OASIS Web Services Secure Exchange (WS-SX) TC

The original Call For Participation for this TC may be found at http://lists.oasis-open.org/archives/tc-announce/200510/msg00006.html. Additional non-normative information, not included in this Charter, may be found in that document.

The charter was revised by a TC ballot conducted from 20-27 July 2007, as noted at http://www.oasis-open.org/committees/ballot.php?id=1352.

The charter was revised by a TC ballot conducted from 3-10 May 2007, as noted at http://www.oasis-open.org/committees/ballot.php?id=1282.

The charter was revised by a TC ballot conducted from 8-15 February 2006, as noted at http://www.oasis-open.org/committees/ballot.php?id=956.

The charter was previously revised by a TC ballot conducted from 5-17 January 2006, as noted at http://www.oasis-open.org/committees/ballot.php?id=917.

The charter for this TC is as follows:

a. Name of the TC

OASIS Web Services Secure Exchange (WS-SX) Technical Committee

b. Statement of Purpose

The purpose of the Web Services Secure Exchange (WS-SX) Technical Committee (TC) is to define extensions to OASIS Web Services Security [1] to enable trusted SOAP message exchanges involving multiple message exchanges and to define security policies that govern the formats and tokens of such messages. This work will be carried out through continued refinement of the Web Services SecureConversation, SecurityPolicy and Trust specifications [2-4] submitted to the TC as referenced in this charter.

c. Scope of Work

The TC will accept as input the February 2005 Version 1.2 of the WS-SecureConversation [2] and the February 2005 Version 1.2 of the WS-Trust [3] as published by Actional Corporation, BEA Systems, Inc., Computer Associates International, Inc., IBM, Layer 7 Technologies, Microsoft Corporation, Oblix Inc., OpenNetwork Technologies Inc., Ping Identity Corporation, Reactivity Inc., RSA Security Inc., and VeriSign Inc and the July 2005 Version 1.1 WS-SecurityPolicy [4] specifications (the Input Documents) as published by IBM, Microsoft, RSA Security and VeriSign.

Other contributions and changes to the input documents will be accepted for consideration without any prejudice or restrictions and evaluated based on technical merit in so far as they conform to this charter. OASIS members with extensive experience and knowledge in these areas are particularly invited to participate.

In order to support general secure Web Service messaging, additional facilities are needed beyond what is provided in OASIS Web Services Security [1]. The OASIS Web Services Security specification describes a base mechanism for securing SOAP messages but does not deal with trust brokering, multi-message exchanges, and policies describing how to secure message exchanges with a Web service. The following sub-sections describe the charter of the WS-SX TC with respect to these areas. The scope of the TC's work is to continue further refinement and finalization of the Input Documents to produce as output modular specifications that standardize the concepts, WSDL documents and XML Schema renderings of the areas described below.

Trusted Brokering of SOAP message exchanges

OASIS Web Services Security [1] defines the basic mechanism for providing secure SOAP messaging. It describes how to use security tokens to obtain message integrity, confidentiality and authentication of the message sender. In order to establish the authenticity of any message sender, the recipient needs to "trust" the asserted credentials of the sender. The WS-SX TC will add additional primitives to enable the establishing and brokering of these trust relationships between parties in a SOAP message exchange as defined by the policy expressions associated with the SOAP endpoints.

The scope of this work is to develop extensions to OASIS Web Services Security [1] that facilitate "trusted" SOAP message exchanges. This will be done by enabling the web services to participate in the establishment and brokering of trust relationships by means of an exchange and issuance of the relevant security tokens. In addition, some token and message validation may require the definition of specialized SOAP messages and header blocks.

This work will focus on:

  1. Describing a protocol for brokering trust on behalf of a requestor by obtaining designated security tokens containing required claims from the trusted authorities.

  2. Describing a framework for interactions with trusted authorities known as security token services. This includes describing the request/response elements for interactions with a security token service. This base framework for requesting and returning of security tokens should be usable for a variety of purposes related to security token services. Web service trust bindings define how this framework is used for specific usage patterns. This specification defines Web service trust bindings for issuance, renewal, cancellation and validation of security tokens.

