1、 International Telecommunication Union ITU-T X.1143TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (11/2007) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Telecommunication security Security architecture for message security in mobile web services ITU-T Recommendation X.1143 ITU-T
2、 X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS Services and facilities X.1X.19 Interfaces X.20X.49 Transmission, signalling and switching X.50X.89 Network aspects X.90X.149 Maintenance X.150X.179 Administrative arrangements X.180X.199 OPEN SYSTE
3、MS INTERCONNECTION Model and notation X.200X.209 Service definitions X.210X.219 Connection-mode protocol specifications X.220X.229 Connectionless-mode protocol specifications X.230X.239 PICS proformas X.240X.259 Protocol Identification X.260X.269 Security Protocols X.270X.279 Layer Managed Objects X
4、.280X.289 Conformance testing X.290X.299 INTERWORKING BETWEEN NETWORKS General X.300X.349 Satellite data transmission systems X.350X.369 IP-based networks X.370X.379 MESSAGE HANDLING SYSTEMS X.400X.499DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS Networking X.600X.629 Efficiency X.630X.639
5、Quality of service X.640X.649 Naming, Addressing and Registration X.650X.679 Abstract Syntax Notation One (ASN.1) X.680X.699 OSI MANAGEMENT Systems Management framework and architecture X.700X.709 Management Communication Service and Protocol X.710X.719 Structure of Management Information X.720X.729
6、 Management functions and ODMA functions X.730X.799 SECURITY X.800X.849 OSI APPLICATIONS Commitment, Concurrency and Recovery X.850X.859 Transaction processing X.860X.879 Remote operations X.880X.889 Generic applications of ASN.1 X.890X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 TELECOMMUNICATION SE
7、CURITY X.1000 For further details, please refer to the list of ITU-T Recommendations. ITU-T Rec. X.1143 (11/2007) i ITU-T Recommendation X.1143 Security architecture for message security in mobile web services Summary ITU-T Recommendation X.1143 describes the security architecture and scenarios for
8、message security in mobile web services. Security services for messages are the most fundamental security requirements for mobile web services. Although the components for message security such as WS-Security have been standardized, standard architecture and service scenarios for providing message s
9、ecurity for mobile web services have yet to be defined. Since simple object access protocol (SOAP) messages use hypertext transfer protocol (HTTP) ports, they cannot be filtered by firewalls; hence the need to provide a message filtering mechanism based on the message contents in the architecture fo
10、r secure mobile web services as well as to integrate the security policy mechanism suitable for mobile web services message security and the message filtering mechanism into the architecture. Since many mobile terminals do not have sufficient processing power to support the web services protocol sta
11、ck fully, and many back-end application servers are not based on web services, interworking mechanisms and scenarios between mobile web services and legacy non-web services applications should be provided. This Recommendation seeks to establish a guideline for security architecture and security serv
12、ice scenarios for message security in mobile web services satisfying the above-mentioned requirements. Source ITU-T Recommendation X.1143 was approved on 13 November 2007 by ITU-T Study Group 17 (2005-2008) under the ITU-T Recommendation A.8 procedure. Keywords Message security, mobile web services,
13、 security gateway, security policy, web services security. ii ITU-T Rec. X.1143 (11/2007) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommunication
14、 Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTS
15、A), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall w
16、ithin ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this Recom
17、mendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure e.g., interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory language such
18、 as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the practice or implementation of this Recommend
19、ation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation development process. As of the date of approva
20、l of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TSB pat
21、ent database at http:/www.itu.int/ITU-T/ipr/. ITU 2008 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. ITU-T Rec. X.1143 (11/2007) iii CONTENTS Page 1 Scope 1 2 References. 1 3 Definitions 2 3.1 Terms defined e
