Unified Security Architectures for Web and WAP
0 likes1,073 views
The document discusses the feasibility of unified security architectures for web and WAP-based services. It analyzes application and infrastructure aspects, finding that transport-bound security, information-bound security, and security tokens can be integrated. With advances in WAP 2.0, web and WAP security may be largely unified at the application level, while infrastructure-level requirements like WPKI can be accommodated at the network border. This allows businesses to avoid investing in separate security infrastructures for web and WAP services.
Unified Security Architectures for Web and WAP
- 1. Unified Security Architectures for Web and WAP: Vision or Fiction? Oliver Pfaff Siemens AG
- 2. E-/M-Business Paradigms Business process owners implement multiple distribution channels to supply services to their customers. E-/M-Business represents business processes digitally. Public networks and corresponding terminals are integrated to enable ubiquitous service access. E-/M-Business architectures separate actual business logic implementation from service presentation/delivery: To avoid business process re-implementation when augmenting service provisioning means. To accommodate different system life cycles which may be driven by different factors. Retail Call-Center Kiosk Web WAP ...
- 3. Service frontend E-/M-Business service User agent PSTN IP network Considered E-/M-Business Architecture PSTN Intranet Network operator Home, hotel ,... Office Mobile Business logic Service backend Service portals E-/M-Business transaction span
- 4. State-of-the-Art in Web and WAP Security Web and WAP security comply to the same technology paradigms: Transport-bound security: transient data encapsulation Web: SSL/TLS WAP: WTLS Information-bound security: persistent data encapsulation Web: PKCS#7 SignedData via JavaScript ‘crypto.signText’ or MS-CAPICOM ‘Sign’ WAP: WMLScript Crypto SignedContent via ‘Crypto.signText’ Security token: storing and employing cryptographic keys Web: PKCS#11/MS-CSP module WAP: WIM Public key infrastructure: binding entity identifiers to public keys Web: PKIX WAP: WPKI WAP security defines formats, protocols, and procedures which deviate from Web technologies.
- 5. E-/M-Business Owner Concerns The provision of business processes over public infrastructure such as the Internet and mobile networks requires adequate IT-security: To which extend should business process owners invest in different security technologies when serving the same business processes via different provisioning means such as Web and WAP? In particular: do they need to invest in different security infrastructures? To examine the feasibility of unified security architectures for Web and WAP-based business services in the sequel, we are going to distinguish: Application from infrastructure aspects Application aspects according to client and server-side issues Infrastructure aspects according to PKI and security token issues
- 6. Integration of Transport-Bound Security Services SSL/TLS and WTLS should terminate in the same network infrastructure sector to offer homogeneous services. An implementation option is: Private network Business logic Web server Subnet IP TCP SSL/TLS HTTP DMZ WAP gateway Subnet IP UDP WTLS WTP WSP SSL/TLS TCP IP Subnet HTTP Web client Dial-in server WAP client Public networks SSL/TLS TCP IP PPP PSTN PPP Subnet PSTN HTTP SSL/TLS TCP IP Subnet HTTP Subnet Subnet WSP WTP WTLS UDP IP PPP CSD CSD PSTN PPP Subnet PSTN Dial-in server Base station HTTP TCP IP HTTP TCP IP Web proxy
- 7. Client-Specific Authentication Services E-/M-Business service User agent PKI ‘ Application plane’ ‘ Infrastructure plane’ PKCS#11 MS-CAPI WIM Sign Security token Signed nonce (WTLS) Signed text (WMLScript Crypto) Sign Signed nonce (SSL/TLS) Signed text (PKCS#7) Sign Security module Validate Entity-ID (PKI domain) Entity-ID (E-/M-Business domain)
- 8. Default WPKI Client Certificate Types PKI Certificate provision Certificate delivery Status information Y/N X.509-WAPCert Based on PKIX (RFC 2459); defines additional constraints to achieve compactness. Profile applies to certificates sent over-the-air. Relying parties receive client certificates in-band. WAP client E-/M-Business X.509-PKIX Profile applies to certificates not sent over-the-air. Relying parties have to fetch client certificates by ID (e.g. URL or hash value). Allows to offload client certificate handling from mobile devices. PKI Certificate ID provision Certificate ID delivery Certificate fetch by ID ID ID
- 9. ICC-Based WIM Options WPKI domain E-/M-Business owner concerns WIM owner E-/M-Business’s discretion May security tokens and PKI be deployed for Web and WAP services simultaneously? E-/M-Business’s discretion Operator’s discretion May WIM resources be re-used for Web applications? Wireless operator Integrated SIM/WIM card SIM plus WIM via internal secondary reader (dual-slot) SIM plus WIM via external reader
- 10. Integrated SIM/WIM Card in Web Security To employ SIM/WIM cards owned by wireless operators in Web security, E-/M-Businesses need to adopt PKI domains which are deployed at the discretion of wireless operators: X.509-PKIX client certificates imply certificate IDs which are currently not defined in SSL/TLS and PKCS#7. Thus, signers have to do certificate fetch operations. X.509-WAPCert client certificates support in-band delivery straight-forward. They require relying parties to support the X.509-WAPCert profile. Integration with PC-based Web clients is a subject of current R&D efforts. The sketched stack employs the mobile as a personal security device. PKCS#11 MS-CAPI PKCS#11/MS-CSP module Air interface (e.g. Bluetooth) ISO 7816 SIM/WIM PC Mobile WIM module
- 11. SIM-Independent WIM in Web/WAP Security PKCS#15-based PSEs may be defined such that PSE-carrying ICCs can simultaneously be used as security tokens for Web and WAP clients: Web client integration requires a PKCS#11/MS-CSP module with PKCS#15 interpreter. PC/SC provides reader independence. WAP client integration requires a WIM and a PKCS#15 interpreter. These software modules may supply different features (e.g. certificate in-band and out-of-band delivery) on base of the same cryptographic keys under the effective security policies. The sketched design shows a sample layout. PKCS#11 MS-CAPI WIM service primitives Prop. MF DF(PKCS15) DF(PKCS15) Reference system AID: WAP-WIM AID: PKCS-15 ISO 7816 PKCS#11 MS-CSP module ICC application Security objects Reference system PKCS#15 interpreter (AID: WAP-WIM) EF(Certificate) EF(Private key) WIM EF(Certificate ID) PKCS#15 interpreter (AID: PKCS-15)
- 12. WAP 1.x Impact on E-/M-Business Security Transport-bound security WTLS is part of WAP releases since WAP 1.0 (1998): Class 1/2: best current practice; limited E-/M-Business service impact. Class 3: no wide deployment until now; infrastructure impact through client-side PKI and tokens. Information-bound security WMLScript Crypto is part of WAP releases since 1.2 (1999): ‘ Crypto.signText’ and SignedContent : no wide deployment until now; infrastructure impact through client-side PKI and tokens. Note: SignedContent may be transformed into PKCS#7 SignedData . Security token WIM is part of WAP releases since 1.2 (1999): ISO 7816/PKCS#15-based token: no wide deployment until now; SIM/WIM integration with Web clients is a subject of R&D efforts, SIM-independent WIM may be used with Web and WAP applications. Public key infrastructure Until the ‘June 2000 Release’, WPKI specifications were not part of WAP releases (preliminary WAPCert and WPKI documents already existed).
- 13. Advances Through WAP 2.0 (‘June 2001 Release’) Transport-bound security WTLS persists and is being augmented by transport level end-to-end security for enhanced enterprise WAP gateway support. TLS support is added for end-to-end security between mobiles and Web servers: WAPCert is going to replace the WTLS server certificate format. Due to TLS and HTTP support, WAP gateways are becoming optional. Information-bound security WMLScript Crypto persists; constraints remain as described before. Security token WIM persists; constraints remain as described before. Public key infrastructure WAPCert and WPKI advance to ‘conformance release’ specifications: WPKI constraints may largely be accommodated at infrastructure border (cf. next slide).
- 14. WPKI Integration WPKI portal WPKI service consumers PKI service providers WPKI specific processing: Client certificates POP during PKI registration based upon WAP security mechanisms. WAP in-band delivery requires X.509-WAPCert certificates. WAP out-of-band delivery is based on IDs; certificates comply to PKIX. Server certificates Currently based upon the WTLS certificate format; likely to become replaced by the X.509-WAPCert profile. Trusted certificates Provisioning and update are based upon WPKI structures delivered with specific MIME types. Thus, WPKI requirements may largely be accommodated at PKI border. RA CA Repository
- 15. Conclusions Private key operations upon mobiles are no common practice in today’s M-Business services. Required technologies currently emerge. The IT-strategy of E-/M-Businesses is significantly impacted by the advent of client-specific entity and message authentication services. Web and WAP security may be unified to a large extend: ‘ Application plane’: WAP specific formats and protocols are of limited impact: With WAP 2.0, WAP gateways and WTLS are becoming optional. WAP signature format can be transformed into PKCS#7. ‘ Infrastructure plane’: WIMs may be integrated with non-WAP applications. WPKI requirements may largely be accommodated at PKI border. Appropriate solution design allows E-/M-Businesses to avoid investments in separate security infrastructures (i.e. PKI and security tokens) when providing services via Web and WAP.
- 16. AID Application ID API Application Programming Interface CA Certification Authority CMS Cryptographic Message Syntax CSD Circuit Switched Data DF Dedicated File DMZ De-Militarized Zone EF Elementary File HTTP Hypertext Transfer Protocol ICC Integrated Circuit Card ID Identifier IETF Internet Engineering Task Force IP Internet Protocol ISO International Standards Organization MF Master File MIME Multipurpose Internet Mail Extensions MS Microsoft MS-CAPI MS Cryptographic API MS-CSP MS Cryptographic Service Provider PC/SC Personal Computer/Smart Card PKCS Public Key Cryptography Standards PKI Public Key Infrastructure PKIX PKI-X.509 Abbreviations POP Proof Of Possession PPP Point-to-Point Protocol PSE Personal Security Environment PSTN Public Switched Telephone Network RA Registration Authority RFC Request For Comment SIM Subscriber Identity Module SSL Secure Sockets Layer TCP Transmission Control Protocol TLS Transport Layer Security UDP User Datagram Protocol URL Uniform Resource Locator W3C World Wide Web Consortium WAP Wireless Application Protocol WIM Wireless Identity Module WML Wireless Markup Language WMLScript WML Script WPKI Wireless PKI WSP Wireless Session Protocol WTP Wireless Transaction Protocol WTLS Wireless TLS WWW World Wide Web
- 17. Author Information Dr. Oliver Pfaff Siemens AG Information and Communication Networks Charles-De-Gaulle-Str. 2 D-81730 Munich E-Mail: oliver.pfaff@icn.siemens.de Telephone: +49.89.722.53227 Mobile: +49.172.8250805