Abstract Securing Web Services with XML aware digital signatures

Securing Web Services with XML aware digital signatures

Sabbir Ahmed and Leisa Armstrong

School of Computer and Information Science, Edith Cowan University

E-mail: sahmed21@https://www.doczj.com/doc/524441372.html,.au, l.armstrong@https://www.doczj.com/doc/524441372.html,.au

Abstract

The evolution of web services has facilitated the integration of business processes scattered across different geographical locations of the world. Along with the benefits that web services provide for high value online transactions, it also poses some security threats. A new standard of XML aware digital signatures, recommended by W3C, provides authentication, data integrity, and support for non-repudiation. Since web services communicate with each other through XML formatted messages, a solution may be found through the use of XML aware digital signatures in identifying the requester web service, validating message integrity and conforming non-repudiation thereby. This research project aims to form a theoretical framework and prototype a solution that will use XML aware digital signatures to ensure proper security in web services messaging.

Keywords

Web services, xml, digital signatures, machine to machine identity management, non-repudiation

INTRODUCTION

Current trends in performing business-to-business transactions and enterprise application integration (EAI) have been extended to the use of web services. Web services facilitate the incorporation of different business processes belonging to various organisations into one single application (IBM developerWorks, 2003a). This article details the evolution and architecture of web services since the emergence of object oriented paradigm and assesses what factors influence the deployment of secure web services. A review of research on web services security suggests that digital signatures may be suitable to mitigate the current security concerns of web services. A research study is currently underway to investigate whether the use of XML aware digital signatures can mitigate current security concerns with web services. The research study aims to determine if the security of web services messaging technology can be improved through the introduction of third party applications which use XML digital signatures. The research will firstly determine whether XML digital signatures improve machine to machine identity management and secondly whether machine to machine identity management methodologies can be successfully integrated to fulfil the security requirement of non repudiation.

BACKGROUND

The world of application and system development has seen the facilitation of code re-use through the introduction of the Objected Oriented (OO) paradigm. Concepts like inheritance, polymorphism and data abstraction presented by OO architecture have provided software developers with an enormous advantage in component based software development (Alhir, 1998). While the OO paradigm has enormous advantages, there are also limitations and innovative techniques are required to overcome these limitations (Champion, Ferris, Newcomer and Orchard, 2002). The most significant limitation is that all the classes in an Object Oriented based application have to be immediately accessible by either residing within the same project; or the API has to be downloaded and placed in the class path; or the compiled DLL needs to be referenced (Champion et al., 2002). This forces all components of an application to reside on one machine and therefore, fails to integrate business processes of the various organisations into one single solution.

With the rapid growth of enterprises and spread of business opportunities, computing with an organisational perspective requires integration of far-located business processes. The inability of the Object Orientation paradigm to achieve this goal imposes the need for a mechanism which allows fragmented software teams to re-use components existing elsewhere on another network machine. According to IBM developerWorks (2003), the evolution of web services was suitable for facilitating the communication of such components. Though Common Object Request Broker Architecture (CORBA) is also a vendor-neutral and language-agnostic

protocol that is capable of performing similar operations, it is limited by its complicated, ad-hoc way of utilizing the flexibility of the Internet. Therefore, web services represent the next step beyond CORBA by leveraging the service-centric distributed nature of the Internet. The XML based messaging system used in web services can allow subscription-based access to organisation’s online services by other business partners. The adoption of web services as a standard messaging architecture could eliminate the expensive legacy system integration processes of Enterprise Application Integration (EAI), by wrapping the legacy applications with web service component interfaces (IBM developerWorks, 2003a).

THE EMERGENCE OF WEB SERVICES

A recent survey conducted by Evans Data Corporation in the USA concluded that up to 40 percent of web developers surveyed, are currently using some form of web services technology (https://www.doczj.com/doc/524441372.html,, 2002). Dixit (2002 cited in https://www.doczj.com/doc/524441372.html,, 2002) concluded that nearly 82 percent of survey respondents considered using the “wonders of Web services” as a minor component of their existing applications, whereas nearly 18 percent of the developers were thinking of using a fully featured web services implementation, in all of their forthcoming applications. There has also been a reported increase in the expenditure on web services, despite the current depressed IT business environment. Lange (2003) has predicted a rise in expenditure on web services in the USA from nearly $1.2 billion in 2003 to a surprising $21 billion by 2007.