22、lsewhere 2 3.2 Terms defined in this Recommendation. 3 4 Abbreviations and acronyms 4 5 Conventions 5 6 Introduction of mobile web services security-related standards. 5 7 Requirements of security architecture and scenarios for message security in mobile web services 7 8 Security model for mobile we
23、b services. 8 8.1 Security threats to mobile web services . 8 8.2 Security requirements. 9 8.3 Security functions for mobile web services 10 8.4 Security architecture for mobile web services 12 8.5 Message security service scenario for mobile web services 14 8.6 Message filtering 17 9 Use cases for
24、message security in mobile web services. 18 Appendix I Reference security architecture for message security in mobile web services 20 I.1 Overall security architecture for message security in mobile web services. 20 I.2 Components of the mobile web services security gateway 23 Appendix II Use cases
25、for message security in mobile web services. 25 II.1 Use case 1. 25 II.2 Use case 2. 28 II.3 Use case 3. 30 II.4 Use case 4. 33 Appendix III Examples of security policy description . 36 Appendix IV Comparison with other standards 38 IV.1 Parlay X 38 IV.2 AAA . 39 IV.3 OMA. 39 Bibliography. 41 ITU-T
26、Rec. X.1143 (11/2007) 1 ITU-T Recommendation X.1143 Security architecture for message security in mobile web services 1 Scope The scope of this Recommendation deals with the security architecture and security service scenarios for secure mobile web services as described below: Integrated security ar
27、chitecture for message security in mobile web services consisting of various mobile terminals and networks. Interworking mechanisms and service scenarios between applications that support the full web services security protocol stacks and legacy applications that do not support the full web services
28、 security protocol stack. Authentication, integrity and confidentiality mechanisms of the message in the mobile web services environment. Integrated security architecture that utilizes the security policy for message security in the mobile web services environment. Message filtering mechanism based
29、on the message contents for the message security architecture. Reference message security architecture and security service scenarios for mobile web services. The following objectives are not within the scope of this Recommendation: To define a new security policy language or an access control langu
30、age. To define a new transport level security protocol or a message level security protocol. 2 References The following ITU-T Recommendations and other references contain provisions which, through reference in this text, constitute provisions of this Recommendation. At the time of publication, the e
31、ditions indicated were valid. All Recommendations and other references are subject to revision; users of this Recommendation are therefore encouraged to investigate the possibility of applying the most recent edition of the Recommendations and other references listed below. A list of the currently v
32、alid ITU-T Recommendations is regularly published. The reference to a document within this Recommendation does not give it, as a stand-alone document, the status of a Recommendation. ITU-T X.800 ITU-T Recommendation X.800 (1991), Security architecture for Open Systems Interconnection for CCITT appli
33、cations. ITU-T X.805 ITU-T Recommendation X.805 (2003), Security architecture for systems providing end-to-end communications. ITU-T X.1141 ITU-T Recommendation X.1141 (2006), Security Assertion Markup Language (SAML 2.0). ITU-T X.1142 ITU-T Recommendation X.1142 (2006), eXtensible Access Control Ma
34、rkup Language (XACML 2.0). IETF RFC 2246 IETF RFC 2246 (1999), The TLS Protocol Version 1.0. IETF RFC 2828 IETF RFC 2828 (2000), Internet Security Glossary. 2 ITU-T Rec. X.1143 (11/2007) IETF RFC 3075 IETF RFC 3075 (2001), XML-Signature Syntax and Processing. IETF RFC 3198 IETF RFC 3198 (2001), Term
35、inology for Policy-Based Management. OASIS WSS OASIS Standard (2006), Web Services Security: SOAP Message Security 1.1 (WS-Security 2004). OASIS WSS-SAML OASIS Standard (2006), Web Services Security: SAML Token Profile 1.1. OASIS WSS-UsernameToken OASIS Standard (2006), Web Services Security: Userna
36、meToken Profile 1.1. OASIS WSS-X.509 OASIS Standard (2006), Web Services Security: X.509 Certificate Token Profile 1.1. (Including errata) OASIS WS-SecPol OASIS Standard, WS-SecurityPolicy 1.2 (2007). W3C P3P W3C Recommendation (2002), The Platform for Privacy Preferences 1.0 (P3P1.0) Specification.
37、 W3C WSDL W3C Recommendation (2007), Web Services Description Language (WSDL) Version 2.0 Part 0: Primer. W3C XML-Enc W3C Recommendation (2002), XML Encryption Syntax and Processing. 3 Definitions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewhere: 3.1.1 acces
38、s control: ITU-T X.800 3.1.2 authentication: ITU-T X.800 3.1.3 authorization: ITU-T X.800 3.1.4 availability: ITU-T X.800 3.1.5 confidentiality: ITU-T X.800 3.1.6 data integrity: ITU-T X.800 3.1.7 data origin authentication: ITU-T X.800 ITU-T Rec. X.1143 (11/2007) 3 3.1.8 key: ITU-T X.800 3.1.9 key
39、management: ITU-T X.800 3.1.10 non-repudiation: ITU-T X.800 3.1.11 policy decision point: IETF RFC 3198 3.1.12 policy enforcement point: IETF RFC 3198 3.1.13 privacy: ITU-T X.800 3.1.14 security architecture: IETF RFC 2828 3.1.15 security policy: IETF RFC 2828 3.1.16 security service: IETF RFC 2828
40、3.1.17 trust: IETF RFC 2828 3.2 Terms defined in this Recommendation This Recommendation defines the following terms: 3.2.1 application service: This is an entity that provides various value-added services to the service requesters. 3.2.2 artifact: A piece of digital information. An artifact may be
41、any size, and may be composed of other artifacts. Examples of artifacts: a message; a URI; an XML document; a PNG image; a bit stream. b-W3C Glossary 3.2.3 discovery: The act of locating a machine-processable description of a web service-related resource that may have been previously unknown and tha
42、t meets certain functional criteria. It involves matching a set of functional and other criteria with a set of resource descriptions. The goal is to find an appropriate web service-related resource. b-W3C Glossary 3.2.4 discovery service: This is an entity that stores interface information for appli
43、cation services and related security policies for access to the application services by clients. Clients can get such information from the discovery service by sending queries that describe the services they want to access. 3.2.5 end point: An association between a binding and a network address, spe
44、cified by a URI, that may be used to communicate with an instance of a service. An end point indicates a specific location for accessing a service using a specific protocol and data format. b-W3C Glossary 3.2.6 gateway: This is a network node that terminates a message on an inbound interface with th
45、e intent of applying some security processing or message conversions to the message, and presenting it to the target service through an outbound interface. 3.2.7 identifier: An identifier is an unambiguous name for a resource. b-W3C Glossary 3.2.8 policy server: This is an entity that manages securi
46、ty policies related to the security processing of messages and access control policies for the messages. 3.2.9 principal: This is an entity whose identity can be authenticated. Examples of principals include an end user or an organization. 3.2.10 registry: Authoritative, centrally controlled store o
47、f information. b-W3C Glossary 3.2.11 service description: A service description is a set of documents that describe the interface to and semantics of a service. b-W3C Glossary 3.2.12 service interface: A service interface is the abstract boundary that a service exposes. It defines the types of messa
48、ges and the message exchange patterns that are involved in interacting with the service, together with any conditions implied by those messages. b-W3C Glossary 4 ITU-T Rec. X.1143 (11/2007) 3.2.13 service provider: The person or organization that is providing a web service. b-W3C Glossary 3.2.14 ser
49、vice requester: A software agent that wishes to interact with a provider agent in order to request that a task be performed on behalf of its owner, the requester entity. b-W3C Glossary 3.2.15 SOAP intermediary: A SOAP intermediary is both a SOAP receiver and a SOAP sender and is targetable from within a SOAP message. It processes the SOAP header blocks targeted at it and acts to forward a SOAP message towards an ultimate SOAP receiver. b-W3C Gloss
