In raw terms, a service refers to a modular and self-contained piece of software, which has a well-defined functionality expressed in abstract terms independent of the underlying implementation that is accessible at a network point. Basically, any implementation of Service-Oriented Architecture has three fundamental roles: Service provider, Service requester, and Service registry and three fundamental operations: Publish, Find, and Bind.The service provider publishes details pertaining to service invocation with a service registry. The service requester finds the details of a service from the service registry. The service requester then invokes (binds) the service on the service provider. The role of service registry is sometimes also referred to as the service broker because it acts as a service broker between the requesters and providers.
These are the most common security requirements for online systems
Confidentiality: The confidentiality requirement states that any piece of information should not be understood by anyone other than the person for whom it was intended. Message privacy is a key requirement here.
Data Integrity: The integrity requirement states that information should not be altered in storage or transit between a sender and the intended receiver without the alteration being detected.
Authentication: The authentication requirement states that the sender and receiver should be able to confirm each other’s identity and the origin/destination of the information.
Authorization: The authorization requirement ensures that the sender has the required authority to perform the operation. This may range from permission to perform some action to permission for viewing some content.
Non-repudiation: The nonrepudiation requirement ensures that the creator/sender of the information cannot deny at a later stage his or her intentions in the creation or transmission of the information.
Privacy: The privacy requirement is more general than the confidentiality requirement above. It also deals with the question of whether to trust the personal information with a Web site.
Trust: This refers to the confidence in a person or a partner doing the transaction. This concept extends beyond trust in a person accessing an online service to even include participants in business-to-business transactions where trust may be used to refer to the adherence to the contractual agreements between the partners.
Auditing:The ability to know who did what, when and where. This is a key requirement when it comes to detection of possible security breaches.
Availability: The computing resources should be available for genuine users when they wish to access the resource. Denial of Service (DoS) attacks may cause lack of availability, and hence, there is a need to protect against such attacks.
The most common security solutions are described below
Passwords: A password refers to a unique secret series of characters which allows a user to access a computing resource. Ideally a password should be difficult to guess to prevent access to unauthorized users. It is the most common authentication mechanism in online systems.
Encryption: Encryption is the most common security technique to ensure confidentiality in online systems. Essentially it refers to the process of taking a piece of data (called cleartext) and a short seed string (a key) and producing an altered piece of data referred to as ciphertext, which is not understood by anybody who does not know the key. Decryption is the reverse process of converting the ciphertext to cleartext. Typically, encryption process relies on hard to emulate mathematical algorithms involving the key and the cleartext.
Encryption algorithms can be divided into symmetric and asymmetric encryption algorithms. In symmetric algorithms, both the encryption and decryption keys are the same. Hence, they function on the basis of shared secret. In asymmetric algorithms, the encryption and decryption keys form a key pair, in which one key is a private key (which shall be kept a secret) and the other is a public key. If a piece of data is encrypted with the public key, it needs the private key to decrypt. Asymmetric methods distribution of the keys is easy, and hence, public key infrastructure relies on asymmetric methods. Encryption of messages ensures confidentiality by making it difficult to deduce the content of the original message from the encrypted message.
Access Control Lists: These are generic formats of security information concerning permissions to access certain resources or to perform certain tasks. Most often, authorization is provided by usage of access control lists (ACL).
Hashing: Hashing is another important technique used to ensure data integrity in online systems. The idea is to take an arbitrary-sized input data (referred to as a message) and generate a fixed-size output, called a digest (or hash), such that it is nearly impossible to compute or guess the message from the hash. The hash of a piece of data can be used to verify the integrity after an online transfer by comparison with the recomputed hash of the transferred data.
Digital Signature: Digital Signature is an important technique to ensure data integrity and nonrepudiation. Typically, the hash of a message is encrypted with the private key of an entity and is termed as the signature of the data. To ensure that the message received by the receiver is actually sent by the person who signed the message, the signature after decryption with the public key of sender should match the hash.
Digital Certificate: Usage of digital signature in sending a message requires that the receiver knows a priori the sender’s public key. This is a big constraint, and hence, it becomes important to make the public key available of the sender as part of the message to achieve flexibility. However, that opens up the requirement of the trust of the public key sent by the sender, whether it is genuine or not. Hence, to overcome these problems, specialized entities termed as certification authorities are entrusted with the task of signing the public key of senders and generate a special form that can be sent along with a message. This signed form of representation of a public key is termed as a digital signature. By leveraging a third-party certification authority (CA), the problem of public keys is reduced to the receivers having to know the public key of the CA. Popular ways of broadcasting this information of public keys of CA entities include integrating them into the popular browsers or other online systems. Digital certificates are stored in standard formats like the popular X.509 Certificate format. Digital certificates are used for authentication and data integrity in public networks.
SSL: SSL (Secure Sockets Layer) is a Web-based protocol that enables a secure connection between the client and the server. It is based on a series of exchange of keys (and the server digital certificate) between the server and the client to generate a session key that is used to encrypt all the following messages in the session. Typically as part of the protocol, the server certificate is requested by the client allowing the client to ensure communication with the right Web server. Thus, SSL enables channel encryption between the client and the server.
Client-side SSL uses digital certificates of clients enabling them to prove their identity to the Web server. This personal certification attribute, or the client identification, is not very common at the moment due to the cumbersome process involved in maintenance of huge numbers of client certificates.
PKI: Public Key Infrastructure (PKI) refers to a collection of authorities and a system for exchange of digital certificates to entities. A PKI set up typically includes a CA for generating, revoking, or maintaining the digital certificates. It also includes a registration authority (RA) for physically verifying the identity of a certificate requester using physical means like checking against an identity card before directing the CA to issue a certificate. CA uses the concept of Certificate Revocation Lists (CRL) for revoking inactive certificates.
Firewalls: Firewalls are specialized security tools designed to protect an enterprise typically against attacks from the external network. All network traffic between the internal and external network is channeled through it, and the firewall allows only desired traffic as configured. Traffic from internal network to external network can also be filtered in the firewall. The conventional firewalls are typically based on the concept of packet filtering, and they operate on the network layer of the stack.
Code Signing: A popular concept for ensuring security of downloadable code on the network is code signing. Any piece of code including Applets, Jar files, ActiveX controls, and so forth are signed before download is allowed. Thus, digitally signed code after download guarantees that the code really comes from the publisher who signs it and ensures that the content has not been corrupted or altered, so it is safe to run.
Sandbox model: An alternative to code signing, the sandbox model, also applies to downloaded code on the network. Unlike the requirement of signing of every piece of code, it places restrictions on the capabilities of the downloaded code to limit the harm it can do on the client machine. Thus, the sandbox model ensures safety to the client machine by restricting the capabilities of the untrusted code; for example, it is not allowed to look at the file system on the client machine.
Refrences : Securing Web Services: Practical Usage of Standards and Specifications by Panos Periorellis (ed) IGI Publishing © 2008