IBM developersWorks (2003a) defines web services as programs that accept requests in XML format from other systems across the Internet or Intranet via lightweight and vendor-neutral communications protocols. For a web service to be implemented, the following processes must be competed. The web service application that requires access to the remote program sends a method with its arguments through a Remote Procedure Call (RPC). The lightweight, vendor-neutral protocol that is used for web service method calls is known as Simple Object Access Protocol (SOAP) (Champion, Ferris, Newcomer and Orchard, 2002). Each call is packaged in a SOAP message that makes use of XML document structure to contain all the information necessary to process its content. On receipt of the SOAP message, the remote application begins to process the content of the message and a response is sent back to the caller in XML format (IBM developersWorks, 2003a).

THE SECURITY CRISIS AND RISE OF XML DIGITAL SIGNATURES

Although the IT industry is discussing a broader scale implementation of web services on one hand, other parts of the IT industry specify that major security issues are restricting them from adopting this evolution in distributed computing. Dixit (2002 cited in https://www.doczj.com/doc/524441372.html,, 2002) reported that 20 percent of those who participated in their survey had faced some sort of security breach within their organisation when using web services. Schmelzer (2003, cited in Parizo, 2003) asserts, the Secure Socket Layer that has gained great popularity in securing E-Commerce sites, merely provides these businesses with a transport time secured commutation and the data is therefore, left unprotected on the server side. Simon, Madsen and Adams (2001) suggest it is unlikely that data would be tempered during transmission; moreover identity management and non-repudiation issues have been looked over in the deployed version of SSL. This has been a concerning issue for companies wanting to deploy web services solutions to perform high value business transactions.

As a result of great industry discussion, it has been proposed that there is a need for the development of a standard that provides a means of transforming thoroughly secured digital data. The new standard of digital signatures for XML documents developed by W3C and IETS provides authentication, data integrity, and support for non-repudiation to the data that has been signed. An excellent feature of this standard is the ability to sign a uniquely identified element of the XML tree, rather than the complete document (Simon, Madsen and Adams, 2001). The verification algorithm is designed to indicate the originator of the XML document and thereby revealing the sender’s identity.

IMPROVING WEB SERVICES SECURITY

It is clear that for a successful adoption of web services technology and the facilitation of the application-to-application transaction; improvements are needed in web service security. A review of literature has concluded

that there are different means of identity management and non-repudiation for low value consumer-to-application transactions. The existing methodologies are cost-effective and can provide sufficient security, only in case of low value consumer to application transaction. The applicability of the new standard of XML digital signatures in application-to-application commercial transactions has immense potential and substantial probabilities. This is because, the emerging trend of application-to-application transaction is the usage of web service requests and responses using XML formatted data elements.

The research study currently underway is investigating the technical requirements and methodologies of a third-party application, designed to manage identities of the machines and prevent repudiation for machine-to-machine high value commercial transactions. As a result of substantial expansion in the deployment of web services in the Industry, a number of IT corporations are also researching web service technologies. This study expands on previous research, carried out by IBM and is utilizing the IBM security suite as an initial starting point for the development of a prototype tool. All signature algorithms used within the proposed research, will be acquired from W3C sites through the use of RPCs, as an alternative to having to implement new algorithms. The boom of web-based applications and the drive to make information accessible world wide, has forced corporations to use a strong and scalable security infrastructure (Stanek, 2004). Nikander (1999) divides the security requirements that form the basis of an ideal corporate security infrastructure into three distinct parts: authentication, integrity and confidentiality.. As far as web services are concerned, Stanek (2004) asserts that web services like web-based applications, also need to meet the basic security requirements of authentication, integrity and confidentiality for its successful uptake by Industry.

Organisations like W3C, Organization for the Advancement of Structured Information Standards (OASIS), and the Liberty Alliance have been working to develop protocols for web services messaging (Loeb, 2001). In fact, the number of standards and protocols emerged, is so large and has originated from so many disparate sources that, Kunene (2004) suggests, confirming that web services of all types can communicate with each other is a major concern. To that end, Kermaier (2004 cited in Kunene, 2004) suggested that there are three XML security standards that he believes are fairly mature and well suited to implement web services security today. These standards include XML signature and XML encryption which are both W3C recommendations; and XML Key Management Specification 2.0 (XKMS) which is currently a W3C working draft. Loeb (2001) asserts that “XML signatures have been designed with the multiple goals of providing integrity, message authentication, and signer authentication services for data of any type, whether located within the XML that includes the signature or elsewhere.”Further investigation by Salz (2003) has presented similar conclusions to Loeb (2001), concerning the goals of XML digital signatures.

The idea of non-repudiation in the case of consumer-to-application transactions is to avert the merchant, along with the purchaser from denial of the committed operation (Tsai, 2003). In relation to formal technical standards and guidelines, Tsai (2003) concludes that little importance has been given to non repudiation and procedures for seamless implementation have not yet been defined. Amongst the techniques that attempt to provide non-repudiation, Tsai (2003) concludes that digital signatures are the most suitable and viable alternative to replace traditional signatures in consumer to application data processing. However, research studies have concluded that such an attempt to achieve non-repudiation with SSL is inadequate for web services messaging (Shin, 2003). Shin (2003) rationalises this due to SSL’s being transport-level security scheme as opposed to a message-level scheme and inability to provide element-wise signing.

In the context of “federated identity management”, Lasance (2003) asserts that enterprises need a mechanism to maintain identity-based policy in this loosely coupled world of web services, where the identity data may need to be shared across organizational boundaries. Chanliau (2004) suggests that the use of security objects or tokens to represent entities may be a possibility. The WS-Security specification developed by OASIS, to ensure proper security of web services, supports various security tokens including X.509 certificates (Chanliau, 2004). Secure propagation of identity information of web services across organisations, through such security tokens (X.509) is being investigated in the current research investigation.

Many organisations are currently working on developing tools and techniques which provide some type of security mechanism in support of web service based applications. For example, Westbridge Technology Inc. (Parizo, 2003) has investigated the methodologies of developing rule-based authorization software that would enable a web service to identify a pre-approved web service request. Software corporations such as IBM and Microsoft have released a number of security white papers (IBM developersWorks, 2003b) which have focussed on the issue of web service security concerns. A number of companies such as Netegrity Inc., VeriSign Inc., RSA Security Inc., and Oblix Inc., have already gone a long way to exhibit their commitment in web services security by offering illustrative identity management products (Parizo, 2003).

RESEARCH IN PROGRESS

The current research study has adopted a grounded theory as its principle research methodology (Martin and Turner 1986). The studies objective is to form a descriptive and explanatory theory, regarding the probabilities of utilising XML aware digital signatures in machine to machine identity management and preventing repudiation of SOAP messages. Other research methodologies have also been described for Information Technology implementation (Ginzberg 1981, Markus 1983); however these methodologies concentrate on the development part of the software and focus comprehensively on user relations. Since the users of the proposed study would be pre-programmed machines and underlying theory development would be critical as per the probability identification, the traditional view of information technology implementation is considered less applicable.

The research study consists of two distinct parallel phases; prototyping a third party tool and theory formation. The prototyping phase of the study focuses on the analysis, design and construction of a third party tool, to generate data, with an aim to attest the validity of the usage of XML aware digital signature. The prototype tool would reside in multiple machines, be integrated with “dummy” web services and be used to study the maturity of the proposed hypothesis. The tool is independent of the programming language with which the web services are written. Web services used in the research experiments are based on both Java and .Net framework, depending on the strategic information architecture of the provider.

Experiments will be carried out to establish the susceptibilities of web services (dummy representatives) deploying common security measures in place (SSL for example). This would form a base line, to gauge what improvements in security the study could achieve. In order to make conclusions as to the general suitability of XML aware digital signatures, in improving the security of web services and in particular, recognising the identities of machines along with preventing repudiation, a number of variables have been identified to determine whether the prototype tool has been successful in securing the web service information. Suitability will be assessed based on whether the prototype tool meets the following criteria; verifies the requestor of the messages, verifies the message integrity, verifies the signatures validity, separates the data and signature element, ensures the creator and sender are the same, ensures the sender can not refuse sent messages, ensures the sender can not claim sent messages are tempered, confirms the machine identity, repudiation and assures suitability. Each criteria would be measured under two scenarios, firstly, with the dummy web services deploying existing security mechanisms and secondly, with the web services deploying the prototyped security mechanism. Data generated from these replicated experiments will be used to refine the theory suggesting the appropriate mechanism of securing web services messaging.

CONCLUSIONS

The emergence of web services as a means facilitate the exchange of business data has a number of benefits including the ability to support high value transactions. However it is clear that the IT industry is concerned by the security threats. This article has demonstrated that one possible solution is the use of the new standard of XML aware digital signatures, recommended by W3C. This standard can provide authentication, data integrity, and support for non-repudiation. Since web services communicate with each other through XML formatted messages, a solution may be found through the use of XML aware digital signatures in identifying the requester web service, validating message integrity and conforming non-repudiation thereby. The research currently underway proposes the prototyping of a solution that uses XML aware digital signatures to ensure proper security in web services messaging.The research study described in this article is in progress and will be completed by the end of 2004.

REFERENCES:

Alhir, S. S. (1998, October 23). The Object-Oriented Paradigm.Retrieved July 28, 2004, from

https://www.doczj.com/doc/524441372.html,/~salhir/TheObjectOrientedParadigm.pdf

Champion, M.; Ferris, C.; Newcomer, E.; & Orchard, D. (2002, November 14). Web Services Architecture. Retrieved July 27, 2004, from https://www.doczj.com/doc/524441372.html,/TR/2002/ WD-ws-arch-20021114/

Chanliau, M (2004, May 06). Getting a grip on federated identity. Retrieved May 6, 2004, from

https://www.doczj.com/doc/524441372.html,/developmenttopics/development/webservices/story/0,10801,92737,00.html Ginzberg, M.J. (1981, April). Early Diagnosis of MIS Implementation Failure: Promising Results and Unanswered Questions. Management Science, 27(4), 459-478.

IBM developersWorks (2003a). XML Web services fundamentals. Retrieved April 10, 2004, from

https://https://www.doczj.com/doc/524441372.html,/developerworks/education/ws-intwsdk51/ws-intwsdk51-2-1.html

IBM developerWorks (2003b). IBM WebSphere SDK for Web Services (WSDK) Version 5.1. Retrieved May 9, 2004, from http: //https://www.doczj.com/doc/524441372.html,/developerworks/webservices/wsdk/

https://www.doczj.com/doc/524441372.html, (2002). Study: Web services, security top developer concerns. Retrieved April 10, 2004, from https://www.doczj.com/doc/524441372.html,/4605/020424webservicessecurity/page_1.html

Kunene, G. (2004). XML Standards Provide Web Services Security. Retrieved April 13, 2004, from

https://www.doczj.com/doc/524441372.html,/security/Article/11934/1954?pf=true

Lange, L. (2003). Web Services Security Gets Serious. Retrieved April 15, 2004, from

https://www.doczj.com/doc/524441372.html,/tech/security/20030129_security

Lasance, M. (2003). Identity Management and Web Services: The need for a more federated approach to identity management. Retrieved May 5, 2004, from https://www.doczj.com/doc/524441372.html,/arts/899_maxware.htm

Loeb, L. (2001). XML signatures: Behind the curtain. Retrieved May 2, 2004, from http://www-

https://www.doczj.com/doc/524441372.html,/developerworks/library/s-digsig.html

Markus, M. L. (1983, June). Power, Politics, and MIS Implementation. Communications of the ACM, 26(6), 430-444.

Martin, P.Y. & B.A. Turner (1986). Grounded Theory and Organizational Research. The Journal of Applied Behavioral Science, 22(2), 141-157.

