Article

A semantics for web services authentication

Authors:

Karthikeyan Bhargavan,

Cédric Fournet, and

Andrew D. GordonAuthors Info & Claims

POPL '04: Proceedings of the 31st ACM SIGPLAN-SIGACT symposium on Principles of programming languages

January 2004

Pages 198 - 209

https://doi.org/10.1145/964001.964018

Published: 01 January 2004 Publication History

Abstract

We consider the problem of specifying and verifying cryptographic security protocols for XML web services. The security specification WS-Security describes a range of XML security tokens, such as username tokens, public-key certificates, and digital signature blocks, amounting to a flexible vocabulary for expressing protocols. To describe the syntax of these tokens, we extend the usual XML data model with symbolic representations of cryptographic values. We use predicates on this data model to describe the semantics of security tokens and of sample protocols distributed with the Microsoft WSE implementation of WS-Security. By embedding our data model within Abadi and Fournet's applied pi calculus, we formulate and prove security properties with respect to the standard Dolev-Yao threat model. Moreover, we informally discuss issues not addressed by the formal model. To the best of our knowledge, this is the first approach to the specification and verification of security protocols based on a faithful account of the XML wire format.

References

[1]

M. Abadi and C. Fournet. Mobile values, new names, and secure communication. In 28th ACM Symposium on Principles of Programming Languages (POPL'01), pages 104--115, 2001.]]

Digital Library

[2]

M. Abadi, C. Fournet, and G. Gonthier. Authentication primitives and their compilation. In 27th ACM Symposium on Principles of Programming Languages (POPL'00), pages 302--315, 2000.]]

Digital Library

[3]

B. Atkinson, G. Della-Libera, S. Hada, M. Hondo, P. Hallam-Baker, C. Kaler, J. Klein, B. LaMacchia, P. Leach, J. Manferdelli, H. Maruyama, A. Nadalin, N. Nagaratnam, H. Prafullchandra, J. Shewchuk, and D. Simon. Web services security (WS-Security), version 1.0. http://msdn.microsoft.com/library/en-us/dnglobspec/html/ws-security.asp. Draft submitted to OASIS Web Services Security TC, April 2002.]]

[4]

K. Bhargavan, C. Fournet, and A. D. Gordon. A semantics for web services authentication. Technical Report MSR--TR--2003--83, Microsoft Research, 2003.]]

[5]

B. Blanchet. From secrecy to authenticity in security protocols. In Proceedings of the 9th International Static Analysis Symposium (SAS'02), volume 2477 of LNCS, pages 342--359. Springer, 2002.]]

Digital Library

[6]

D. Box, D. Ehnebuske, G. Kakivaya, A. Layman, N. Mendelsohn, H. Nielsen, S. Thatte, and D. Winer. Simple Object Access Protocol (SOAP) 1.1, 2000. W3C Note, http://www.w3.org/TR/2000/NOTE-SOAP-20000508/.]]

[7]

J. Boyer. Canonical XML, 2001. W3C Recommendation, http://www.w3.org/TR/2001/REC-xml-c14n-20010315/.]]

[8]

J. Boyer, D. E. Eastlake, and J. Reagle. Exclusive XML Canonicalization, 2002. W3C Recommendation, http://www.w3.org/TR/2002/REC-xml-exc-c14n-20020718/.]]

Digital Library

[9]

M. Burrows, M. Abadi, and R. Needham. A logic of authentication. Proceedings of the Royal Society of London A, 426:233--271, 1989.]]

[10]

E. Cohen. TAPS: A first-order verifier for cryptographic protocols. In 13th IEEE Computer Security Foundations Workshop, pages 144--158. IEEE Computer Society Press, 2000.]]

Digital Library

[11]

J. Cowan and R. Tobin. XML Information Set, 2001. W3C Recommendation, http://www.w3.org/TR/2001/REC-xml-infoset-20011024/.]]

[12]

E. Damiani, S. De Capitani di Vimercati, S. Paraboschi, and P. Samarati. Securing SOAP e-services. International Journal of Information Security, 1(2):100--115, 2002.]]

[13]

E. Damiani, S. De Capitani di Vimercati, and P. Samarati. Towards securing XML web services. In ACM Workshop on XML Security 2002, pages 90--96, 2003.]]

Digital Library

[14]

T. Dierks and C. Allen. The TLS protocol: Version 1.0, 1999. RFC 2246.]]

Digital Library

[15]

D. Dolev and A. Yao. On the security of public key protocols. IEEE Transactions on Information Theory, IT--29(2):198--208, 1983.]]

Digital Library

[16]

D. Eastlake and P. Jones. US Secure Hash Algorithm 1 (SHA1), 2001. RFC 3174.]]

Digital Library

[17]

D. Eastlake, J. Reagle, D. Solo, M. Bartel, J. Boyer, B. Fox, B. LaMacchia, and E. Simon. XML-Signature Syntax and Processing, 2002. W3C Recommendation, http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/.]]

