sec（ ).ppt

Size: px

Start display at page:

Download "sec（ ).ppt"

こうざぶろうふしはら
5 years ago
Views:

1 XML XML XML WSS Web Service Security - 2 -

2 XML Cont. XML Apache Project ( ) - 4 -

3 XKMS XML SAML SSO SAML XML XML Web XML XML - 6 -

4 - 7 - XKMS 2.0 W3C: XML DSS OASIS:CD A XPath Filter 2.0 W3C: C SAML 2.0 OASIS:CD XML-Signature W3C: RFC Exclusive XML C14n 1.0 W3C: Canonical XML 1.0 W3C: RFC SAML 1.1 OASIS: WSS OASIS: D XML Encryption W3C: XACML OASIS: XACML 1.1 OASIS:CS XACML 2.0 OASIS:CD SOAP B Decryption Transform W3C: XML

5 2001 XML Encryption XML-Signature Exclusive XML C14n Canonical XML XKMS WSS SAML XACML DSS W3C (2002/3/4) W3C (2002/2/12) W3C (2002/5/24) W3C (2001/3/15) W3C 2001/3/30) W3C (2002/3/18) OASIS 2002/7/1) OASIS (2002/7/1) 2002 W3C (2002/12/10) W3C (2002/7/18) WD W3C (2003/4/18) (2002/4/5) WD11 OASIS (2003/3/3) OASIS (2002/11/5) LC OASIS (2003/5/3) OASIS (2003/2/6) 2003 W3C (2004/4/5) OASIS (2004/4/6) OASIS (2003/9/2) WD13 OASIS (2004/5/31) CS OASIS (2003/8/7) WD11 OASIS (2004/5/14) WD21 OASIS (2004/5/11) 2004 CD04 OASIS (2004/12/6) CD03 OASIS (2004/12/14) CD OASIS (2004/06/28) LC:Last Call / CS:Committee Specification / WD:Working Draft / CD:Committee Draft SAML XACML XKMS WSS XML-Signature <KeyInfo> XML Encryption

6 WSS (Web Services Security) WS-Security WSS (Web Service Security) OASIS Web Services Security TC -open.org/committees/wss/ OASIS Core SOAP Message Security 1.0 (WS-Security 2004) OASIS Username Token Profile 1.0 OASIS X.509 Token Profile 1.0 OASIS SAML Token Profile 1.0 OASIS, 2004/12/1 REL Token Profile 1.0 OASIS, 2004/12/19 Kerberos Token Profile 1.0 WD05, 2004/7/27 SOAP Message Security: Minimalist Profile (MProf) 1.0 WD1.5, 2003/3/7 SOAP Messages with Attachements (SwA) Profile 1.0 WD14, 2004/11/

7 WS-Security 2004 SOAP WS-Security 2004 ID Security

8 End-to-End SSL SSL: Point-to-Point WSS: End-to-End HTTPS WS-SecuritySecurity HTTPS

9 SOAP XML-Signature XML Encryption ID wsu:id XML-Signature ID XML Encryption ID

10 Security SOAP actor/role <wsse:security> Security actor/role Security actor/role <wsse:usernametoken> XML X.509 Kerberos <wsse:binarysecuritytoken> XML XML SAML REL <wsse:security>

11 s11:envelope s11:header s11:body wsse:security s11:actor wsse:usernametoken wsse:username 1..* (s12:role) 0..* 0..* 0..* wsse:binarysecuritytoken ValueType EncodingType saml:assertion <wsse:securitytokenreference> <ds:keyinfo> URI <wsse:reference> <wsse:keyidentifier> <ds:keyname> <wsse:embedded>

12 wsse:security wsse:reference URI ValueType wsse:securitytokenreference wsse:keyidentifier ValueType EncodingType 0..* ds:keyinfo ds:keyname wsse:embedded saml:assertion XML-Signature <ds:signature> Detached <wsse:security> Exclusive XML Canonicalization SOAP Message Normalization STR Dereference Transform <wsse:securitytokenreference>

13 XML Encryption <xenc:referncelist> <xenc:encryptedkey> wsse:security 0..* 0..* 0..* ds:signature xenc:refenecelist xenc:encryptedkey ds:keyinfo wsse:securitytokenreference 1..* xenc:datarefenece ds:keyinfo wsse:securitytokenreference

14 <wsse:security> <xenc:encryptedkey>.</xenc:encryptedkey> <ds:signature>.</ds:signature> </wsse:security> <wsse:security> <ds:signature>.</ds:signature> <xenc:encryptedkey>.</xenc:encryptedkey> </wsse:security> <wsu:timestamp> <wsu:created> <wsu:expires>

15 wsse:security wsu:created 0..1 wsu:timestamp wsu:expires SOAP Fault wsse:unsupportedsecuritytoken wsse:unsupportedsecurityalgorithm wsse:invalidsecurity <wsse:security> wsse:invalidsecuritytoken wsse:failedauthentication wsse:failedcheck wsse:securitytokenunavailable

16 PKI I

17 OASIS WSS SAML XML-Signature XML Encryption

Encryption Security

Encryption Security 200426 XML Consortium WG XML Signature XML Encryption XKMS2.0 X-KRSS:Register X-KISS:Locate X-KISS:Validate WS-Security XACML WG 2004/02/06 1 XML WG 2004/02/06 2 2001 2002 2003 XKMS XML SAML SSO SAML XML