DOCSLIB.ORG

Document-Based Message-Centric Security Using XML Authentication and Encryption for Coalition and Interagency Operations

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Document-Based Message-Centric Security Using XML Authentication and Encryption for Coalition and Interagency Operations Calhoun: The NPS Institutional Archive Theses and Dissertations Thesis Collection 2009-09 Document-based message-centric security using XML authentication and encryption for coalition and interagency operations Williams, Jeffrey Scott Monterey, California. Naval Postgraduate School http://hdl.handle.net/10945/4610 NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA THESIS DOCUMENT-BASED MESSAGE-CENTRIC SECURITY USING XML AUTHENTICATION AND ENCRYPTION FOR COALITION AND INTERAGENCY OPERATIONS by Jeffrey Scott Williams Sr. September 2009 Thesis Advisor: Don Brutzman Second Reader: Don McGregor This thesis was done at the MOVES Institute Approved for public release; distribution is unlimited THIS PAGE INTENTIONALLY LEFT BLANK REPORT DOCUMENTATION PAGE Form Approved OMB No. 0704-0188 Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188) Washington DC 20503. 1. AGENCY USE ONLY (Leave blank) 2. REPORT DATE 3. REPORT TYPE AND DATES COVERED September 2009 Master’s Thesis 4. TITLE AND SUBTITLE Document-Based and Message-Centric Security Using 5. FUNDING NUMBERS XML Authentication and Encryption for Coalition and Interagency Operations 6. AUTHOR Jeffrey Scott Williams Sr. 7. PERFORMING ORGANIZATION NAME AND ADDRESS 8. PERFORMING ORGANIZATION Naval Postgraduate School REPORT NUMBER Monterey, CA 93943-5000 9. SPONSORING /MONITORING AGENCY NAME AND ADDRESS 10. SPONSORING/MONITORING Naval Postgraduate School, Modeling Virtual Environments and Simulations AGENCY REPORT NUMBER Institute, Monterey, California 93943 11. SUPPLEMENTARY NOTES The views expressed in this thesis are those of the author and do not reflect the official policy or position of the Department of Defense or the U.S. Government. 12a. DISTRIBUTION / AVAILABILITY STATEMENT 12b. DISTRIBUTION CODE Approved for public release; distribution is unlimited A 13. ABSTRACT Different agencies and different nations are not able to securely communicate and share structured information due to differences in security policies and data formats. The current evolution of security and data policies is not solving this fundamental problem. Document-based message-centric XML security can provide satisfactory security within a diversified communications framework between traditional and nontraditional partners by utilizing existing Web standards for XML canonicalization, XML digital signature, XML compression and XML encryption. Vulnerabilities related to the exchange of cryptographic technologies are minimized by strictly adhering to open-standards technology. This approach thus resolves multi-partner trust challenges in regards to using another entity's equipment, software, or policy requirements through the proper adoption of standards-based structured data and alternative cryptographic algorithms. Exemplar results demonstrated in this thesis show that XML Security is a feasible approach for operations that include multiple agencies and coalition partners. Alternative solutions are also available using proprietary technologies, but such approaches lock participants into commercial contracts, prohibit distribution and provide suspect capabilities. Therefore, they cannot attain interagency or international acceptance. Such methods involve the use of unique or proprietary message formats with customized encryption and compression algorithms that are not available for broad scrutiny by open source communities. Closed approaches cannot gain group trust. This thesis specifically investigates XML standardization methods for various categories of unclassified data to provide secure information exchange among a wide audience, e.g. multi-agency task force or multinational coalition partners. Using an XML document-centric approach is a helpful organizing principle for this problem that provides levels of security consistent with common business practices achieved, within the constraints of the respective organizational security policies of each participant. The resulting design patterns for XML document development enhance confidentiality, integrity, and authentication commensurate with the nature of the unclassified document