Digital Library

[18]

C. Fournet and M. Abadi. Hiding names: Private authentication in the applied pi calculus. In M. Okada, B. Pierce, A. Scedrov, H. Tokuda, and A. Yonezawa, editors, Software Security -- Theories and Systems. Mext-NSF-JSPS International Symposium, Tokyo, Nov. 2002 (ISSS'02), volume 2609 of LNCS, pages 317--338. Springer, 2003.]]

[19]

A. Gordon and A. Jeffrey. Authenticity by typing for security protocols. Journal of Computer Security, 11(4):451--521, 2003.]]

Digital Library

[20]

A. Gordon and R. Pucella. Validating a web service security abstraction by typing. In ACM Workshop on XML Security 2002, pages 18--29, 2003.]]

Digital Library

[21]

J. Jonsson and B. Kaliski. Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1, 2003. RFC 3447.]]

Digital Library

[22]

R. Kemmerer, C. Meadows, and J. Millen. Three systems for cryptographic protocol analysis. Journal of Cryptology, 7(2):79--130, 1994.]]

Digital Library

[23]

H. Krawczyk, M. Bellare, and R. Canetti. HMAC: Keyed-hashing for message authentication, 1997. RFC 2104.]]

Digital Library

[24]

G. Lowe. Breaking and fixing the Needham-Schroeder public-key protocol using CSP and FDR. In Tools and Algorithms for the Construction and Analysis of Systems, volume 1055 of LNCS, pages 147--166. Springer, 1996.]]

Digital Library

[25]

Microsoft Corporation. Microsoft .NET Pet Shop, 2002. http://www.gotdotnet.com/team/compare/petshop.aspx.]]

[26]

Microsoft Corporation. Web Services Enhancements for Microsoft .NET, Dec. 2002. http://msdn.microsoft.com/webservices/building/wse/default.aspx.]]

[27]

R. Milner. Communicating and Mobile Systems: the π-Calculus. Cambridge University Press, 1999.]]

Digital Library

[28]

A. Nadalin, C. Kaler, P. Hallam-Baker, and R. Monzillo. Web Services Security: SOAP Message Security, Aug. 2003. Available from http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=wss.]]

[29]

R. Needham and M. Schroeder. Using encryption for authentication in large networks of computers. Commun. ACM, 21(12):993--999, 1978.]]

Digital Library

[30]

H. F. Nielsen and S. Thatte. Web services routing protocol (WS-Routing). http://msdn.microsoft.com/library/en-us/dnglobspec/html/ws-routing.asp, October 2001.]]

[31]

L. Paulson. The inductive approach to verifying cryptographic protocols. Journal of Computer Security, 6:85--128, 1998.]]

Digital Library

[32]

J. H. Saltzer, D. P. Reed, and D. D. Clark. End-to-end arguments in system design. ACM Transactions in Computer Systems, 2(4):277--288, November 1984.]]

Digital Library

[33]

M. Satyanarayanan. Integrating security in a large distributed system. ACM Trans. Comput. Syst., 7(3):247--280, 1989.]]

Digital Library

[34]

J. Siméon and P. Wadler. The essence of XML. In 30th ACM Symposium on Principles of Programming Languages (POPL'03), pages 1--13, 2003.]]

Digital Library

[35]

F. Thayer Fábrega, J. Herzog, and J. Guttman. Strand spaces: Proving security protocols correct. Journal of Computer Security, 7:191--230, 1999.]]

Digital Library

[36]

L. van Doorn, M. Abadi, M. Burrows, and E. Wobber. Secure network objects. In IEEE Computer Society Symposium on Research in Security and Privacy, pages 211--221, 1996.]]

Digital Library

[37]

T. Woo and S. Lam. A semantic model for authentication protocols. In IEEE Computer Society Symposium on Research in Security and Privacy, pages 178--194, 1993.]]

Digital Library

Cited By

Sankaran ADatta PBates A(2020)Workflow Integration Alleviates Identity and Access Management in Serverless ComputingProceedings of the 36th Annual Computer Security Applications Conference10.1145/3427228.3427665(496-509)Online publication date: 7-Dec-2020
https://dl.acm.org/doi/10.1145/3427228.3427665
May MLux KGunter C(2020)WSEmailService Oriented Computing and Applications10.1007/s11761-019-00283-914:1(5-17)Online publication date: 21-Jan-2020
https://doi.org/10.1007/s11761-019-00283-9
Blanchet BPaiola MSadeghi AGligor VYung M(2013)Automatic verification of protocols with lists of unbounded lengthProceedings of the 2013 ACM SIGSAC conference on Computer & communications security10.1145/2508859.2516679(573-584)Online publication date: 4-Nov-2013
https://dl.acm.org/doi/10.1145/2508859.2516679
Show More Cited By

Index Terms

A semantics for web services authentication
1. Theory of computation
  1. Semantics and reasoning
    1. Program semantics

Recommendations

A semantics for web services authentication
Theoretical foundations of security analysis and design II

