セキュリティ関連XML規格の紹介

Size: px

Start display at page:

Download "セキュリティ関連XML規格の紹介"

きみとしいしなみ
5 years ago
Views:

1 XML XML Consortium

2 XML XML Signature XML Encryption XKMS Web WS-Security SAML XACML 2003/06/02 2

3 XML XKMS 2.0 W3C:WD A XPath Filter 2.0 W3C: C XML Signature W3C: WS-Security OASIS:WD Exclusive XML C14n W3C: Canonical XML W3C: SAML OASIS: SAML v1.1 OASIS:Last Call SOAP XML Encryption W3C: D XACML OASIS: Decryption Transform W3C: XML B 2003/06/02 3

4 XML Signature XML Signature PKI XML Signature XML 2003/06/02 4

5 XML Signature W3C:XML Signature WG Requirement IETF W3C IETF Working Draft RFC3275 PKCS#7 Detached Enveloped Enveloping 2003/06/02 5

6 2003/06/02 6

7 Signature 0..* SignedInfo SignatureValue KeyInfo Object CanonicalizationMethod SignatureMethod 1..* Reference Transforms DigestAlgorithm DigestValue 2003/06/02 7

8 <Reference> <Transform> 1..* Reference URI Object Transforms DigestAlgorithm DigestValue 1..* Canonical exc-canonical Transform Enveloped Signature Algorithm Decryption Transform Base64 XPath XPath 2.0 XSLT 2003/06/02 8

9 Enveloping <ds:signature> <ds:object> <myap:order/> </ds:object> </ds:signature > Enveloped <myap:order> <ds:signature> </ds:signature > </myap:order> Detached <myap:order> </myap:order> <ds:signature> </ds:signature > <Signature> 2003/06/02 9

10 <Signature xmlns= > <SignedInfo> <CanonicalizationMethod Algorithm= /> <SignatureMethod Algorithm= /> <Reference URI= #Ref1 > <Transforms> <Transform Algorithm= /> </Transforms> <DigestMethod Algorithm= /> <DigestValue>j6lwx3rvEPO0vKtMup4NbeVu8nk=</DigestValue> </Reference> </SignedInfo> <SignatureValue>MC0CFFrVLtRlk..=</SignatureValue> <KeyInfo> </KeyInfo> <Object Id= Ref1 > <myap:order xmlns:myap= > <myap: > X </myap: > <myap:creditcard> <myap:name>takashi Shimoda</myap:Name> <myap:validthru>03-05</myap:validthru> <myap:cardno> </myap:cardno> </myap:creditcard> </myap:order> </Object> </Signature > 2003/06/02 10

11 Interoperability 16 Availability Source:5 Toolkit:12 Java API 2003/06/02 11

12 Canonical XML <CardType vender= Master ></CardType> <CardType vender= Master /> 2003/06/02 12

13 W3C:XML Signature WG ( UTF-8 #xa etc. <CardType vender= Master ></CardType> <CardType vender= Master /> <CardType vender= Master ></CardType> 2003/06/02 13

14 Exclusive XML Canonicalization C14N W3C:XML Signature WG /06/02 14

15 <n0:elem2 xmlns:n0= > <n1:elem1 xmlns:n1= > content </n1:elem1> </n0:elem2> Base Doc. Wrapped Doc. c14n excc14n <n1:elem1 xmlns:n0= xmlns:n1= > content </n1:elem1> <n1:elem1 xmlns:n1= > content </n1:elem1> exc-c14n 2003/06/02 15

16 Enveloped Signature W3C:XML Signature WG /06/02 16

17 XPath <XPath Filter= intersect >//ToBeSigned</XPath Filter> <XPath Filter= subtract >//NotToBeSigned</XPath Filter> <XPath Filter= union >//ReallyToBeSigned</XPath Filter> <ToBeSigned> <NotToBeSigned> <ReallyNotToBeSigned> </ReallyNotToBeSigned> </NotToBeSigned> </ToBeSigned> 2003/06/02 17

18 Decryption Transform for XML Signature W3C XML Encryption WG /06/02 18

19 <ds:transform> <ds:signature> <ds:reference URI= #Ref1 > <ds:transforms> <ds:transform Algorithm= > <dcrypt:except URI= #secret-1 /> </ds:transform> </ds:transforms> <ds:digestmethod Algorithm= /> <ds:digestvalue> j6lwx3rvepo0vktmup4nbevu8nk=</digestvalue> </ds:reference> </ds:signature> 2003/06/02 19