generated, while maintaining information objects at an appropriate level of security and acceptable level of risk. 14. SUBJECT TERMS Extensible Markup Language (XML), Extensible Markup Language for 15. NUMBER OF Transformations (XSLT), Extensible Markup Language Security, Extensible Markup Language PAGES Encryption, Extensible Markup Language Digital Signature, Extensible Markup Language 229 Authentication 16. PRICE CODE 17. SECURITY 18. SECURITY 19. SECURITY 20. LIMITATION OF CLASSIFICATION OF CLASSIFICATION OF THIS CLASSIFICATION OF ABSTRACT REPORT PAGE ABSTRACT Unclassified Unclassified Unclassified UU NSN 7540-01-280-5500 Standard Form 298 (Rev. 2-89) Prescribed by ANSI Std. 239-18 i THIS PAGE INTENTIONALLY LEFT BLANK ii Approved for public release; distribution is unlimited DOCUMENT-BASED MESSAGE-CENTRIC SECURITY USING XML AUTHENTICATION AND ENCRYPTION FOR COALITION AND INTERAGENCY OPERATIONS Jeffrey Scott Williams Sr. Lieutenant Commander, United States Navy B.S. Computer Science, Morehouse College, 1996 Submitted in partial fulfillment of the requirements for the degree of MASTER OF SCIENCE IN MODELING VIRTUAL ENVIRONMENTS AND SIMULATION (MOVES) from the NAVAL POSTGRADUATE SCHOOL September 2009 Author: Jeffrey Scott Williams Sr. Approved by: Don Brutzman Thesis Advisor Don McGregor Second Reader Dr. Mathias Kölsch Chair, MOVES Academic Committee iii THIS PAGE INTENTIONALLY LEFT BLANK iv ABSTRACT Different agencies and different nations are not able to securely communicate and share structured information due to differences in security policies and data formats. The current evolution of security and data policies is not solving this fundamental problem. Document-based message-centric XML security can provide satisfactory security within a diversified communications framework between traditional and nontraditional partners by utilizing existing Web standards for XML canonicalization, XML digital signature, XML compression and XML encryption. Vulnerabilities related to the exchange of cryptographic technologies are minimized by strictly adhering to open-standards technology. This approach thus resolves multi-partner trust challenges in regards to using another entity's equipment, software, or policy requirements through the proper adoption of standards-based structured data and alternative cryptographic algorithms. Exemplar results demonstrated in this thesis show that XML Security is a feasible approach for operations that include multiple agencies and coalition partners. Alternative solutions are also available using proprietary technologies, but such approaches lock participants into commercial contracts, prohibit distribution and provide suspect capabilities. Therefore, they cannot attain interagency or international acceptance. Such methods involve the use of unique or proprietary message formats with customized encryption and compression algorithms that are not available for broad scrutiny by open source communities. Closed approaches cannot gain group trust. This thesis specifically investigates XML standardization methods for various categories of unclassified data to provide secure information exchange among a wide audience, e.g. multi-agency task force or multinational coalition partners. Using an XML document-centric approach is a helpful organizing principle for this problem that provides levels of security consistent with common business practices achieved, within the constraints of the respective organizational security policies of each participant. The resulting design patterns for XML document development enhance confidentiality, integrity, and authentication commensurate with the nature of the unclassified document generated, while maintaining information objects at an appropriate level of security and acceptable level of risk. v THIS PAGE INTENTIONALLY LEFT BLANK vi TABLE OF CONTENTS I. INTRODUCTION AND PROBLEM STATEMENT...............................................1 A. INTRODUCTION............................................................................................1 1. Thesis Goal and Scope Use tab key ....................................................6 2. Security—How is it Defined within the Scope of the Thesis? .........6 3. Methodology .........................................................................................7 B. MEASURABLE SUCCESS GOAL ...............................................................8 C. THESIS QUESTIONS.....................................................................................8 D. INITIAL CONSTRUCT..................................................................................9 E. THESIS ORGANIZATION..........................................................................12 II. RELATED WORK ....................................................................................................15
