SCUR203 Why Do We Need Security Standards?

Transcription

1 SCUR203 Why Do We Need Security Standards? Cristina Buchholz Product Security, SAP Learning Objectives As a result of this workshop, you will be able to: Recognize the need for standardization Understand SAP s position with respect to security standards See how you can contribute to, and influence the standards SAP AG 2003, SCUR203, Cristina Buchholz / 2

2 Why Standards? Lowering total cost of ownership In design, development and maintenance Less learning effort Much less adaptation effort Creating trust Proven, wide in use, not proprietary Everybody uses the same SAP AG 2003, SCUR203, Cristina Buchholz / 3 Why Security Standards? Call Center Document Mgmt Market Analysis SCM ERP Trading e-sales Technical systems PLM E-Procurement SAP AG 2003, SCUR203, Cristina Buchholz / 4

3 Agenda Little helpers the MLs of security SAML DSML XKMS Changing the development platform JAAS Standards for a new technology XML DigSig and XML Encrypt WS Security Aligning identity management to reality Liberty Alliance Who s Who? OASIS, W3C, Open Group Wrap-Up Summary SAP AG 2003, SCUR203, Cristina Buchholz / 5 Agenda Little helpers the MLs of security SAML DSML XKMS Changing the development platform JAAS Standards for a new technology XML DigSig and XML Encrypt WS Security Aligning identity management to reality Liberty Alliance Who s Who? OASIS, W3C, Open Group Wrap-Up Summary SAP AG 2003, SCUR203, Cristina Buchholz / 6

4 SAML Client 1. Login 2. Response 6. Resource Issuer (PDP) 3. Access 4. Pull Assertion 5. Assertion Relying (PEP) PDP: Policy Decision Point PEP: Policy Enforcement Point SAP AG 2003, SCUR203, Cristina Buchholz / 7 DSML ecommerce Application DSML HTTP, FTP SMTP DSML DSML Service LDAP Directory DSML DSML Service LDAP Directory SAP AG 2003, SCUR203, Cristina Buchholz / 8

5 XKMS X-KRSS Registration Revocation Recovery Registration Server Delegation Trust Server X-KISS SAP AG 2003, SCUR203, Cristina Buchholz / 9 Agenda Little helpers the MLs of security SAML DSML XKMS Changing the development platform JAAS Standards for a new technology XML DigSig and XML Encrypt WS Security Aligning identity management to reality Liberty Alliance Who s Who? OASIS, W3C, Open Group Wrap-Up Summary SAP AG 2003, SCUR203, Cristina Buchholz / 10

6 Standardization Topics Java Community Java platforms: Standard Edition, Enterprise Edition, Micro Edition Many Java API wrappings around other standards (Web services, security, transaction handling ) SAP AG 2003, SCUR203, Cristina Buchholz / 11 JAAS JAAS - Java Authentication and Authorization Service - additional package to JDK 1.3, integral part of JDK pluggable and stacked authentication - standardized Interfaces - big variety of JAAS Login Modules available SAP AG 2003, SCUR203, Cristina Buchholz / 12

7 JAAS Authentication Design LoginModule LoginContext Callbacks Configuration (Deployment) Lc.login(); CallbackHandler e.g. HttpRequest, HttpResponse Logon dialog EJB/Servlet Application Container User SAP AG 2003, SCUR203, Cristina Buchholz / 13 Agenda Little helpers the MLs of security SAML DSML XKMS Changing the development platform JAAS Standards for a new technology XML DigSig and XML Encrypt WS Security Aligning identity management to reality Liberty Alliance Who s Who? OASIS, W3C, Open Group Wrap-Up Summary SAP AG 2003, SCUR203, Cristina Buchholz / 14

8 What is a Web Service? A Web service is a software component that can be described, discovered and executed using open Internet standards. SAP AG 2003, SCUR203, Cristina Buchholz / 15 XML, WSDL, UDDI, SOAP and HTTP Service Discovery Service Publication Service Directory UDDI WSDL XML SOAP HTTP Service Requestor Service Invocation Service Provider SAP AG 2003, SCUR203, Cristina Buchholz / 16