20 XML Encryption XML Encryption XML Encryption XML 2003/06/02 20

21 XML Encryption W3C XML Encryption WG /06/02 21

22 2003/06/02 22

23 EncryptedData EncryptedKey EncryptedType ReferenceList CarriedKeyName EncryptionMethod ds:keyinfo CipherData EncryptionProperties CipherValue CipherReference 2003/06/02 23

24 <myap:order xmlns:myap= > <myap:creditcard> <xed:encrypteddata Id="ED" xmlns:xed=" <xed:encryptionmethod Algorithm="#tripledes-cbc /> <ds:keyinfo xmlns:ds=" <ds:retrivalmethod URI= #EK /> </ds:keyinfo> <xed:cipherdata> <xed:ciphervalue>41a2bdeaxedda468xaegde..</xed:ciphervalue> </xed:cipherdata> </xed:encrypteddata> </myap:creditcard> <xek:encryptedkey Id= EK xmlns:xek= > <xek:encryptionmethod Algorithm="#rsa1_5 /> <ds:keyinfo xmlns:ds=" <ds:keyname> </ds:keyinfo> <xek:cipherdata> <xek:ciphervalue>5+gpvuqntat3uy8pped</xek:ciphervalue> </xek:cipherdata> <xek:referencelist> <xek:datareference URI="#ED"/> </xek:referencelist> </xek:encryptedkey> </myap:order> 2003/06/02 24

25 Interoperability 4 Availability Source:1 MIT Toolkit:4 Baltimore,IBM,Phaos,VeriSign) 2003/06/02 25

26 PKI Public Key Infrastructure 2003/06/02 26

27 SCEP Simple Certificate Enrollment Protocol ASN.1 CRL OCSPv2 DPV Delegated Path Validation/ DPD Delegated Path Discovery/ 2003/06/02 27

28 XKMS 2.0 XML Key Management Specification XKMS PKI PKI 2003/06/02 28

29 XKMS 2.0 OASIS:XML-Based Security Services TC W3C Note (XKMS 1.X) :VeriSign,Microsoft,WebMethod W3C:XML Key Management WG Working Draft 3 K-KRSS Registry X-KISS Locate Validate Web XML Signature <ds:keyinfo> 2003/06/02 29

30 Proxy XKMS XKMS 2003/06/02 30

31 X-KRSS:Register <RegisterRequest> <Prototype> </Prototype> <AuthInfo> </AuthInfo> </RegisterRequest> XKMS <RegisterResult> <KeyBinding> </KeyBinding> </RegisterResult> 2003/06/02 31

32 X-KISS:Locate XKMS <LocateRequest> </LocateRequest> X509 <LocateResult> <ds:keyvalue>rsa Key Value</ds:KeyValue> </LocateResult> X /06/02 32

33 X-KISS:Validate XKMS <ValidateRequest> <ds:keyvalue>rsa Key Value</ds:KeyValue> </ValidateRequest> <ValidateResult> <Status>Valid</Status> <Interval> </Interval> </ValidateResult> 2003/06/02 33

34 Validate Request <Validate Request xmlns=" <Query> <Status>Indeterminate</Status> <ds:keyinfo xmlns:ds=" <ds:keyvalue> <ds:rsakeyvalue> <ds:modulus>y0ezi+pl544o0anacbhof==</ds:modulus> <ds:exponent>aqab</ds:exponent> </ds:rsakeyvalue> </ds:keyvalue> </ds:keyinfo> </Query> Query Respond <Respond> <string>keyvalue</string> <string>validityinteval</string> </Respond> </Validate Request> 2003/06/02 34

35 ValidateResult <ValidateResult xmlns=" <Reslut>Success</Reslut> <Answer> <KeyBinding> <Status>Valid</Status> <ds:keyinfo xmlns:ds=" <ds:keyvalue> <ds:rsakeyvalue> <ds:modulus>y0ezi+pl544o0anacbhof==</ds:modulus> <ds:exponent>aqab</ds:exponent> </ds:rsakeyvalue> </ds:keyvalue> </ds:keyinfo> <ValidityInterval> <NotBefore> T12:00:00</NotBefore> <NotAfter> T12:00:00</NotAfter> </ValidityInterval> </KeyBinding> </Answer> </ValidateResult> Answer 2003/06/02 35