Load more

Recommended publications
  • An Arbitration System for Student Evaluation Based on XML Signature
    2nd EUROPEAN COMPUTING CONFERENCE (ECC’08) Malta, September 11-13, 2008 An Arbitration System for Student Evaluation based on XML Signature ROBERT ANDREI BUCHMANN, SERGIU JECAN Business Information Systems Dpt. Faculty of Economic Sciences and Business Administration Babes Bolyai University Cluj Napoca Str. Th. Mihali 58-60, ROMANIA [email protected], [email protected] Abstract: This paper promotes an e-learning application model for student evaluation, based on AJAX frameworks in order to provide improved user experience and asynchronous data exchange and the XML Signature standard in order to impose message authentications for the test papers. The motivation of this research is the need to arbitrate contestation for e-learning evaluation by providing an authentication and non-repudiation mechanism for both the students’ answers and the teachers’ evaluation criteria and rating, especially in open answer tests. Keywords: - e-learning, digital signature, AJAX 1 Introduction arose the issue of arbitration in contestation processes, especially in tests based on open E-learning already provides a mature model for questions, but also in multiple choice tests with educational processes. However, the separation no immediate answer validation. The proposed of parties in time and space is bound to solution is an extension to traditional e-learning communication gaps causing situations where an application models, regarding the evaluation arbitration system should provide trust module, based on XML-based digital signature mechanisms between the student and the and improved usability through AJAX teacher. The proposed application model is an frameworks. evolutionary step of the XML-driven e- commerce application previously implemented 3 Problem Solution for Flash 2004 with XML support and currently migrated under an AJAX framework and within 3.1 Instrumentation an e-learning context based on trust managed through XML Signatures.
    [Show full text]
  • XML Signature/Encryption — the Basis of Web Services Security
    Special Issue on Security for Network Society Falsification Prevention and Protection Technologies and Products XML Signature/Encryption — the Basis of Web Services Security By Koji MIYAUCHI* XML is spreading quickly as a format for electronic documents and messages. As a consequence, ABSTRACT greater importance is being placed on the XML security technology. Against this background research and development efforts into XML security are being energetically pursued. This paper discusses the W3C XML Signature and XML Encryption specifications, which represent the fundamental technology of XML security, as well as other related technologies originally developed by NEC. KEYWORDS XML security, XML signature, XML encryption, Distributed signature, Web services security 1. INTRODUCTION 2. XML SIGNATURE XML is an extendible markup language, the speci- 2.1 Overview fication of which has been established by the W3C XML Signature is an electronic signature technol- (WWW Consortium). It is spreading quickly because ogy that is optimized for XML data. The practical of its flexibility and its platform-independent technol- benefits of this technology include Partial Signature, ogy, which freely allows authors to decide on docu- which allows an electronic signature to be written on ment structures. Various XML-based standard for- specific tags contained in XML data, and Multiple mats have been developed including: ebXML and Signature, which enables multiple electronic signa- RosettaNet, which are standard specifications for e- tures to be written. The use of XML Signature can commerce transactions, TravelXML, which is an EDI solve security problems, including falsification, spoof- (Electronic Data Interchange) standard for travel ing, and repudiation. agencies, and NewsML, which is a standard specifica- tion for new distribution formats.
    [Show full text]
  • XML for Java Developers G22.3033-002 Course Roadmap
    XML for Java Developers G22.3033-002 Session 1 - Main Theme Markup Language Technologies (Part I) Dr. Jean-Claude Franchitti New York University Computer Science Department Courant Institute of Mathematical Sciences 1 Course Roadmap Consider the Spectrum of Applications Architectures Distributed vs. Decentralized Apps + Thick vs. Thin Clients J2EE for eCommerce vs. J2EE/Web Services, JXTA, etc. Learn Specific XML/Java “Patterns” Used for Data/Content Presentation, Data Exchange, and Application Configuration Cover XML/Java Technologies According to their Use in the Various Phases of the Application Development Lifecycle (i.e., Discovery, Design, Development, Deployment, Administration) e.g., Modeling, Configuration Management, Processing, Rendering, Querying, Secure Messaging, etc. Develop XML Applications as Assemblies of Reusable XML- Based Services (Applications of XML + Java Applications) 2 1 Agenda XML Generics Course Logistics, Structure and Objectives History of Meta-Markup Languages XML Applications: Markup Languages XML Information Modeling Applications XML-Based Architectures XML and Java XML Development Tools Summary Class Project Readings Assignment #1a 3 Part I Introduction 4 2 XML Generics XML means eXtensible Markup Language XML expresses the structure of information (i.e., document content) separately from its presentation XSL style sheets are used to convert documents to a presentation format that can be processed by a target presentation device (e.g., HTML in the case of legacy browsers) Need a
    [Show full text]
  • Introduction to XML
    Introduction to XML CS 317/387 Agenda – Introduction to XML 1. What is it? 2. What’s it good for? 3. How does it work? 4. The infrastructure of XML 5. Using XML on the Web 6. Implementation issues & costs 2 1. What is it? Discussion points: First principles: OHCO Example: A simple XML fragment Compare/contrast: SGML, HTML, XHTML A different XML for every community Terminology 3 1 Ordered hierarchies of content objects Premise: A text is the sum of its component parts A <Book> could be defined as containing: <FrontMatter>, <Chapter>s, <BackMatter> <FrontMatter> could contain: <BookTitle> <Author>s <PubInfo> A <Chapter> could contain: <ChapterTitle> <Paragraph>s A <Paragraph> could contain: <Sentence>s or <Table>s or <Figure>s … Components chosen should reflect anticipated use 4 Ordered hierarchies of content objects OHCO is a useful, albeit imperfect, model Exposes an object’s intellectual structure Supports reuse & abstraction of components Better than a bit-mapped page image Better than a model of text as a stream of characters plus formatting instructions Data management system for document-like objects Does not allow overlapping content objects Incomplete; requires infrastructure 5 Content objects in a book Book FrontMatter BookTitle Author(s) PubInfo Chapter(s) ChapterTitle Paragraph(s) BackMatter References Index 6 2 Content objects in a catalog card Card CallNumber MainEntry TitleStatement TitleProper StatementOfResponsibility Imprint SummaryNote AddedEntrySubject(s) Added EntryPersonalName(s) 7 Semistructured Data Another data model, based on trees. Motivation: flexible representation of data. Often, data comes from multiple sources with differences in notation, meaning, etc. Motivation: sharing of documents among systems and databases.
    [Show full text]
  • Web API Protocol and Security Analysis Web
    EXAMENSARBETE INOM DATATEKNIK, GRUNDNIVÅ, 15 HP STOCKHOLM, SVERIGE 2017 Web API protocol and security analysis Web API protokoll- och säkerhetsanalys CRISTIAN ARAYA MANJINDER SINGH KTH SKOLAN FÖR TEKNIK OCH HÄLSA Web API protocol and security analysis Web API protokoll- och säkerhetsanalys Cristian Araya and Manjinder Singh Degree project in Computer science First level, 15hp Supervisor from KTH: Reine Bergström Examiner: Ibrahim Orhan TRITA-STH 2017:34 KTH The School of Technology and Health 141 52 Flemingsberg, Sweden Abstract There is problem that every company has its own customer portal. This problem can be solved by creating a platform that gathers all customers’ portals in one place. For such platform, it is required a web API protocol that is fast, secure and has capacity for many users. Consequently, a survey of various web API protocols has been made by testing their performance and security. The task was to find out which web API protocol offered high security as well as high performance in terms of response time both at low and high load. This included an investigation of previous work to find out if certain protocols could be ruled out. During the work, the platform’s backend was also developed, which needed to implement chosen web API protocols that would later be tested. The performed tests measured the APIs’ connection time and their response time with and without load. The results were analyzed and showed that the protocols had both pros and cons. Finally, a protocol was chosen that was suitable for the platform because it offered high security and fast connection.
