WS-SecureConversation

1
WS-SecureConversation

• Vidya Iyer
• 3/11/06

2
Web services
3
(No Transcript)
4
SecureConversation

• End-to-end security
• Leverages SSL, and Kerberos
• Leverages XMLENC and XMLDSIG
• Establishes contexts for convenient multi-message
  communication
• Initial overhead to establish context, then
  faster communication

5
Terms

• Security Token security related information
  (ie. X.509 cert, Kerberos ticket, username)
• Security Context established authenticated
  state, and related keys
• Security Context Token URI representation of
  Security Context

6
Creating Secure Contexts
7
Changing contexts

• Amending, Renewing, Cancel contexts
• Requester sends Amend URI http//schemas.xmlsoap.o
  rg/ws/2005/02/trust/RST/SCT/Amend
• And proof of possession of key
• Recipients authenticate request and update their
  context
• Same for Renew, Cancel

8
Deriving keys

• Common to use SecureContexts to agree on
  pseudorandom generators to derive keys
• Uses DeriveKeyToken syntax
• Syntax is agnostic to key derivation scheme
• No need to send key material

9
Benefits over SSL

• End-to-end security
• XML aware
• Selective encryption
• Easier to nullify existing contexts

10
Questions?