Pedro Felix
ABSTRACT
The WS-* specification set defines a message authentication model for web services. This model targets the authentication of messages exchanges in large scale decentralized systems, composed by different authentication domains. However, it has scalability and flexibility limitations: the acquirement of identity claims requires online interactions with security token services, which introduces communication overhead and creates performance bottlenecks; the services' policies, containing its requirements, must directly point to the issuing security token services, limiting the flexibility of the trust relations.
We present a new model, addressing these limitations, using two concepts from the trust management paradigm: credentials for claim inference and claim-based issuer references (attribute based delegation). We show how credentials are used both to increase the scalability, reducing the number of online token requests, and to increase the flexibility by allowing indirect trust relations, namely claim based delegation. We also show how the simultaneous usage of security tokens and credentials results in several advantages of our model, when compared to credential only trust management models.
The proposed model fits nicely into the WS-* framework, namely into its message security model and policy language. We illustrate this with the implementation of an extension to the Windows Communication Foundation - a commercial grade web services platform - that provides support for this model.
- M. Blaze, J. Feigenbaum, and A. D. Keromytis. The role of trust management in distributed systems security. In Secure Internet Programming: Security Issued for Mobile and Distributed Objects, pages 185--210. Springer-Verlag, 1999. Google Scholar
- K. Cameron and M. Jones. Design Rationale behind the Identity Metasystem Architecture. Microsoft.Google Scholar
- D. E. Clarke, J.-E. Elien, C. M. Ellison, M. Fredette, A. Morcos, and R. L. Rivest. Certificate chain discovery in SPKI/SDSI. Journal of Computer Security, 9(4):285--322, 2001. Google ScholarDigital Library
- A. Herzberg, Y. Mass, J. Mihaeli, D. Naor, and Y. Ravid. Access control meets public key infrastructure, or: assigning roles to strangers. In SP '00: Proceedings of the 2000 IEEE Symposium on Security and Privacy, pages 2--14, 14--17 May 2000. Google ScholarDigital Library
- M. Jones. A Guide to Supporting Information Cards within Web Applications and Browsers as of the Information Card Profile V1.0. Microsoft, December 2006.Google Scholar
- N. Li, J. Feigenbaum, and B. Grosof. A logic--based knowledge representation for authorization with delegation. In CSFW '99: Proceedings of the 12th IEEE workshop on Computer Security Foundations, pages 162--174, 28--30 June 1999. Google ScholarDigital Library
- N. Li and J. Mitchell. RT: a role-based trust-management framework. In DARPA Information Survivability Conference and Exposition, 2003. Proceedings, volume 1, pages 201--212 vol.1, 22--24 April 2003.Google Scholar
- N. Li, W. H. Winsborough, and J. C. Mitchell. Distributed credential chain discovery in trust management. Journal of Computer Security, 11(1):35--86, 2003. Google ScholarCross Ref
- Microsoft. Windows Communication Foundation. http://msdn2.microsoft.com/en-us/netframework/aa663324.aspx.Google Scholar
- OASIS. Web Services Security Kerberos Token Profile 1.1, February 2006.Google Scholar
- OASIS. Web Services Security SAML Token Profile 1.1, February 2006.Google Scholar
- OASIS. Web Services Security: SOAP Message Security 1.1, February 2006.Google Scholar
- OASIS. Web Services Security UsernameToken Profile 1.1, February 2006.Google Scholar
- OASIS. WS--Trust 1.3, March 2007.Google Scholar
- H. Wang, S. Jha, T. Reps, S. Schwoon, and S. Stubblebine. Reducing the dependence of SPKI/SDSI on PKI. In D. Gollmann, J. Meier, and A. Sabelfeld, editors, Proceedings of the 11th European Symposium on Research in Computer Security (ESORICS), volume 4189 of Lecture Notes in Computer Science, pages 156--173, Hamburg, Germany, September 2006. Springer. Google ScholarDigital Library
- Word Wide Web Consortium. Web Services Addressing 1.0, August 2005.Google Scholar
- Word Wide Web Consortium. Web Services Policy 1.5, June 2005.Google Scholar
Index Terms
- A scalable and flexible web services authentication model
Recommendations
A non-interactive deniable authentication scheme based on designated verifier proofs
A deniable authentication protocol enables a receiver to identify the source of the given messages but unable to prove to a third party the identity of the sender. In recent years, several non-interactive deniable authentication schemes have been ...
A key authentication scheme with non-repudiation
In 1996, Horng and Yang proposed a key authentication scheme that requires no authorities. However, it is vulnerable to the guessing attack. An intruder can try out a password and forge the public key. To amend this problem, an improved authentication ...
Secure remote user authentication scheme using bilinear pairings
WISTP'07: Proceedings of the 1st IFIP TC6 /WG8.8 /WG11.2 international conference on Information security theory and practices: smart cards, mobile and ubiquitous computing systemsIn 2006, Das et al. proposed a remote user authentication scheme using the properties of bilinear pairings. The current paper, however, demonstrates that Das et al.'s scheme is still vulnerable to an impersonation attack and an off-line password ...
Comments