the signature is able to prove the sender’s association with the security token . Data confidentiality, authentication, and Integrity.
3. Web services security models: limitations
The decision to title this section as limitation and not weaknesses is for a very legitimate reason. The limitations in any security model may or may not be considered as weaknesses, and that is because not in every case all the security features are required. In some case, it is required to apply only one security feature, for example integrity, and so there would a security model that secure only the integrity of the data, and on.
3.1. Transport-level security
3.1.1. Point-to-point security
Rather than providing end-to-end security, SSL/TLS provides point-to-point security. This is considered a limitation for the following reason: in web services architecture there might be multiple function calls in between intermediary nodes, before the actual service is provided to the requesting client; Then, SSL/TLS does not provide security between client and web service as a whole (end-to-end), it only secures the client and the first intermediary node (point-to-point) .
3.1.2. Document-wise encryption
Rather than providing also application-message-level security (for element-wise encryption), SSL/TLS provides only transport-level security (document-wise encryption). Some web services need encrypting only part of the SOAP document, yet, that is not possible with SSL/TLS .
3.2. Message-level security
As mentioned in the introductory part of this section, these security models can have limitations, but these limitations might be intentional because not, in every case, all of the security features are required. For example, XML signature only provides authentication and integrity, but not confidentiality, while XML encryption model provides confidentiality, but not authentication and integrity. So that depends on what security is required, accordingly, a security model will be selected for implementation.
Conclusion
Six common web services security models were presented, defined and analyzed. Two of those are transport-level type security and the rest are message-level type security. Transport-level type models were point-to-point and document-wise oriented. If end-to-end and element-wise oriented security was needed, one can choose from the message-level type of security models. Fortunately, the limitations in the transport level have been addressed with some security models at the message level. At this level, it is possible to achieve end-to-end security as well as element-wise encryption. Depending on the result of a security analysis, hopefully a company can find the exact security requirements in one of these models. However, there is nothing that forbids implementing more than one model in a single case, if no one model was found to satisfy the exact security requirements.