    [Show full text]
  • OASIS Digital Signature Services (OASIS-DSS) an Architecture, Implementation and Interoperability Master’S Thesis at Graz University of Technology 2008
    OASIS Digital Signature Services (OASIS-DSS) An Architecture, Implementation and Interoperability Master’s Thesis at Graz University of Technology 2008 submitted by Konrad Lanz, bakk.techn., BSc Hons Institute for Applied Information Processing and Communications (IAIK), Graz University of Technology A-8010 Graz, Austria December 2008 © Copyright 2005-2008 Konrad Lanz Assessor: O.Univ.-Prof. Dipl.-Ing. Dr.techn. Reinhard Posch Supervisor: Ass.-Prof. Dipl.-Ing. Dr.techn. Peter Lipp i The candidate confirms that the work submitted is his own and the appropriate credit has been given where reference has been made to the work of others. I understand that failure to attribute material which is obtained from another source may be considered as plagiarism. (Signature of student) Signature Value F4BtvtUqSBPSgBeE2QPp1suVNoU75kZAk05AgIgLKJlMEov7RCAW35vkkEr/HwdR Signatory C=AT,OU=VSig,O=Hauptverband österr. Sozialvers.,CN=Konrad Lanz Date/Time-UTC 2008-12-15T23:15:40Z Issuer-Certificate C=AT,O=Hauptverband österr. Sozialvers.,CN=VSig CA 2 Serial-No. 17293657787164074630362273138432232730208 Method urn:pdfsigfilter:bka.gv.at:binaer:v1.1.0 Parameter etsi-bka-1.0@1229382940-394096199@31239-32542-0-14959-320 Verification Verification service: http://demo.a-sit.at/el_signatur/verification ©2005-2008 Konrad Lanz, All Rights reserved. Permission to copy this document is granted to Graz University of Technology i.e. the Institute for Applied Information Processing and Communications (IAIK) for in house educational purposes and its library and on a fair use basis. For permission to copy this document otherwise please do not hesitate to contact [email protected] with the following subject “request for copy permission MSc-Thesis 2008”.
    [Show full text]
  • Signxml Documentation Release 0.0.1
    SignXML Documentation Release 0.0.1 Andrey Kislyuk Oct 29, 2020 Contents 1 Installation 3 2 Synopsis 5 2.1 Verifying SAML assertions.......................................5 2.2 XML signature methods: enveloped, detached, enveloping.......................6 2.3 XML parsing security and compatibility with xml.etree.ElementTree .............7 3 Authors 9 4 Links 11 4.1 Bugs................................................... 11 5 License 13 6 API documentation 15 7 Release Notes 21 8 Changes for v2.8.1 (2020-10-29) 23 9 Changes for v2.8.0 (2020-06-20) 25 10 Changes for v2.7.3 (2020-06-10) 27 11 Changes for v2.7.2 (2019-12-01) 29 12 Changes for v2.7.1 (2019-11-30) 31 13 Changes for v2.7.0 (2019-11-30) 33 14 Changes for v2.6.0 (2019-01-10) 35 15 Changes for v2.5.2 (2017-12-07) 37 16 Changes for v2.5.1 (2017-12-07) 39 17 Changes for v2.5.0 (2017-12-07) 41 18 Changes for v2.4.0 (2017-07-10) 43 i 19 Changes for v2.3.0 (2017-04-24) 45 20 Changes for v2.2.4 (2017-03-19) 47 21 Changes for v2.2.3 (2016-12-20) 49 22 Changes for v2.2.2 (2016-12-20) 51 23 Changes for v2.2.1 (2016-09-26) 53 24 Changes for v2.2.0 (2016-09-25) 55 25 Changes for v2.1.4 (2016-09-18) 57 26 Changes for v2.1.0 (2016-09-18) 59 26.1 Version 2.0.0 (2016-08-05).......................................