  3. Declaring specific Web service bindings to a security token service for security token issuance including, but not limited to the following cases:

    1. Actions and elements for requesting a security token (or tokens).

    2. Actions and elements for responding with a security token (or tokens).

    3. Specifying the scope of each requested and returned security token using WS-Policy [5] (e.g. wsa:endpointReference).

    4. Specifying mechanisms for issuing, computing or utilizing existing keys as proof keys associated with the issued token.

    5. Support for requesting and returning bearer tokens

    6. Requesting or returning multiple security tokens.

    7. Transferring security tokens as part of application messages as well as part of the SOAP body of a separate response message

    8. Requesting a security token (or tokens) on behalf of another entity (or entities).

    9. Requesting a security token (or tokens) that may be forwardable or delegatable.

    10. Specifying characteristics of the requested type of keys.

    11. Enabling additional negotiation and challenge protocol mechanisms to be used (e.g. SASL mechanisms, SPNEGO) initiated by either client or server.

  4. Declaring specific Web service bindings of the security token service framework for security token renewal. Renewal is the process by which a previously issued token with expiration is presented at a security token service and the same token is returned with new expiration characteristics. Such a renewal binding should be defined for (but not be limited to) the following:

    1. Actions and elements for requesting the renewal of a single token.

    2. Actions and elements for responding with a renewed token (or tokens).

    3. Allowing for direct or indirect references to the security tokens being renewed.

  5. Declaring specific Web service trust bindings of the security token service framework for cancellation. When a previously issued token is no longer needed, the cancel binding can be used to cancel the token, terminating its use. Such cancel binding should define (but not be limited to) the following cases:

    1. Actions and elements for requesting the cancellation of a single token.

    2. Actions and elements for responding with the cancellation result.

    3. Allowing for direct or indirect references to the security tokens being cancelled.

  6. Declaring specific Web service trust bindings of the security token service framework for token validation. Validation binding is used to evaluate a security token (or OASIS Web Services Security [1] compliant message) and the result is returned as a status, token or both. Such a validation binding should be defined for (but not be limited to) the following:

    1. Actions and elements for requesting the validation of a token (or message).

    2. Actions and elements for responding about the validity of a token (or tokens).

    3. Allowing for direct or indirect references to the security tokens being validated.

  7. Generalizing the mechanism for a security token service to allow for multi-leg exchanges. Such exchange should allow for, but not be limited to "challenges", tunnelling of legacy binary protocols, and tunnelling of hardware-based legacy protocols. Specifically, the following models of challenge and exchanges should be defined by this specification:

    1. Signature challenge that requires the other party to sign specified information.

    2. Binary exchanges involving the usage of binary data from existing non-Web Services protocols.

    3. Exchanges involving request and passing of a key exchange token

Shared security contexts

OASIS Web Services Security [1] describes using security credentials to implement message integrity, confidentiality and authentication. In cases where multiple messages need to be exchanged securely, typically a shared security context is established between the communicating parties and used for the life time of the message exchange. This TC will also address adding extensions to Web Services Security [1] and define the appropriate secure SOAP message exchanges (see above) to permit the definition of shared security contexts.

This work will encompass:

  1. Defining mechanisms for establishing a shared security context in the following cases:

    1. When one of the communicating parties creates the context and propagates it to other parties.

    2. When the shared context is achieved through a sequence of negotiations.

    3. When the shared context is brokered through a third party security token service.

  2. Defining specific Web service bindings for security context establishment by utilizing the Web service trust binding elements for requesting and responding with security context tokens.

  3. Defining specific Web service bindings for renewal of the security context token.

  4. Defining specific Web service bindings for cancellation of the security context token.

  5. Defining specific Web service bindings for amendment of the claims associated with a security context.

  6. Since a shared security context may contain or imply a shared key, this specification must contain descriptions of common elements for key derivation models, where such a scheme is desirable for improving the security characteristics of the keys being used.

  7. Defining a token profile for use of security context tokens with OASIS Web Services Security [1].

  8. Defining a token profile for use of derived key tokens with OASIS Web Services Security [1].

Security policies

OASIS Web Services Security [1], WS-SecureConversation [2] and WS-Trust [3] define open-ended wire formats. WS-Policy [5] defines a framework for allowing web services to express their constraints and requirements as policy assertions. WS-SecurityPolicy [4] uses the facilities of WS-Policy [5] to express the conditions and restrictions on the wire formats defined by OASIS Web Services Security [1], WS-SecureConversation [2] and WS-Trust [3] to a specific set of typed message interchanges. That is to say WS-SecurityPolicy "strongly types" the supported security messages. This type of policy enablement allows the supported message exchanges to be analyzed from a security perspective to indicate which security protocols an end point supports.

