Web Services Security: Message Level Security

5 Questions

What is the purpose of the WS-Security framework?

To provide security protection at the message level

What does the WS-Security Framework protect against?

Message disclosure

A security token is a credential that proves the identity, such as ________.

X.509

Match the following WS-Security options with their descriptions:

User name = A security option containing a user name and a password Binary = Contains a certified ticket like Kerberos XML = Send a reference to a security token instead of the token itself Token reference = Contains a URI for a security token

XML Encryption ensures the confidentiality of SOAP messages.

True

Study Notes

Message Level Security

Message-Level Security provides security protection above the transport level, using the WS-Security framework.
WS-Security defines SOAP headers that include necessary information to protect messages.

WS-Security Framework

A set of specifications that augment SOAP message headers to incorporate solutions to common security threats.
Protects against message alteration and message disclosure.
Designed to work with SOAP 1.1 and SOAP 1.2.
Defines security tokens and encryption mechanisms that go in the SOAP header.

Security Tokens

A credential that proves identity.
Examples: X.509, Kerberos, SAML.
A web service might request additional proof after accepting the credential.
A digital signature might be sent along with the certificate to authenticate the identity.

Managing Security Tokens

A username accompanying a password.
A ticket is encrypted by its issuer using a key that the web service can verify.

WS-Security Options

WS-Security explicitly defines four options:
- Username
- Binary
- XML
- Token reference
The simplest way is to send a security token containing a user name and a password.

Binary Security Token

Contains a certified ticket (for example Kerberos).

Security Token Reference

Send a reference to a security token rather than the token itself.
The element contains a URI for a security token.

Message Integrity

Leveraging XML signature in conjunction with security tokens to ensure messages are transmitted without modifications.
Signatures might be added by SOAP intermediaries.
The element provides information to the service provider as to which key was used to create a signature.

XML Encryption

Provides confidentiality in conjunction with security tokens to keep portions of SOAP message confidential.
The encryption information references a security token when that token is used to encrypt the data.

WS-SecurityPolicy

Provides a way for the requestor and provider to agree on which options are being used.