    [Show full text]
  • TU07 XML at The
    ApacheCon 2004 November 2004 XML at the ASF Ted Leung [email protected] Copyright © Sauria Associates, LLC 2004 1 ApacheCon 2004 November 2004 Overview xml.apache.org ws.apache.org Xerces XML-RPC Xalan Axis FOP WSIF Batik JaxMe Xindice cocoon.apache.org Forrest XML-Security Cocoon XML-Commons Lenya XMLBeans Copyright © Sauria Associates, LLC ApacheCon 2004 2 There are three major XML focused projects at the ASF. Originally there was one project, xml.apache.org. Earlier this year, the Cocoon and web services projects were formed. Xml.apache.org contains a number of projects that are general purpose XML tools. Most of these tools are based on specifications from the World Wide Web Consortium. This includes XML itself, XSLT, XSL Formatting object, Scalable Vector Graphics, and XML Signature and XML Encryption The web services project, ws.apache.org contains projects that cluster around standards for dealing with Web Services, including SOAP and XML-RPC The Cocoon project is oriented around the Cocoon Web publishing framework which is basd on XML, XSLT, and a number of other XML related technologies. I’m not going to be able to give you any deep technical details regarding all of these projects. Instead, I’m going to try to describe what these projects are, what standards they implement, and talk about situations where you might use them. Unless I say otherwise, I’m going to be covering the Java projects. There are a few projects which have C/C++ versions and I’ll mention that where applicable. Copyright © Sauria Associates,
    [Show full text]
  • The OWASP Foundation OWASP XML External Entity Attacks (XXE)
    AppSec Germany 2010 XML External Entity Attacks (XXE) Sascha Herzog Compass Security AG [email protected] OWASP +41 55 214 41 78 20.10.2010 Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation http://www.owasp.org XML External Entity Attacks (XXE), Sacha Herzog AppSec Germany 2010 Agenda Introduction Server2Server Communication – Web Services Client2Server Communication – Web 2.0 (AJAX) XML Basics DTD XML Schema XML Attacks Generator Attacks XML Parser Attacks Mitigation Xerces Hardening OWASP OWASP AppSec Germany 2010 Conference XML External Entity Attacks (XXE), Sacha Herzog AppSec Germany 2010 B2B / Server2Server XML Data Exchange in Web Services B2B integration with XML documents SOAP Services ORDER XML Shop Internet Supplier CONFIRM XML Example Order processing systems OWASP OWASP AppSec Germany 2010 Conference XML External Entity Attacks (XXE), Sacha Herzog AppSec Germany 2010 B2B / Server2Server Example: Web Service Integration of Web Services into portal (Stock Quotes) Data or presentation oriented Remote Portlets can be distinguished. OWASP OWASP AppSec Germany 2010 Conference XML External Entity Attacks (XXE), Sacha Herzog AppSec Germany 2010 XMLHttpRequest / Client2Server XML Data Exchange XMLHttpRequest Object JavaScript OWASP OWASP AppSec Germany 2010 Conference XML External Entity Attacks (XXE), Sacha Herzog AppSec Germany 2010 Web 2.0 - Data Exchange Formats Upstream Data Format Web 2.0 GET & POST(form, txt/xml, soap-xml) Downstream Data Format Web 2.0 html,css,xml,java-script,json,custom OWASP OWASP AppSec Germany 2010 Conference XML External Entity Attacks (XXE), Sacha Herzog AppSec Germany 2010 XML Basics: Introduction XML is a standard for exchanging structured data in textual format <?xml version="1.0" encoding="UTF-8"?> <order> <product>1234</product> <count>1</count> <orderer> <contact>Jan P.