Nikander, P. (1999, November). IPSEC - Internet Protocol Security. Retrieved May 7, 2004, from

http://www.tml.hut.fi/Tutkimus/IPSEC/

Parizo, E. B. (2003). Identity, authentication key to Web services security. Retrieved April 21, 2004, from https://www.doczj.com/doc/524441372.html,/originalContent/0,289142,sid26_gci929656,00.html

Salz, R. (2003). Understanding XML Digital Signature. Retrieved May 3, 2004, from

https://www.doczj.com/doc/524441372.html,/library/default.asp?url=/library/en-us/dnwebsrv/html/ underxmldigsig.asp

Shin, S. (2003, March 18). Secure Web services. The upcoming Web services security schemes should help drive Web services forward. April 12, 2004, from https://www.doczj.com/doc/524441372.html,/javaworld/jw-03-2003/jw-0321-wssecurity-tote_p.html

Simon, E.; Madsen, P. & Adams, C. (2001). An Introduction to XML Digital Signatures. Retrieved April 25, 2004, from https://www.doczj.com/doc/524441372.html,/pub/ a/2001/08/08/xmldsig.html

Stanek, R (2004, April 20). Future of Web Services Expert(s). Retrieved May 8, 2004, from

https://www.doczj.com/doc/524441372.html,/ateQuestionNResponse/0,289625,sid26_cid582964_tax294589,00.html Stylus Inc. (2004). Software Development Life Cycle. Retrieved April 28, 2004, from

https://www.doczj.com/doc/524441372.html,/Common/Concerns/SoftwareDevtPhilosophy.php

Tsai, C. (2003). Non-Repudiation In Practice Retrieved April 1, 2004, from

https://www.doczj.com/doc/524441372.html,.tw/iwap/proceedings/proceedings/sessionD/6.pdf

COPYRIGHT

Sabbir Ahmed and Leisa Armstrong ? 2004. The author/s assign the We-B Centre & Edith Cowan University a non-exclusive license to use this document for personal use provided that the article is used in full and this

copyright statement is reproduced. The authors also grant a non-exclusive license to the We-B Centre & ECU to publish this document in full in the Conference Proceedings. Such documents may be published on the World Wide Web, CD-ROM, in printed form, and on mirror sites on the World Wide Web. Any other usage is prohibited without the express permission of the authors

SAP开发webservice接口教程

SAP开发webservice接口教程 在client=100中进行开发： 1.创建RFC函数 SE80，在函数组下，右击->创建，创建函数模块，填写函数模块名称及描述。 2.函数属性标签页，选择“远程启用的模块”，其余默认不变。 3.函数导入标签页，需要添加调用时传入的参数（表），“传递值”需勾选。 表类型：ZSHR_EMPLOYEER_T （需要自己创建） 行类型：ZSHR_EMPLOYEER （需要自己创建）

4.函数导出标签页，需要添加调用返回的参数（表），“传递值”需勾选。 表类型：ZSHR_EMPLOYEER_OUT_T （需要自己创建） 行类型：ZSHR_EMPLOYEER_OUT （需要自己创建） 5.函数源代码标签页，需要写代码实现把传入的数据保存在透明表中。 至此，函数创建完成。 6.创建Web Services 右击包名创建企业服务，进入如下页面，选择“Service Provider”，因为我们是服务提供者，点击“继续”。

7.选择“Existing ABAP Object (Inside Out)”，点击“继续”。 8.给服务起名，并填写描述，点击“继续”

9.选择“Function Module”，点击“继续”。 10.填写我们第一步创建的函数，并勾选“Map Name”，点击“继续”。 11.SOAP Appl默认不变，Profie下拉框选择第四个选择，即不进行权限认证。点击“继续”。 12.填写对于的包和请求，点击“继续”。 下一步，直接点击“完成”。服务创建成功。

13.配置SOA 使用T-CODE：soamanager，进入web页面的SOA管理（client=100）。 14.点击“简化Web服务配置”，进入如下设置页面，点击“执行”，从列表中找到自己创建的 服务，勾选第一个checkbox，User Name/Password(basic)，点击列表左上角的“保存”，之后页面右上角的“返回”按钮，返回首页。 这一步设置，代表我们只设置用户名/密码的调用认证方式。