This work will specifically define the following:

  1. Mechanism for specifying what parts of the message must be secured, called protection assertions

    1. Such protection assertions must be able to specify integrity requirements at both the element and header/body level in a security policy binding (defined below) neutral manner.

    2. Such protection assertions must be able to specify confidentiality requirements at both the element and header/body level in a security policy binding (defined below) neutral manner.

    3. Mechanisms to protect SOAP header elements or the SOAP body element must not require the use of XPath [21] but may provide it as an option.

  2. Mechanism for specifying pre-conditions of security, called conditional assertions

    1. Such conditional assertions must be able to specify the required elements in the message

  3. General mechanism for specifying tokens to use in protecting the message or binding claims to the message, called token assertions

    1. Such token assertions should facilitate the specification of at least the following token types defined by OASIS SOAP Message Security, WS-Trust and WS-SecureConversation: Username token, X509 token, Kerberos token, SPNego Context Token, Security Context Token, Secure Conversation Token, SAML token, REL token, HTTPS token as well as any opaque token issued by a security token service.

    2. Such token assertions should specify conditions for inclusion in the message such as whether the token should be included in every message explicitly, whether the token should be always excluded from the message and a reference included in the message, whether the token should be included once in a message exchange and external reference should be used subsequently.

    3. Such token assertions should support specification of derived keys.

  4. An abstraction for describing some of the common security usage patterns called security policy bindings.

    1. Such an abstraction should contain a description of the required and optional elements of such a security policy binding, including minimal token requirements, necessary key transfer mechanism, structure and contents of elements in wsse:security header, and correlation mechanisms.

    2. Such a binding framework should also include properties for describing algorithm suite to be used, whether a timestamp should be included, signature/encryption ordering in the message, whether signatures are encrypted, and whether the signing token should also be covered by the signature.

    3. Specific security policy binding assertions for the patterns where transport is used, where a symmetric key token is used for message security or where an asymmetric key token pair is used for message security.

  5. A mechanism for specifying additional token types that provide additional claims, called supporting token assertions. Such a mechanism should support the following cases:

    1. When additional tokens are used to sign additional parts of the message

    2. When additional tokens are signed by the primary signature token

    3. When additional tokens sign the primary signature

    4. When additional tokens sign the primary signature and are signed by the primary signature token

  6. A mechanism for specifying token referencing and token issuance called WSS assertions and Trust assertions that meet the referencing mechanisms and properties defined in OASIS Web Services Security 1.0 (and associated token profiles) [1], OASIS Web Services Security 1.1 (and associated token profiles) [6], in WS-Trust [3] and WS-SecureConversation [2]. Such a mechanism should include:

    1. Properties for indicating the Web Services Security 1.0 [1] defined reference mechanism to use

    2. Properties for indicating the Web Services Security 1.1 [6] defined reference mechanism to use including thumbprint reference and encryptedkey reference

    3. Signature confirmation requirement

    4. Properties for indicating the type of challenges required (as defined in WS-Trust [3])

    5. Properties for indicating the type of entropy mechanism required in a negotiation sequence (as defined in WS-Trust [3])

General Notes on Scope

The output specifications will uphold the basic principles of other Web services specifications of independence and composition and be composable with the other specifications in the Web services architecture, such as the specifications listed in the References section, numbers 1, 5-12 and 18-20. The TC will also take into consideration the following specifications/works listed in the References section, numbers 13, 14, 15 and 16.

If any of the above specifications is outside of a standardization process at the time this TC moves to ratify its deliverables, or is not far enough along in the standardization process, any normative references to it in the TC output will be expressed in an abstract manner, and the incarnation will be left at that time as an exercise in interoperability. While composition with other specifications is a goal of the TC, it is also a goal to leave the specifics of how that composition is achieved outside the scope of this TC. Each of the protocol elements will use implementation and language neutral XML formats defined in XML Schema [17].

