Single Sign OnSingle Sign On

SE lab 박사 2 학기조동일

Single Sign OnSingle Sign On 22

OutlineOutline• SSO(Single Singn-On) 이란 ?• 관련기술

– 데이터 암호화• RSA• SessionKey• 전자 서명

– 인증 프로토콜• Kerberos• SAML

• IBM Tivoli WebSEAL• Oracle SSO• SSO Issue• 참고자료

Single Sign OnSingle Sign On 33

SSO(Single Sign-On)SSO(Single Sign-On) 이란이란 ??• 인증데이터의 공유• 1997 년 IBM 이 개발• Benefits of single sign-on

– Reducing password fatigue from different user name and password combinations

– Reducing time spent re-entering passwords for the same identity

– Can support conventional authentication such as Windows Credentials

– Reducing IT costs due to lower number of IT help desk calls about passwords

– Security on all levels of entry/exit/access to systems without the inconvenience of re-prompting users

– Centralized reporting for compliance adherence

[ SSO 시나리오 1 ]SP : Service Provider IdP : id Provider

[ SSO 시나리오 2 ]

Single Sign OnSingle Sign On 44

관련기술관련기술• 데이터 암호화

– RSA– SessionKey– 전자서명

• 인증 프로토콜– Kerberos– SAML

Single Sign OnSingle Sign On 55

RSARSA• 가장 널리쓰이는 비대칭키 암호화 알고리즘 (= 공개키

암호화 알고리즘 )• 대칭키 암호화의 한계에 의해 개발

– 키 노출

• 1977 년 MIT 의 Ron RRivest, Ad SShamir, Len AAdleman 에 의해 개발

• 키교체 가능• 128bit 키 대칭키 암호화 = 1024bit 키 비대칭키 암호화• 약점

– 암호화 키의 공격– 비대칭암호화에 비해 느린 암호화 속도

Single Sign OnSingle Sign On 66

RSA Work FlowRSA Work Flow

평문 암호화 암호문 복호화 평문

B 개인키B 공개키

A SideA Side networknetwork B SideB Side

Single Sign OnSingle Sign On 77

SessionKeySessionKey• 데이터는 대칭키로 암호화 , 대칭키는 공개키로 암호화• 대칭키 암호화의 장점 + 비대칭키 암호화의 장점• 대표적인 세션키 암호화

– PGP(Pretty Good Privacy)• 1991 년 Phil Zimmermann• email 암호화에 주로 쓰임

– S/MIME(Secure/Multipurpose Internet Mail Extension)• RSA 에 의해 고안• email 암호화에 주로 쓰임

– SSL, TLS• Secure Socket Layer, Transport Layer Security• TCP/IP 트래픽 보안을 위해 개발

Single Sign OnSingle Sign On 88

SessionKey Work FlowSessionKey Work Flow

평문 대칭키암호화 암호문 대칭키복호화 평문

B PrivateKey

대칭키

A SideA Side networknetwork B SideB Side

B PublicKey

비대칭키암호화SessionKey

비대칭키복호화

Single Sign OnSingle Sign On 99

전자 서명전자 서명• 목적

– 데이터 원형에 대한 보증– 데이터가 변조되지 않았다는 증명

• 개인키로 서명 , 공개키로 검증

메시지 메시지

메시지다이제스트알고리즘

메시지다이제스트알고리즘

메시지다이제스트 메시지다이제스트

A PrivateKey A PublicKey

서명알고리즘 서명알고리즘

전자서명

A SideA Side networknetwork B SideB Side

일치성 여부 비교일치성 여부 비교

Single Sign OnSingle Sign On 1010

KerberosKerberos• MIT 에서 Athena 프로젝트의 일환으로 개발• IETF 표준• 특징

– 중앙 집중식 인증 서버– Network 상에 패스워드가 흘러다니지 않음

• 인증절차① 사용자는 User ID 와 패스워드를 입력하여 Kerberos Server 에

인증 요청② Kerberos Server 는 사용자와 Ticket-Granting 서버에 사용자가

입력한 패스워드에 기반하여 만든 Sessionkey 를 전달 , 사용자에게는 Ticket-Granting 서버에서 발급받은 발행일자 , 시간등이 적혀 있는 Server Ticket 을 전달

③ 사용자는 접속하려는 Server 로 Service 요청을 하게 되며 부여받은 Ticket 을 설정에 따라 추가 인증 없이 자유롭게 이용가능

Single Sign OnSingle Sign On 1111

How Kerberos WorksHow Kerberos Works

Single Sign OnSingle Sign On 1212

SAMLSAML• Security Assertion Markup Language• XML-based standard for exchanging authentication and a

uthorization data between security domains• Product of the OASIS Security Services Technical Commit

tee• SAML 구성요소

– Service Provider– User– Identity Provider

Single Sign OnSingle Sign On 1313

SAML Profile OverviewSAML Profile Overview

Single Sign OnSingle Sign On 1414

SAML assertions SAML assertions • Assertion A was issued at time t by issuer R regarding su

bject S provided conditions C are valid• Three types of statements are provided by SAML

– Authentication statements– Attribute statements – Authorization decision statements

Single Sign OnSingle Sign On 1515

SAML protocolsSAML protocols• Describes

– how certain SAML elements are packaged within SAML request– response elements– gives the processing rules

• Three types of SAML queries– Authentication query – Attribute query – Authorization decision query

Single Sign OnSingle Sign On 1616

SAML Request SampleSAML Request Sample<?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names.tc:SAML:2.0:protocol" id="njhcchieeahdhddkggacblohicefdfdjbackbpll" Version="2.0" IssueInstant="2008-11-19T21:09:35Z" ProtocolBinding="urn:oasis:names.tc:SAML:2.0:binding:HTTP-Redirect" ProviderName="chodi" AssertionConsumerServiceURL="ACS"/>

Single Sign OnSingle Sign On 1717

SAML Response SampleSAML Response Sample<?xml version="1.0" encoding="UTF-8"?><samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol“ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#“ ID="bjpohpgolkpiljgpkjlhajhlhdpmblilgipeikja" IssueInstant="2008-11-19T21:14:42Z" Version="2.0"> <Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> <SignedInfo> <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" /> <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> <Reference URI=""> <Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /></Transforms> <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> <DigestValue>Vt2avcp4uoy+aiKXOn5WNaiA+qs=</DigestValue> </Reference> </SignedInfo> <SignatureValue>Qi05A7zhKCvyddFDe1n/lCqJ5P4Yfr3JsQ+nhJZZSWjP25wrnjWs1C/DxkQMCmSD/EIBYl2Z/WmAzYqdnpx2+5/p1V0myZ+NH6R0WZGLmyW+WDuBE4ngPZpe3wm51iSiW+MJ2/VYlRU7fpVMrEqZT1Yq2uv/jTVNxH/1A4YFQ6g=</SignatureValue> <KeyInfo> <KeyValue> <RSAKeyValue> <Modulus>oSwznf1Lsr8Vqyc1g9tX5kvNFKP6LcOaFlN4a890RUnuQ5JyjFo3uL/nn99IR5HxKOPR/bHq+oSw70olLCCL2nH2ivOBvuAkxxLlUH2LLVGn3juoocsFK5ycOCukSi+fnWpIwrpT5qy7iLnGdnnmyUnmJKDTJ2TVYfWPsJJSzt8=</Modulus> <Exponent>AQAB</Exponent> </RSAKeyValue> </KeyValue> </KeyInfo> </Signature> <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></samlp:Status> <Assertion ID="ifdjppldlkndhhjljajbaocekdeogonhbleogmjn“ IssueInstant="2003-04-17T00:46:02Z" Version="2.0"> <Issuer>https://www.opensaml.org/IDP</Issuer> <Subject> <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress">cho</NameID> <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer" /> </Subject> <Conditions NotBefore="2008-11-19T09:14:42Z" NotOnOrAfter="2008-11-20T09:14:42Z"></Conditions> <AuthnStatement AuthnInstant="2008-11-19T21:14:42Z"> <AuthnContext> <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef> </AuthnContext> </AuthnStatement> </Assertion></samlp:Response>

Single Sign OnSingle Sign On 1818

IBM Tivoli WebSEALIBM Tivoli WebSEAL

[ Protecting the Web space with WebSEAL ]

[ The Tivoli Access Manager authorization process ]

Single Sign OnSingle Sign On 1919

Oracle SSOOracle SSO

Single Sign OnSingle Sign On 2020

SSO IssueSSO Issue• Intergration heterogeneous lagecy system

– e.g.,• language : php, java, .net,…• server : HTTP Server, WAS, MTS,…

• Customizing cost• External error

– e.g., network fail,…

• Security– e.g., use cookie

• Identity server down, all service stop

Single Sign OnSingle Sign On 2121

참고자료참고자료• Single sign-on

– http://en.wikipedia.org/wiki/Single_sign-on#cite_note-0• Simplify enterprise Java authentication with single sign-on

– http://www.ibm.com/developerworks/library/j-gss-sso/index.html• SAML V2.0 Holder-of-Key Web Browser SSO Profile Working Draft 08, 3 Nove

mber 2008, OASIS• Security Assertion Markup Language

– http://en.wikipedia.org/wiki/SAML• SAML 을 이용한 SSO Service 의 구현

– http://blog.sdnkorea.com/blog/501• Building Kerberos-Based Secure Services Using Metro

– http://blogs.sun.com/enterprisetechtips/entry/building_kerberos_based_secure_services

• SSL on ISC, Part 1: What is SSL and why should I care?– http://www.ibm.com/developerworks/autonomic/library/ac-iscssl1/?S_TACT=10

5AGX55&S_CMP=EDU• IBM Tivoli Access Manager WebSEAL Administrator’s Guide Version

4.1• Oracle® Application Server Single Sign-On Administrator’s Guide 10g Releas

e 2 (10.1.2)