What is a nonce? (15/250-2016)

In cryptography, a nonce is an arbitrary number that may only be used once.
It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks.

May include 

• timestamp (requires clock synchronization between organizations)

Reference:
https://en.wikipedia.org/wiki/Cryptographic_nonce

What are the mechanisms supported by AAA (109/285 technotes for 2015)?

• SAML
• SAML, a user can login to one system in an environment, and then will be able access to other systems in that environment without needing to login again (until the web browser session is ended).

• XACML PEP/PDP - 
• eXtensible Access Control Markup Language 
• Policy Enforcement Point/ Policy Decision Point
• The standard defines a declarative access control policy language implemented in XML and a processing model describing how to evaluate access requests according to the rules defined in policies.

• Kerberos & SPNEGO
• a protocol for authentication
• uses tickets to authenticate
• avoids storing passwords locally or sending them over the internet
• involves a trusted 3rd-party
• built on symmetric-key cryptography
• Kerberos is normally deployed in a client/server environment. It is rarely used in web-applications and thin client environments.

• Because of this, SPNEGO comes to the rescue. It stands for Simple and Protected GSS-API Negotiation Mechanism, which provides a mechanism for extending a Kerberos based single sign-on environment to web-applications.

References:

• http://www.roguelynn.com/words/explain-like-im-5-kerberos/
• https://en.wikipedia.org/wiki/SPNEGO
• http://thekspace.com/home/component/content/article/54-kerberos-and-spnego.html
• http://wso2.com/library/articles/2014/02/introduction-to-security-assertion-markup-language-2.0/

What is a multistep probe? What is a AAA action?(108/285 technotes for 2015)

Multistep Probe :-

To view the contents of any phase, enable the multi-step probe for the firewall or Web Services proxy - employing a document processing policy containing a AAA action


AAA Action :

AAA Action is a Datapower object - that references a specific AAA policy. This is the way to add  (bridge) a AAA policy to any of the services mentioned below.

• XML Firewall
• MPGW
• Web Service proxy
• XSL proxy

References:

Datapower Architectural Design Patterns -Integrating and Securing Services Across Domains -   http://www.redbooks.ibm.com/abstracts/sg247620.html?Open

What is AAA? (107/285 technotes for 2015)

AAA - stands for 

• Authentication
• Authorization
• Auditing

Datapower makes clear separation of processing of all three in a loosely coupled way.

The steps for AAA are:

1. Extract identity (EI) claim - such as username /password from HTTP basic authentication.
2. Extract resource (ER) - such as Web services URL being accessed.
3. Authenticates (AU) the extracted identity - with either an on-board / off-board identity server - LDAP
4. Map Credentials (MC)- using rewrite rules
5. Map Resource (MR) - mapped using rewrite rules
6. Authorize (AU)- submit to a policy server for authorization.
7. Post Processing (PP) - audit

References: 

Datapower Architectural Design Patterns -Integrating and Securing Services Across Domains -   http://www.redbooks.ibm.com/abstracts/sg247620.html?Open

What is Credential Transformation in Datapower? (106/285 technotes for 2015)

Since WebService requests have to travel multiple security domains, the credentials used in the inbound to a boundary server, often require transformation, before reaching the recipient.

Types of Transformation:

• Technology - 
• changing a credential from one type to another
• eg: sender might use Digital Signatures, while the receiver might use Username token.

• Naming - 
• the name that represents a user might change, similar to Relationship in Process Server.
• eg: your identity to IBM can be your serial number, but to bank it can be bank account number. 

To Resolve this - 

1. Custom developed ad-hoc code - 
1. Datapower can perform complex transformations - using built in functions as well as custom transformations.
2. Leverage a product like TFIM (Tivoli Federated Identity Manager)
1. Datapower can also connect to products like TFIM.

Rule of THUMB:

• Use Datapower - for simple credential transformation
• User TFIM - 
• for complex credential transformation
• when transformation occurs in multiple places like Datapower and WAS.

How does Datapower provides Acceleration and Flexibility? (105/285 technotes for 2015)

Acceleration - 

Datapower consumes messages in the network speed, and can remove the WS-Security overhead and pass the clear message to back-end server and vice versa.

Felxibility - 

1. Datapower supports more of WS-Security than of any Application Server - maybe Websphere will catchup the near future, but as of now they have a complete coverage.
2. Datapower fundamentally includes XSL processing engine - which helps in easy Transformation of messages.
3. By offloading the WS-Security processing to Datapower, we eliminate the need to configure and re-configure the back end server.

Example of Datapower usecase:

1. Client who want to use WS-Security but find that their Application Server, does not fully support this, should evaluate Datapower.
2. Clients expecting to frequently change WS-Security settings, 
3. Clients with problematic messages.

What is WS Trust & Secure Conversation? (104/285 tech notes for 2015)

Why WS Trust and Secure Conversation?

WS-Security adds enterprise-level security features to SOAP message exchanges, but with a substantial performance cost. 

WS-Trust builds on WS-Security to provide a way of exchanging security tokens, 
WS-SecureConversation builds on WS-Security and WS-Trust to improve performance for ongoing message exchanges

What is the performance issue with WS Security?
WS Security uses asymmetric keys - that is public and private key pair, which require larger keys and complex processing while decrypting messages vs single secret keys known to the both parties. 

WS Conversation uses WS Trust (+ WS Security) to use only a single key pair to communicate between client and server.


What is WS-Trust?
WS Trust is a WS based standard for Requesting / Receiving the tokens

• Function 1 - Implement the STS to
• issuing
• renew
• cancel
• validate Security Tokens
• Function 2 - Support brokering Trust relationship

What is STS (Security Token Service)?

An STS is a web service that implements a simple interface defined by the WS-Trust specification. The operations supported are issue, renew, cancel and validation of Tokens. 

WS Conversation - is a standard which allows symmetric encryption to be used ongoing exchange of messages between client and the server.

-----------------------

How WS Trust is established?

• Consumer Requests a Security Token (RST) to the STS
• STS returns a signed token to the Consumer - Request Security Token Response (RSTR)
• Once the token is received - the requester can present it to multiple services.

References:

http://www.ibm.com/developerworks/library/j-jws15/
https://www.youtube.com/watch?v=YZNVyUc-3fQ
http://bit.ly/1WcpDKb

What is WS Policy? (103/285 technotes for 2015)

WS Policy is a flexible / extensible grammar to define

• capabilities
• requirements 
• general characteristics of entities in an  

XML Web Services based system based on a particular domain.

Examples of Domain for which we have separate policies:

• Security
• Privacy
• Reliable Messaging

Where and how is a WS-Policy used?

Ans: A Web Service uses a policy to define its requirements in the wsdl file.

For eg:

policy 1: all messages must be signed and encrypted in a certain way.

policy 2: every message has to have a timestamp.

What is WS-Policy Terminology?

Ans:

Policy --> multiple Policy Alternative

Policy Alternative --> multiple Policy Assertion

Policy Assertion - is the criteria - for eg: every msg needs to be encrypted.

eg: of WS-Policy

References:

1. https://www.youtube.com/watch?v=vh4gYKe3_Jc
2. www.redbooks.ibm.com/redbooks/pdfs/sg247620.pdf
3. http://www.w3.org/TR/ws-policy-primer/

What is a Root CA and Intermediate Certificate? (86/285 technotes for 2015)

• The Root certificate has the private key issued by the CA (Certificate Authority). 
• This is set offline and has to be in a secured location as it contains the private key.
• From the Root CA - 2nd Level / Intermediate Certificate’s are generated
  
• 2nd Level Certificates are responsible for issuing certificated to any websites which require certificates.

• In order for the browser accesing a website to trust a certificate, the browser has to be pre-loaded with the Root Certificate (the red arrow).

