Application of XML Schema in Web Services Security.ppt

QuickTree Inc. Application of XML Schema in Web Services Security About me 10 years in enterprise software business XML focus since 1998 Projects XML Schema 1.0 validation engine, SOAP security framework,? XSLT 1.0 compiler, hardware based XML Parser. Large XML based language for a declarative constraint engine Storing XML documents in a RDBMS XML Schemas for Catalog Services, XML based RPCs and Workflows Systems QuickTree SOAP Security Module (SSM) Designed from the ground up with OEM integration in mind, the SSM hides the complexities of XML processing and allows network equipment like Firewalls, SSL VPN devices and Load Balancers to inspect and secure Web Services traffic SOAP Security in the Network Features XML Denial of Service Prevention ?- Checking for XML well-formedness, nested element depth, element length, message size, external entities, attribute length, etc WSDL Based Access Control ?- Limit a user or groups access to particular services or operations defined in the WSDL file SOAP Structural and Parameter Validation -?Prevent mal-structured SOAP messages and apply parameter validation using type checking with full support for regex based schema types SQL and Command Injection Protection ?- Detect and block command injection attacks, commonly hidden as valid parameters Streaming mode interface -?XML messages can be forwarded to the QuickTree module as they come in without blocking QuickTree SOAP Security Module (SSM) User Experience WSDL Based validation XML Schema 1.0 validation engine (‘C’ based) Generate schema by combining WSDL, XML Schema and SOAP Streaming and Hardwarized Structural Validation vs Data-type validation ACLs Issues Schema Specification XML Schemas with multiple target namespaces xsi:type and encoding style Mapping WSDL/SOAP types to XML Schema types (Ex: soapenc:arrayType) Versioning Compliance Levels Support compliance/conformance levels (like internationalization standards) Structural validation and/or Data-type valid