We consider the problem of specifying and verifying cryptographic security protocols for XML web services. The security specification WS-Security describes a range of XML security elements, such as username tokens, public-key certificates, and digital ...
Read More
A semantics for web services authentication
POPL '04

We consider the problem of specifying and verifying cryptographic security protocols for XML web services. The security specification WS-Security describes a range of XML security tokens, such as username tokens, public-key certificates, and digital ...
Read More
Secure sessions for Web services

We address the problem of securing sequences of SOAP messages exchanged between web services and their clients. The WS-Security standard defines basic mechanisms to secure SOAP traffic, one message at a time. For typical web services, however, using WS-...
Read More

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

POPL '04: Proceedings of the 31st ACM SIGPLAN-SIGACT symposium on Principles of programming languages

January 2004

364 pages

ISBN:158113729X

DOI:10.1145/964001

General Chair:
Neil D. Jones
DIKU, University of Copenhagen
,
Program Chair:
Xavier Leroy
INRIA Rocquencourt

ACM SIGPLAN Notices Volume 39, Issue 1
POPL '04
January 2004
352 pages
ISSN:0362-1340
EISSN:1558-1160
DOI:10.1145/982962
Issue’s Table of Contents

Copyright © 2004 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 01 January 2004

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Article

Conference

POPL04

Sponsor:

POPL04: The 31st Annual ACM Symposium on Principles of Programming Languages

January 14 - 16, 2004

Venice, Italy

Acceptance Rates

POPL '04 Paper Acceptance Rate 29 of 176 submissions, 16%;

Overall Acceptance Rate 824 of 4,130 submissions, 20%

Upcoming Conference

POPL '25

Sponsor:
sigplan

The 52nd Annual ACM SIGPLAN Symposium on Principles of Programming Languages

January 19 - 25, 2025

Denver , CO , USA

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

40
Total Citations
View Citations
2,468
Total Downloads

Downloads (Last 12 months)8
Downloads (Last 6 weeks)1

Other Metrics

View Author Metrics

Citations

Cited By

Sankaran ADatta PBates A(2020)Workflow Integration Alleviates Identity and Access Management in Serverless ComputingProceedings of the 36th Annual Computer Security Applications Conference10.1145/3427228.3427665(496-509)Online publication date: 7-Dec-2020
https://dl.acm.org/doi/10.1145/3427228.3427665
May MLux KGunter C(2020)WSEmailService Oriented Computing and Applications10.1007/s11761-019-00283-914:1(5-17)Online publication date: 21-Jan-2020
https://doi.org/10.1007/s11761-019-00283-9
Blanchet BPaiola MSadeghi AGligor VYung M(2013)Automatic verification of protocols with lists of unbounded lengthProceedings of the 2013 ACM SIGSAC conference on Computer & communications security10.1145/2508859.2516679(573-584)Online publication date: 4-Nov-2013
https://dl.acm.org/doi/10.1145/2508859.2516679
Oreku GLi J(2011)End User Authentication (EUA) Model and Password for SecurityOrganizational and End-User Interactions10.4018/978-1-60960-577-3.ch007(149-164)Online publication date: 2011
https://doi.org/10.4018/978-1-60960-577-3.ch007
Ye XLiao L(2011)Verifying Authenticity in Interactive Behaviors of SemanticWeb ServicesAdvances in Intelligent Web Mastering – 310.1007/978-3-642-18029-3_14(131-141)Online publication date: 2011
https://doi.org/10.1007/978-3-642-18029-3_14
Michlmayr ARosenberg FLeitner PDustdar S(2010)Selective Service Provenance in the VRESCo RuntimeInternational Journal of Web Services Research10.4018/jwsr.20100401047:2(65-86)Online publication date: 1-Apr-2010
https://doi.org/10.4018/jwsr.2010040104
Phillips A(2010)Specifying and Implementing Secure Mobile ApplicationsProcess Algebra for Parallel and Distributed Processing10.1201/9781420064872.ch8Online publication date: 31-Jan-2010
https://doi.org/10.1201/9781420064872.ch8
Kürtz KSchnoor HWilke TFeng DBasin DLiu P(2010)Computationally secure two-round authenticated message exchangeProceedings of the 5th ACM Symposium on Information, Computer and Communications Security10.1145/1755688.1755715(214-225)Online publication date: 13-Apr-2010
https://dl.acm.org/doi/10.1145/1755688.1755715
Kuo-Yi Chen Chin-Yang Lin Ting-Wei Hou (2010)A low-cost secure schemes for authentications and access control with the use of multiple public IC cards2010 3rd International Conference on Advanced Computer Theory and Engineering(ICACTE)10.1109/ICACTE.2010.5579553(V3-609-V3-613)Online publication date: Aug-2010
https://doi.org/10.1109/ICACTE.2010.5579553
Ye XLiao L(2010)OWL-based verifying temporal properties for pervasive computing2010 IEEE Globecom Workshops10.1109/GLOCOMW.2010.5700209(1596-1600)Online publication date: Dec-2010
https://doi.org/10.1109/GLOCOMW.2010.5700209
Show More Cited By

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents