XML Document Security

1
MSCS 282 - Topics in Computer Science Advanced
Database Systems

• XML Document Security
• using Encryption and Signature
• Monday, Dec. 5, 2005

2
Team members

• Sreekanth Balasubramanian
• Dan Piessens
• Wei (JW) Yang
• Paula Stroud

3
Presentation Overview

• Introduction of XML Security - Paula
• Concepts of Encryption and Signature - Sreekanth
• Solutions for XML Security - JW
• Conclusion - JW
• Demo - Dan
• Questions

4
Introduction of XML Security

• The needs for XML security
• Popularity
• Banks, medical data, etc.
• Plain text
• Needs to be protected
• Container

ltPATIENTgt ltSSNgt123lt/SSNgt
ltNamegtJohnlt/Namegt ltInsurancegtBlt/Insurancegt
lt/PATIENTgt ltPATIENTgt ltSSNgt234lt/SSNgt
ltNamegtClarklt/Namegt ltInsurancegtClt/Insurancegt
lt/PATIENTgt ltCASEgt ltCaseIdgt1lt/CaseIdgt
ltSSNgt123lt/SSNgt ltInjuryDategt10/14/2003lt/InjuryDa
tegt lt/CASEgt ltCASEgt
5
Introduction of XML Security

• XML security road map

6
Introduction of XML Security

• Two aspects of XML security
• XML document security
• Using XML (Container) to extend the capability of
  security

7
A fictitious medical XML database

• The tree structure for the Database
• Business requirement

8
The Concept of Encryption and Signature

• Encryption
• Signature

9
The Concept of Encryption and Signature

• Encryption
• Basic introduction encryption
• Confidentiality

ltPATIENT secure"true" access"nurse"gt ltSSNgt123lt
/SSNgt ltPNamegtJohnlt/PNamegt ltHealthPlangtBlt/HealthP
langt lt/PATIENTgt
ltPATIENT secure"true" access"nurse"gt
ltSSNgtDXlqFB3wPA4N4sz8YKYD/EkT/hUcjzQr2vyHGYzXSR8
lt/SSNgt ltPNamegtVzOkp91ZAYmeFB/aIG2M8GvYWfK7
HQSC6Ivvc07Z1slt/PNamegt
ltHealthPlangt14R0Rn4YGde9zAiPIDdF9lOyVFILCK64WD767l
fofv4lt/HealthPlangt lt/PATIENTgt
10
The Concept of Encryption and Signature

• Signature
• Basic introduction
• Integrity
• Guarantee the data has not changed
• Authentication
• You are who you say you are.
• Nonrepudiation
• You can not deny your signatures

• ltSignatureValuegt
• oPuSA60oGySLDnDULQeGumQmP/0uwfDmv7TLGMJLEW9owJVnAD
  4jB2xZ4HnQLkxcdioT3sQeXiL3hUwDsiO/4wD2b623DNmXti
  02biyZV/psX8w5d2X7TrD8QXQi95KrsJNx1keQiEGSugnw/cCD
  qTKiIICkChD0SqtiIaPbI
• lt/SignatureValuegt

11
XML Encryption and Signature vs. Regular
Encryption and Signature

• Extendable
• Flexible
• Granular

12
Our Implementation, with Solutions for XML
Security

• Role base access control
• Roles
• Keys
• User ID and Key mapping
• Manifest
• Signature

13
Our Implementation, with Solutions for XML
Security

• The tree structure for the Database
• Business requirement

14
Our Implementation, with Solutions for XML
Security

• Create Roles and Keys

Clerk
Nurse
Doctor
15
Our Implementation, with Solutions for XML
Security

• User ID map to Roles

16
Our Implementation, with Solutions for XML
Security

• - Manifest

17
Our Implementation, with Solutions for XML
Security

• - Structure

Medical DB
Manifest
Signature
18
Conclusion

• XML security road map

19
Demo
20
Questions