9 Web Service Security Data Signed / Encrypted HTTP / XML / SOAP Business Server Intermediary Message Security Intermediary Business Server Point-to-Point Security SAP AG 2003, SCUR203, Cristina Buchholz / 17 XML DigSig and XML Encrypt Business Server Business Server Client XML Sig / Enc Client cert. Client cert. Application WS XML Sig / Enc UDDI Service Registry XKMS Service Key Info. SAML / XACML Services SAP AG 2003, SCUR203, Cristina Buchholz / 18

10 WS-Security (WS-S) Mission statement: WS-Security forms the necessary technical foundation for higher-level security services including Federation within the context of the Web Services Security roadmap SAP AG 2003, SCUR203, Cristina Buchholz / 19 WS-Security Roadmap WS- SecureConversation WS-Federation WS-Authorization WS-Policy WS-Trust WS-Privacy Today WS-Security SOAP Foundation SAP AG 2003, SCUR203, Cristina Buchholz / 20

11 WS Security Scope The scope of the Web Services Security technical committee is the support of security mechanisms in the following areas: Using XML signature to provide SOAP message integrity Using XML encryption to provide SOAP message confidentiality Attaching and referencing security tokens on headers or SOAP messages Carrying security information for potentially multiple, designated actors Associating signatures with security tokens SAP AG 2003, SCUR203, Cristina Buchholz / 21 Standards Being Integrated Access control TC (XACML) XML Common Biometric Format TC (XCBF) Provisioning TC (PSTC) Rights Language TC (XrML) Security Services TC (SAML) XML Signature XML Encryption XML Key Management (XKMS) SAP AG 2003, SCUR203, Cristina Buchholz / 22

12 Agenda Little helpers the MLs of security SAML DSML XKMS Changing the development platform JAAS Standards for a new technology XML DigSig and XML Encrypt WS Security Aligning identity management to reality Liberty Alliance Who s Who? OASIS, W3C, Open Group Wrap-Up Summary SAP AG 2003, SCUR203, Cristina Buchholz / 23 Why is Identity Management a Challenge? SAP AG 2003, SCUR203, Cristina Buchholz / 24

13 Liberty Alliance Project Mission statement: Enable a networked world in which individuals and businesses can more easily conduct transactions while allowing for the privacy and security of identity information SAP AG 2003, SCUR203, Cristina Buchholz / 25 Liberty Alliance Architecture LIBERTY IDENTITY FEDERATION FRAMEWORK (ID-FF) LIBERTY IDENTITY SERVICES INTERFACE SPECIFICATION (ID-SIS) Specifications evolve in parallel and rely upon each other LIBERTY IDENTITY WEB SERVICES FRAMEWORK (ID-WSF) SAML HTTP WSS WSDL XML Enc WAP XML SSL/TLS SOAP XML Dsig SAP AG 2003, SCUR203, Cristina Buchholz / 26

14 Federation Framework Simplified sign-on and account aggregation Seamless single sign-on in the context of federated providers Circles of Trust Identity Provider Service Provider Anonymized query and servicing User SAP AG 2003, SCUR203, Cristina Buchholz / 27 Web Services Framework Interoperable identity-based web services Distributed and non-redundant user storage Service provider retrieves identity information through Identity discovery Attribute Provider Identity Provider Service Provider User sets attribute permissions with the Attribute provider User SAP AG 2003, SCUR203, Cristina Buchholz / 28

15 Service Interface Specification Common identity services Calendar Registration Wallet Address book Identity Provider Circles of Trust Service Provider User chooses among personalized and interoperable identity services User SAP AG 2003, SCUR203, Cristina Buchholz / 29 Agenda Little helpers the MLs of security SAML DSML XKMS Changing the development platform JAAS Standards for a new technology XML DigSig and XML Encrypt WS Security Aligning identity management to reality Liberty Alliance Who s Who? OASIS, W3C, Open Group Wrap-Up Summary SAP AG 2003, SCUR203, Cristina Buchholz / 30