References:

https://youtu.be/LRMBZhdFjDI

HTTP Authentication (Basic, Digest). (65/285 technotes for 2015)

HTTP Basic Auth:

• Client sends username / password in clear text
  
• should be used only with HTTPS (SSL) 

HTTP Digest:

• Client sends hashed form of the password to the server
  
• should be used over HTTP (SSL0
• Caution: Although the password cannot be captured, it can be replayed.

HTTP Basic Auth - details:

• If a server gets a anonymous request for a protected resource, it can immediately reject the request with a 401 (access denied) code, and setting the WWW-authenticate response header as shown below.
  
• Web browser will display a login dialog when this response is received.
• User / password is entered
• browser sedn all the info back to the server

GET /securefiles/ HTTP/1.1 
Host: www.httpwatch.com 
Authorization: Basic aHR0cHdhdGNoOmY=

• The authorization value “
  
  aHR0cHdhdGNoOmY=” is simply the base 64 encoded version of username:password
  

What is a SOAPHandler in WS-Security? (41 of 285 technotes for 2015)

SOAP handler is a SOAP message interceptor, which is able to intercept incoming or outgoing SOAP message and manipulate its values.

“javax.xml.ws.handler.soap.SOAPHandler” is the Interface which needs to be implemented by someone who wants to use the SOAP Handler.

It inherits 4 methods namely

• getHeaders() 
• close()
• handleFault()
• handleMessage()

Any implementation of SOAPHandler interface will implement the handleMessage() operation to intercept the SOAP message.

SampleCode:

public boolean handleMessage(SOAPMessageContext context) {
Boolean isOutboundMessage = (Boolean) context.get(MessageContext.MESSAGE_OUTBOUND_PROPERTY);
if (isOutboundMessage) {
SOAPPart messageSoapPart = context.getMessage().getSOAPPart();
WSSecHeader securityHeader = new WSSecHeader();
try {
securityHeader.insertSecurityHeader(messageSoapPart);
} catch (WSSecurityException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
Map map = new HashMap();
map.put(Constants.MAPPING_ALIAS, “CT_J2C_FDSH_ALIAS”);
CallbackHandler callbackHandler = null;
LoginContext loginContext = null;
try {
callbackHandler = WSMappingCallbackHandlerFactory.getInstance().getCallbackHandler(map, null);
loginContext = new LoginContext(“DefaultPrincipalMapping”, callbackHandler);
loginContext.login();
Subject subject = loginContext.getSubject();
Set credentials = subject.getPrivateCredentials();
PasswordCredential passwordCredential = (PasswordCredential) credentials.iterator().next();
String userid = passwordCredential.getUserName();
String password = new String(passwordCredential.getPassword());
WSSecUsernameToken usernameToken = new WSSecUsernameToken();
usernameToken.setPasswordType(WSConstants.PASSWORD_DIGEST);
usernameToken.setUserInfo(userid, password);
WSSecTimestamp timestamp = new WSSecTimestamp();
usernameToken.build(messageSoapPart, securityHeader);
timestamp.build(messageSoapPart, securityHeader);
} catch (Exception e) {
System.out.println(“FDSHJavaHandler - Exception occured while loggin in”);
}
}
return true;
 

What is XML Appliance? (28 of 285 technotes for 2015)

What is it?

• XML Appliance is a special purpose network device - used to secure manage and mediate XML traffic.
  
• Useed in SOA and COC (Cloud Oriented Computing)
  
• Integrate on-premise application to off premise cloud hosted apps..
• synonyms - SOA appliances, SOA gateways, XML gateways, cloud brokers.
  
  
  
• Specialized - MOM (Message Oriented Middleware)
• Originally hardware - but now mostly software and also virtualized - due to advances in computing speed.