    [Show full text]
  • Securely Streaming SVG Web-Based Electronic Healthcare Records Involving Android Mobile Clients
    146 JOURNAL OF EMERGING TECHNOLOGIES IN WEB INTELLIGENCE, VOL. 1, NO. 2, NOVEMBER 2009 Securely Streaming SVG Web-Based Electronic Healthcare Records involving Android Mobile Clients Sabah Mohammed and Jinan Fiaidhi Department of Computer Science, Lakehead University, Thunder Bay, Ontario P7B 5E1, Canada {mohammed, jfiaidhi}@lakeheadu.ca Osama Mohammed Department of Software Engineering, Lakehead University, Thunder Bay, Ontario P7B 5E1, Canada [email protected] Abstract— Although Electronic Healthcare Records (EHRs) system to provide it in a paper fashion. Healthcare has technology largely facilitates patient care by providing long relied upon paper based record systems which have clinicians with the ability to review a more complete medical become cumbersome and expensive to manage and record, interoperability and privacy issues present present significant challenges related to speed of significant barriers to their implementation. This article accessibility and security. Thus the emerging benefit of proposes the open source SVG (Scalable Vector Graphics) standard for representing electronic healthcare records for mobile Internet technology to healthcare is to provide interoperability purpose where security can be enforced mobile access to medical records. Again, using mobile using lightweight SAX streaming filters. The SVG filters are technology means that the treatment process can be sped based on the Java SAX API to push pieces of the SVG to the up and the potential for medical errors can be reduced. encryption/decryption handlers. The SAX handlers can With motivations such as patient privacy protection and filter, skip tags, or encrypt tags partially or universally at laws like the US Health Insurance Portability and any time from the stream of the SVG EHRs.
    [Show full text]
  • HTML5 and Digital Signatures
    HTML5 and Digital Signatures Signature Creation Service 1.1 Nov 22, 2017 13.10.2014 SPECIFICATION 2 (23) Signature Creation Service 1.1 22.11.2017 Väestörekisterikeskus DOCUMENT MANAGEMENT Prepared by Antti Partanen / VRK <[email protected]> Inspected by Approved by VERSION CONTROL version no. what has been done date/person 1,0 Final version (no changes to 0.7 version) 17.2.2015/PL 1.0.1 Added 30.6.2015/PL https usage as requirement server certificate requirements SCS module for javascript (example) clarifications for selector.akis and selector.issuers format removed selector.validate parameter added requirement for SCS to check whether certificate is valid or not removed localhost.fineid.fi as dnsName parameter in SCS server certificate (compared to previous 1.0.1 version) protocol version is still the same: 1.0 1.1 Added: 4.6.2017/PL support for http based access dropped completely separation of authentication and signing purpose authentication challenge to be used for authentication purpose keyalgorithms array to selector functionality cms signature type and cms signature profile protocol version 1.1 support signature request size up to 100MB (was 2MB) minor editorial corrections 21.11.2017/AP SPECIFICATION 3 (23) Signature Creation Service 1.1 22.11.2017 Väestörekisterikeskus Table of contents 1 Introduction ........................................................................................................................................... 4 1.1 Definitions and Acronyms ..............................................................................................................
    [Show full text]
  • Guide to XML Web Services Security (PDF)
    Guide to XML Web Services Security XML Application Firewalls for Securing and Monitoring XML Web Services XML Web Services Are Revolutionizing the IT Industry XML and Web Services are simple, but powerful standards that enable applications to more efficiently communicate with each other. Similar to how Internet-based technologies enable person-to-person (email) and person-application communication (web pages), XML Web Services is revolutionizing application-to-application communication. When you send an email, you need not worry about what technologies are being used to send and receive the email. As long as various simple standards are followed, you are ensured the message will be readable by the receiving party regardless of whether they are using Outlook, Unixmail or Yahoo Mail on any platform. XML Web Services enables applications to communicate more effectively without having to work out the underlying mechanics of the communication. However, Web Services standards do not completely address security for XML Web Services. This guide provides you with a quick overview of the security issues related to XML Web Services, what standards are currently in the works and how you can secure communication today. Why are Web Services Potentially Dangerous? The use of XML and Web Services can pose serious risk if security is not properly addressed from the beginning. Current security schemes must be updated to handle the new class of communications that Web Services enables. Current technologies can be used to secure highly controlled Web Service networks but are not able to scale to mission critical environments. Web Services Expose New Security Risks Web Services are designed to tunnel through Network firewalls do not firewalls, evading their usefulness at the application provide protection layer.
    [Show full text]