16 OASIS Mission statement: OASIS is a not for profit, global consortium that drives the development, convergence and adoption of e-business standards SAP AG 2003, SCUR203, Cristina Buchholz / 31 W3C Mission statement: The World Wide Web Consortium (W3C) develops interoperable technologies for the Web Universal Access Semantic Web Web of Trust SAP AG 2003, SCUR203, Cristina Buchholz / 32

17 Open Group Mission statement: Guide the development and adoption of industry initiatives and standards SAP AG 2003, SCUR203, Cristina Buchholz / 33 Identity Management What is the link between identity management and the Open Group? Provides background information Defines the business problem Documents the objectives of end users and organizations Proposes common terminology Defines categories of requirements Explores various technology architectures SAP AG 2003, SCUR203, Cristina Buchholz / 34

18 Agenda Little helpers the MLs of security SAML DSML XKMS Changing the development platform JAAS Standards for a new technology XML DigSig and XML Encrypt WS Security Aligning identity management to reality Liberty Alliance Who s Who? OASIS, W3C, Open Group Wrap-Up Summary SAP AG 2003, SCUR203, Cristina Buchholz / 35 SAP Security Standards Stack Trust Relationship Management Liberty Alliance Application security framework SAML WS-Security Transport and communication XML-DSIG XML-Encryption HTTPS GSS-API SAP AG 2003, SCUR203, Cristina Buchholz / 36

19 Agenda Little helpers the MLs of security SAML DSML XKMS Changing the development platform JAAS Standards for a new technology XML DigSig and XML Encrypt WS Security Aligning identity management to reality Liberty Alliance Who s Who? OASIS, W3C, Open Group Wrap-Up Summary SAP AG 2003, SCUR203, Cristina Buchholz / 37 Target Standards lower your TCO SAP is both complying to and driving the security standards You can contribute to, and influence the standards SAP AG 2003, SCUR203, Cristina Buchholz / 38

20 What Next? Use the standards implemented in SAP technology Share your business case with us and we shall find the best solution together SAP AG 2003, SCUR203, Cristina Buchholz / 39 Further Information Public Web: Key Capabilities Security SAP Customer Services Network: Consulting Contact Frank Rambo, NetWeaver Security Consulting (frank.rambo@sap.com) SAP AG 2003, SCUR203, Cristina Buchholz / 40

21 Questions? Q&A SAP AG 2003, SCUR203, Cristina Buchholz / 41 Feedback Please complete your session evaluation and drop it in the box on your way out. Thank You! The SAP TechEd 03 Basel Team SAP AG 2003, SCUR203, Cristina Buchholz / 42

22 Copyright 2003 SAP AG. All Rights Reserved No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. Microsoft, WINDOWS, NT, EXCEL, Word, PowerPoint and SQL Server are registered trademarks of Microsoft Corporation. IBM, DB2, DB2 Universal Database, OS/2, Parallel Sysplex, MVS/ESA, AIX, S/390, AS/400, OS/390, OS/400, iseries, pseries, xseries, zseries, z/os, AFP, Intelligent Miner, WebSphere, Netfinity, Tivoli, Informix and Informix Dynamic Server TM are trademarks of IBM Corporation in USA and/or other countries. ORACLE is a registered trademark of ORACLE Corporation. UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group. Citrix, the Citrix logo, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, MultiWin and other Citrix product names referenced herein are trademarks of Citrix Systems, Inc. HTML, DHTML, XML, XHTML are trademarks or registered trademarks of W3C, World Wide Web Consortium, Massachusetts Institute of Technology. JAVA is a registered trademark of Sun Microsystems, Inc. JAVASCRIPT is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by Netscape. MarketSet and Enterprise Buyer are jointly owned trademarks of SAP AG and Commerce One. SAP, R/3, mysap, mysap.com, xapps, xapp and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and in several other countries all over the world. All other product and service names mentioned are the trademarks of their respective companies. SAP AG 2003, SCUR203, Cristina Buchholz / 43