Providers:

• Datapower & Vordel - 1999 - Hardware
• Layer 7 - 2002
• Forum Systems - 2001
• Managed Methods - 2005

Industry:

• XML - Cross division and cross company data exchange protocol
  
• XML appliance used in - 
  
  finance, telecommunications, government, energy, logistics and more
• addresses SOA Governance -
  
  how applications delivered as “services” can be shared with or called by other applications
  
  
• 
  
  addressed message security, availability and translation of data so that an application can call another application irrespective of the data format and security policies
  
  
  

Reference - 

• http://en.wikipedia.org/wiki/XML_appliance
  

What are the short comings of SSL? (21 of 285 technotes for 2015)

SSL/TLS Shortcomings -

• SSL is point to point - when the message reaches a peer server
• SSL needs to be stripped off so that the message can be processed
  

SSL Limitations:

• SSL is point to point - where as we need end 2 end security, as typical enterprise application has multiple layers.

• SSL is transport layer security - not message level security - data in disk cannot be protected by ssl

• HTTPS - does not support nonrepudiation well - critical for business
  
• server can prove that a completed transaction was requested by a client (in case a dispute arises)
  
• SSL does not support element wise signing - i.e. sign only the credit card details of the entire message.
  

What is SSL Accelerators? (20 of 285 technotes for 2015)

SSL acceleration is a method of offloading the processor-intensive public-key encryption algorithms involved in SSL transactions to a hardware accelerator.


Typically this means having a separate card that plugs into a PCI slot in a computer that contains one or more co-processors able to handle much of the SSL processing.

References:
http://en.wikipedia.org/wiki/SSL_acceleration

What is XML Signature? (16 of 285 tech notes for 2015)

XML Signature or Digital Signature:

• Provides end 2 end message integrity - gurantee
  
• authentication information about msg originator

To handle SSL shortcomings the XML Signature is used.

XML Signature:

• “hash” the message - 
  
• arbitrary stream of bytes and converts it to a single fixed-size value known as a digest.
  
• A digest is a one-way process: it’s “computationally infeasible” to recreate a message from the hash
  
• or to find two different messages which produce the same digest value.
  
• common hash mechanism is SHA1, the Secure Hash Algorithm

• (read more in the link below)

——————————–

• To hash the message - we need a shared secret key which should be difficult to guess
• use Kerberos
• when 2 entities want to communicate
• a central authority distributes “tickets” that contain a temporary session key 

• Or use public-key cryptography
• private key, known only to the holder
  
• public key, accessible to anyone who wants to communicate with the key holder
  
• anything encrypted with the private key can only be decrypted with the public key, and vice versa 
• (read more about RSA in the link below)

——————————– 

• I want to send message M
• generate a digest, H(M)
  
  
  
• signature  - encrypt the digest with my private key, {H(M)}private-key
• you receive the message, M and the signature
  
• you generate the digest, H’(M)
  
  
  
• decrypt the signature using my public key getting the H(M)
• If H(M)and H’(M) are the same, then we know that M is the same  
  

References:

MSDN - http://bit.ly/1Hnqek1

What is WS-Security (Web Services)? (15 of 285 technotes for 2015)

What is WS Security?

WS-Security addresses how to maintain a secure context over a multi-point message path.

• Secure services beyond SSL over HTTP (HTTPS) (see http://bit.ly/1afA8Kg for more info)
• SOAP header extensions for end-to-end SOAP messaging security 
• Uses
• XML Signature & Encryption - ways to encrypt and sign contents of XML message
• XML Cannonicalization - making XML ready for signing and encrypting
• WS-Security gives a framework to embed the above mentioned technologies into SOAP message - using a transport neutral fashion.

What is SSL (Secure Sockets Layer)? (14 of 285 technotes for 2015)

• SSL is a security protocol for the transport layer.
• A protocol is  guideline to define how an algorithm should be written.
• SSL encrypts the messages between the web server and the browser.

Secure Web Services (13 of 285 technotes for 2015)

Why Web Service security is so important nowadays

1. Interaction between communicating partners increasing from Intranet to Internet
2. Communicating partners are more likely to interact with each other without need for establishing business or human relationship first.
3. Program to program communication increases.
4. Large number of interactions.

Most common way of Interaction - SSL (Secure Socket Layer) used with HTTP i.e. HTTPS.