36 Interoperability VeriSign,Entrust Availability Toolkit VeriSign(Java) Entrust(Java) Poupou(.NET) Microsoft(ASP.NET) 2003/06/02 36

37 WS-Security Security Web Service Security Web 2003/06/02 37

38 WS-Security Security OASIS:Web Services Security TC OASIS webservices/020607/j_ws-secure.html Working Draft 11 :IBM,Microsoft,VeriSign..(47 SOAP-SEC:Signature IBM,MS SOAP-SEC:Encryption,Security Token IBM WS-Security,WS-License IBM 2003/06/02 38

39 WS-Security Security Web SOAP XML Signature XML Encryption 2003/06/02 39

40 soap:envelope soap:header soap:body 1..* wsse:security wsse: SecurityToken ds:signature xenc:encryptedkey 2003/06/02 40

41 1..* wsse:security soap:actor SecurityToken UsernameToken BinarySecurityToken SecurityTokenReference ds:keyinfo Username Password 2003/06/02 41

42 SSL SSL:Point to Point HTTPS JFB HTTPS Card WS-Security:End to End WS-Security Security JFB Card 2003/06/02 42

43 Signature Encryption WS-Security: Card Signature/Encryption: Card 2003/06/02 43

44 Availability Toolkit: WS-Security Policy Trust Privacy SecureConversation Federation Authorization IBM Microsoft VeriSign /j_ws-secmap.html 2003/06/02 44

45 SAML Security Assertion Markup Language / Single Sign-On) 2003/06/02 45

46 SAML OASIS: XML-Based Security Services TC : Sun, HP, IBM, Entegrity, Oblix, AuthML Outlook, Securant, S2ML Netegrity, VeriSign, Commerce One, webmethod, X-TASS VeriSign (1.0) (1.0 revision 01) OASIS SAML /06/02 46

47 SAML Password, Kerberos, Secure Remote Password, Hardware Token, SSL/TLS Cert., X.509, PGP, Pull / Push / 3rd Party Security Model SOAP/HTTP Redirection, Proxy, 2003/06/02 47

48 SAML SAML 1.0 Specification Set Complete SAML v1.0 specification set Assertions and Protocol Assertion Schema Protocol Schema Binding and Profiles Security and Privacy Considerations Conformance Program Specification Glossary Draft Profile document WS-Security SAML Token Profile Draft6 2003/06/02 48

49 SAML Policy Policy Policy Credentials Collector Authentication Authority Attribute Authority Policy Decision Point Authentication Assertion Attribute Assertion Authorization Decision Assertion SAML System Entry Authentication Assertion Policy Enforcement Point 2003/06/02 49

50 SAML Pull Model Pull /06/02 50

51 SAML Push Model Push /06/02 51

52 SAML 3rd Party Security Model /06/02 52

53 SAML <samlp:request MajorVersion="1" MinorVersion="0 RequestID= 8xtyzzKqPMLcFswefRIJAL"> <samlp:respondwith>authenticationstatement</samlp:respondwith> <samlp:authenticationquery> <saml:subject> <saml:nameidentifier Name= JFB"/> <saml:subjectconfirmation> <saml:confirmationmethod> </saml:confirmationmethod> <saml:subjectconfirmationdata> utkaryqmytsz= </saml:subjectconfirmationdata> </saml:subjectconfirmation> </saml:subject> </samlp:authenticationquery> </samlp:request> NameIdentifier ConfirmationMethod 2003/06/02 53

54 2003/06/02 54 SAML SAML ( ) xtyzzkqpmlcfswefrijal Assertion NameIdentifier

55 SAML Interoperability OASIS InterOp 12 (Portal Site / Contents Site) Availability Liberty Alliance 1. / (Java / C++) by Internet2(UCAID) Shibboleth Modified Apache/BSD-style license 2003/06/02 55

56 SAML Java API JSR-155 Standard API for SAML RSA Security ( ) RSA [2003/1] 2003/06/02 56

57 XACML extensible Access Control Markup Language /06/02 57

58 XACML OASIS: extensible Access Control Markup Language TC : Entrust, Entegrity, Crosslogix, IBM, XACL IBM OASIS 2003/06/02 58