Out of Scope

The following is a non-exhaustive list. It is provided only for the sake of clarity. If some function, mechanism or feature is not mentioned here, and it is not mentioned in the Scope of Work section either, then it will be deemed to be out of scope.

The TC will not define a mapping of the functions and elements described in the specifications to any programming language, to any particular messaging middleware, nor to specific network transports.

The following items are specifically out of scope of the work of the TC:

  1. Definition and management of trust policy expressions (that is, statements about who is trusted to make what claims about an entity); these are different from the in-scope "trust assertions" referred to in the Scope of Work section above

  2. Token revocation notifications and revocation management (e.g. via CRLs)

  3. Schemas for specific tokens issued, renewed, cancelled or validated as part of the trust process.

  4. The establishment of trust between two or more business parties

  5. Definition of new key derivation algorithms

  6. Providing a general purpose boxcaring model

  7. Definition of APIs

  8. Definition of additional negotiation and challenge protocol mechanisms.

  9. Developing the roadmaps [15], [16] or other specifications mentioned in those roadmaps, beyond the material listed explicitly as within the scope of this charter.

The TC will not attempt to define concepts or renderings for functions that are of wider applicability including but not limited to:

  • Addressing

  • Policy language frameworks

  • Routing

  • Reliable message exchange

  • Transactions and compensation

Where required these functions are achieved by composition with other Web services specifications.

The TC will not attempt to define functionality duplicating that of any normatively referenced specification in the input WS-SecureConversation [2], WS-Trust [3] or WS-SecurityPolicy [4] specifications.If the referenced specification is outside of a standardization process at the time this TC moves to ratify its deliverables, or is not far along enough in the standardization process, any normative references to it in the TC output will be expressed in an abstract manner, and the incarnation will be left at that time as an exercise in interoperability.

d. Deliverables

The TC has the following set of deliverables:

  • A revised Web Services SecureConversation specification and associated Schema. A Committee Specification is scheduled for completion within 18 months of the first TC meeting.

  • A revised Web Services Trust specification with associated Schema and WSDL. A Committee Specification is scheduled for completion within 18 months of the first TC meeting.

  • A revised Web Services SecurityPolicy specification and associated Schema. A Committee Specification is scheduled for completion within 18 months of the first TC meeting.

  • A non-normative Examples document expected to be delivered by end of 2007.

These specifications will reflect refinements, corrections or material technological improvements with respect to the input documents and in accordance with this charter. Ratification of the above specifications as OASIS standards. Following this, ratification of updated specifications as revised OASIS standards to address any errata to fix errors and to replace policy references to the WS-Policy W3C Recommendation as soon as that Recommendation is available will mark the end of the TCs lifecycle.

e. Anticipated Audience

The anticipated audience for this work includes:

  • Vendors offering web services products

  • Other specification authors that need security for Web services

  • Software architects and programmers, who design, write or integrate applications for Web services

  • End users implementing Web services-based solutions that require an interoperable, composable solution for trusted SOAP message exchanges, security policies and shared security contexts.

  • Vendors making gateway and router class products (both hardware and software)

f. Language

TC business will be conducted in English.

g. IPR Policy

This TC will operate under the "RF (Royalty Free) on RAND Terms" IPR mode as defined in the OASIS Intellectual Property Rights (IPR) Policy, effective 15 April 2005.

References

[1] WS-Security Version 1.0
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0.pdf

Web Services Security: SAML Token Profile 1.0
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0.pdf

Web Services Security: REL Token Profile 1.0
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf

[2] WS-SecureConversation
http://schemas.xmlsoap.org/ws/2005/02/sc

[3] WS-Trust
http://schemas.xmlsoap.org/ws/2005/02/trust

[4] WS-SecurityPolicy
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy

[5] WS-Policy
http://schemas.xmlsoap.org/ws/2004/09/policy/

[6] WS-Security Version 1.1
http://www.oasis-open.org/committees/download.php/13397/wss-v1.1-spec-pr-SOAPMessageSecurity-01.pdf

http://www.oasis-open.org/committees/download.php/13396/wss-v1.1-spec-pr-SOAPMessageSecurity-01.htm

Web Services Security: SAML Token Profile 1.1
http://www.oasis-open.org/committees/download.php/13404/wss