JSP填空题和判断题

填空题 1．W3C是指___万维网联盟_______。 2．Internet采用的通信协议是___TCP/IP___。 3．当今比较流行的技术研发模式是__C/S__和__B/S__的体系结构来实现的。 4．Web应用中的每一次信息交换都要涉及到__服务器_和_客户端__两个层面。 5．HTML文档的开头和结束元素为_______。 6．表格定义中使用的子标记的含义为___单元格___。 7．将一个图像作为一个超级链接，用到了____标记。 8．input表单域表示一个文本框时，它的type属性应该赋值为__text____。 9．URL是Uniform Resource Locator的缩写，中文称之为统一资源定位器。 10．超级链接标记的href属性取值为链接的目标地址。 11．一个完整的JSP页面是由普通的HTML标记、JSP指令标记、JSP动作标记、变量声明与方法声明、程序片（Scriptlet）、表达式（）、注释（Comment）7种要素构成。 12．JSP页面的基本构成元素，其中变量和方法声明（Declaration）、表达式（Expression）和Java程序片（Scriptlet）统称为JSP脚本元素。 13．指令标记、JSP动作标记统称为JSP标记。 14．“<%!”和“%>”之间声明的方法在整个页面内有效，称为页面的成员方法。 15．在“<%!”和“%>”之间声明的变量又称为页面成员变量，其作用范围为整个JSP页面。16．JSP页面的程序片中可以插入HTML 标记。 17．当JSP页面的一个客户线程在执行synchronized 方法时，其他客户必须等待。 18．JSP页面中，输出型注释的内容写在“”之间。 19．JSP声明函数时，如果在前面加上_synchronize 关键字，功能是当前一个用户在执行该方法时，其他用户必须等待，直到该用户完成操作。 20．Page指令的属性Language的默认值是java 。 21、在Error.jsp页面中，要使用Exception对象，必须设置的指令是<%@page isErrorPage = “true”%>. 22、要使java bean在整个应用程序的声明周期中，被该应用程序中的任何JSP文件所使用，则该java bean 的Scope属性必须设置为application 。 23、在Servlet中，主要使用HttpServletResponse类的重定向方法sendRedirect 方法实现重定向，以及使用RequestDispatcher类的转发方法forward 方法实现转发功能。 24．out对象的__ out.flush()_____方法，功能是输出缓冲的内容。 25．JSP的__session___对象用来保存单个用户访问时的一些信息。 26．response对象的_sendRedirect(URL url)___方法可以将当前客户端的请求转到其他页面去。 27．当客户端请求一个JSP页面时，JSP容器会将请求信息包装在__request__对象中。 28．response.setHeader（“Refresh”, “5”）的含义是指页面刷新时间为5秒__。 29．在JSP中为内置对象定义了4种作用范围，即Application Scope 、Session Scope 、Page Scope 和Request Scope 四个作用范围。 30．表单的提交方法包括___post_______和____get______方法。 31．表单标记中的__action___属性用于指定处理表单数据程序url的地址。

Web Services业务接口规范说明书

XXXX系统 Web Services业务接口规范说明书 拟制 审核 会签 批准 【公司名称】

版本历史

目录 1.范围 (1) 2.术语、定义和缩略语 (1) 2.1 术语、定义 (1) 2.2 缩略语 (1) 3.接口设计 (1) 3.1 接口公共参数 (1) 3.1.1请求参数 (1) 3.1.2返回参数 (2) 3.2 业务功能接口 (3) 3.2.1业务模块1 (3) 4.MD5加密 (6) 5.参考文献 (6)

1.范围 本规范文档主要适用于XXXX系统和其它业务系统信息数据的接入。 2.术语、定义和缩略语 2.1术语、定义 2.2缩略语 3.接口设计 3.1接口公共参数 接口服务器通过：http://IP:port/EIP/WebService/ 连接服务器，同时对外提供业务功能接口，接收的参数和返回的参数都用一定的xml格式进行封装。 3.1.1请求参数 1.请求类型为String类型