59 XACML XACL XML Access Control Language IBM XSS4J XACML XACL <xacl> <object href= premium ] /> <acl> <subject><role>requester</role></subject> <action name= read permission= grant /> <condition operation= and > <predicate name= comparestr > <parameter value= eq /> <parameter> <function name= getuid /> </patameter> <parameter> <function name= getvalue > <parameter value= /name /> </function> </parameter> </predicate> </acl> </xacl> 2003/06/02 59

60 XACML XACML Specifications OASIS Standard [18 Feb. 2003] Specification Document Policy Schema Context Schema 2003/06/02 60

61 XACML PEP: Policy enforcement point PDP: Policy decision point PAP: Policy administration point PIP: Policy information point access 11 PEP requester PDP context handler PIP obligations service resource PAP subjects environment /06/02 61

62 XACML PolicySet Policy Combining Algorithm Policy Rule Obligations Target Condition Effect Subjects Resources Actions 2003/06/02 62

63 XACML Effect (Permit) (Deny) Target Match Match Condition True False Rule Effect Not applicable Permit Deny Match Indeterminate Indeterminate No-match True Not applicable No-match False Not applicable No-match Indeterminate Not applicable 2003/06/02 63

64 XACML XACML Context domain-specific inputs xacml.xml domain-specific outputs xacmlcontext/ request.xml PDP xacmlcontext/ response.xml 2003/06/02 64

65 XACML <Rule RuleId= //cons.com/rule/id/1 Effect= Permit > <Description>Sample policy</description> <Target> <Subjects> <Subject> <SubjectMatch MatchId= function:rfc822name-match > <SubjectAttributeDesignator AttributeId= identifier:subject:subject-id DataType= identifier:datatype:rfc822name /> <AttributeValue DataType= identifier:datatype:rfc822name </SubjectMatch> </Subject> </Subjects> <Resources> <AnyResource /> </Resources> <Actions> <Action> <ActionMatch MatchId= function:string-equal > <ActionAttributeDesignator AttributeId= urn:oasis:names:tc:xacml:1.0:action DataType= xs:string /> <AttributeValue DataType= xs:string >read</attributevalue> </ActionMatch> </Action> </Actions> </Target> <Condition FunctionId= function:daytimeduration-greater-than > <Apply FunctionId= function:date-substract > <EnvironmentAttributeDesignator AttributeId= urn:oasis:names:tc:xacml:env:date DataType= xs:date /> <AttributeSelector RequestContextPath= /ctx:request//ctx:resourcecontent/ed:employee/ed:dob DataType= xs:date /> </Apply> <AttributeValue DataType= xs:daytimeduration >20-0-0</AttributeValue> </Condition> </Rule> 2003/06/02 65

66 XACML Request Context <?xml version= 1.0 encoding= UTF-8?> <Request xmlns= urn:oasis:names:tc:xacml:1.0:context xmlns:xsi= xsi:schemalocation= urn:oasis:names:tc:xacml:1.0:context http // > <Subject> <Attribute AttributeId= urn:oasis:names:tc:xacml:1.0:subject:subject-id DataType= identifier:rfc822name > </Attribute> </Subject> <Resource> <Attribute AttributeId= identifier:resource:resource-uri DataType= xs:anyuri > <AttributeValue> </Attribute> </Resource> <Action>< <Attribute AttributeId= urn:oasis:names:tc:xacml:1.0:action DataType= xs:string > <AttributeValue>read</AttributeValue> </Attribute> </Action> </Request> 2003/06/02 66

67 XACML Response Context <?xml version= 1.0 encoding= UTF-8?> <Response xmlns= urn:oasis:names:tc:xacml:1.0:context xmlns:xsi= xsi:schemalocation= urn:oasis:names:tc:xacml:1.0:context http // > <Result> <Decision> Deny> </Decision> </Result> </Request> IBM 2 ContentGuard 5 [2002 9] 2003/06/02 67

68 Links XML Signature: XPath Filter Exclusive XML Canonicalization XML Encryption: Decryption Transform: /06/02 68

69 Links WS-Security ibm.com/jp/developerworks/webservices/020607/j_wssecure.html XKMS SAML XACML /06/02 69

セキュリティ関連XML規格の紹介

セキュリティ関連XML規格の紹介 XML SAML XACML 2002 8 23 XML SAML XACML 2002/8/23 1 XML XKMS 2.0 W3C: 2002-03-18 A XML Signature W3C: 2002-02-12 C SAML OASIS: 2002-06-01 WS-Security OASIS: 2002-04-05 XPath Filter 2.0 Exclusive XML C14n