Web Services Security: X.509 Certificate Token Profile 1.1
http://www.oasis-open.org/committees/download.php/13383/wss-v1.1-spec-pr-x509TokenProfile-01.htm

Web Services Security: Kerberos Token Profile 1.1
http://www.oasis-open.org/committees/download.php/13389/wss-v1.1-spec-pr-KerberosTokenProfile-01.htm

Web Services Security: UsernameToken Profile 1.1
http://www.oasis-open.org/committees/download.php/13392/wss-v1.1-spec-pr-UsernameTokenProfile-01.htm

Web Services Security: Rights Expression Language (REL) Token Profile 1.1
http://www.oasis-open.org/committees/download.php/13301/wss-v1.1-spec-pr-RELTokenProfile.htm

Web Services Security: SOAP Messages with Attachments (SwA) Profile 1.1
http://www.oasis-open.org/committees/download.php/13288/wss-v1.1-spec-pr-SwAProfile-01.html

[7] WS-ReliableMessaging
http://www.oasis-open.org/committees/document.php?document_id=13220&wg_abbrev=ws-rx

[8] WS-Addressing
http://www.w3.org/Submission/2004/SUBM-ws-addressing-20040810/

[9] SOAP 1.1
http://www.w3.org/TR/2000/NOTE-SOAP-20000508/

[10] SOAP 1.2
http://www.w3.org/TR/2003/REC-soap12-part1-20030624/

[11] WSDL 1.1
http://www.w3.org/TR/2001/NOTE-wsdl-20010315

[12] WSDL 2.0
http://www.w3.org/TR/wsdl20/

[13] WS-I Basic Profile
http://www.ws-i.org/deliverables/workinggroup.aspx?wg=basicprofile

[14] WS-I Basic Security Profile
http://www.ws-i.org/Profiles/BasicSecurityProfile-1.0.html

[15] Secure, Reliable, Transacted Web Services: Architecture & Composition
http://msdn.microsoft.com/webservices/understanding/advancedwebservices/default.aspx?pull=/library/en-us/dnwebsrv/html/wsoverview.asp

http://www-128.ibm.com/developerworks/webservices/library/ws-securtrans/index.html

[16] Security in a Web Services World: A Proposed Architecture and Roadmap
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwssecur/html/securitywhitepaper.asp

http://www-128.ibm.com/developerworks/library/ws-secmap/

[17] XML Schema
XML Schema Part 1: Structures
http://www.w3.org/TR/2001/REC-xmlschema-1-20010502/

XML Schema Part 2: Datatypes
http://www.w3.org/TR/2001/REC-xmlschema-2-20010502/

[18] WS-Coordination
http://schemas.xmlsoap.org/ws/2004/10/wscoor

[19] WS-AtomicTransaction
http://schemas.xmlsoap.org/ws/2004/10/wsat

[20] WS-BusinessActivity
http://schemas.xmlsoap.org/ws/2004/10/wsba

[21] XPath 1.0
http://www.w3.org/TR/1999/REC-xpath-19991116

[22] ITU-T Recommendation X.509 (2000)
http://www.itu.int/ITU-T/asn1/database/itu-t/x/x509/2000/index.html, March 2000.

[23] Liberty Identity Web Services Framework (ID-WSF)
http://www.projectliberty.org/resources/specifications.php

[24] Liberty ID-WSF Authentication Service Specification
http://www.projectliberty.org/specs/draft-liberty-idwsf-authn-svc-v2.0-02.pdf

[25] Open Mobile Alliance Web Services Enabler (OWSER)
http://www.openmobilealliance.org/release_program/owser_v10.html

[26] J. Kohl and C. Neuman,
"The Kerberos Network Authentication Service 311 (V5)," RFC 1510,
September 1993,
http://www.ietf.org/rfc/rfc1510.txt

[27] Security Requirements for Cryptographic Modules,
May 2001.
See http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf

[28] Security Assertion Markup Language (SAML)
http://www.oasis-open.org/committees/security/

[29] eXtensible Access Control Markup Language (XACML)
http://www.oasis-open.org/committees/xacml/

[30] XML Key Management Specification (XKMS)
http://www.w3.org/2001/XKMS/

END

 

TOP OF PAGE