CWASAR - A European Infrastructure for Secure Electronic Commerce
by Winfried Kühnhauser
The goal of CWASAR (Cooperative Wide Area Service Architecture) is
to design and implement a European-wide infrastructure for secure electronic
commerce. The project was preceeded by a professionally conducted market
analysis in Germany, Spain and France, of the basic user requirements for
a cross-country oriented system. From the results of this analysis, the
main functional and architectural components of CWASAR were defined. The
CWASAR approach is professionally applied within the eco infobase, the
industrial offspring of the CWASAR infrastructure. This summary focuses
on the security aspects designed to cater for the varying security requirements
of end users and sketches the basic approach taken.
Communication technology today provides us with world-wide computer
networks that link together a multitude of individual systems from industry,
the public sector and academia, thus opening up many possibilities for
efficient communication and cooperation.
The principal advantage of such networks is that world-wide information
resources become very easily accessible. Ironically, this is also the network's
biggest danger. Legal restrictions, ethical practices as well as commercial
and private interests imply that much of the information on the network
is sensitive in some way, and so access to this information must be controlled.
This is particularly important for applications in fields such as law,
medicine, and commerce. Protecting such systems against misuse is the domain
of Information Security.
The social and commercial acceptance of such systems depends highly
on the public's confidence in their security. Encryption mechanisms that
guard the integrity and authenticity of the information while in transit
are used today in some specialised applications, such as the electronic
banking of Bank 24, a subsidiary company of Deutsche Bank.
However, the isolated use of security mechanisms in dedicated applications
is far from sufficient for establishing a global trust in the security
of a global communication infrastructure. To this end, concepts are needed
which allow information security to be tailored to that which ordinary
users, institutions or service providers individually require.
The CWASAR Approach
The approach to security in CWASAR centres around the notion of security
policies sets of rules that govern the use of sensitive information.
Security policies in CWASAR are individual: each organisation, each application
and each user may define his own policy. Security policies and application
systems are distinct: a security policy is a separate, autonomous software
unit that can be developed by applying proven methods and tools from software
engineering, thus enhancing the efficiency and economy of the development
process.
The Technology
Success in achieving a high level of security in a computer system depends
on the degree of care put into designing and implementing its security
policies. This covers the quality of the development process as well as
the quality of the security architecture that integrates and enforces the
policies. The approach in CWASAR is twofold: Firstly, methods and tools
are developed to support the efficient and correct engineering of security
policies. Secondly, mechanisms in security architectures are developed
that support the integration and enforcement of such policies into a system
platform.
Methods and Tools to support Policy Engineering
To meet the high quality requirements of security policies, their specification
uses security models and formal specification techniques that provide the
foundation for the analysis of security properties as well as for the verification
of the generated code. This part is the domain of security engineering:
the efficient development of policies such that the user may have trust
in the conformity of requirements and implementation. This process is supported
by tools for the exact identification of security requirements, for the
exact definition of policy semantics, for the analysis of a specification,
for the verification of policy implementations and for the certification
of the results.
Efficiency of policy development is considered the key to a broad application
of this technology. The approach is to minimise the development effort
by providing software manufacturers with methods and tools for policy re-use.
These include the composition of verified policy components and an algebra
to define the semantics of policy combination.
The CWASAR Security Architecture
The implementation of security policies concerns paradigms for the representation
of implemented security policies as well as properties of the security
architecture that allow to integrate and enforce the policies.
The basis of our approach is the custodian concept. A custodian is a
programmed module encapsulating the security policy of an application.
Once programmed, a custodian is linked to an application and at run-time,
it intercepts all communications between entities of the application and
verifies whether the communication is legal with respect to the security
policy.
The key point for the security architecture is the integration of the
custodian model. To that end, the security architecture implements the
traditional reference monitor principles (such as total mediation and policy
tamperproofness) as well as custodian persistency and the binding of an
application to its governing custodian.
Conclusions and Perspective
The security technology presented in this summary has been validated
within the GMD Institute for System Design Technology for several years
now. A security architecture capable of integrating application-specific
security policies was implemented for the OSF Distributed Computing Environment
and was also designed for the CWASAR electronic commerce scenario. The
concepts are now on the verge of being professionally applied within the
eco infobase, the industrial counterpart of the CWASAR infrastructure.
Methods and tools for the efficient development of security policies
are currently a major research topic of the information security group
at GMD. A policy specification language exists that today works for a certain
class of policies. Future work will focus on two goals: to further advance
the efficiency of policy development by re-using existing and verified
policy components, and to support the proof and certification of a policy's
security properties.
The validation work has provided us with a small set of ready-to-use
security policies that can be viewed as the foundation of our ultimate
goal: a rich set of ready-to-use, off-the-shelf security policies that
can be taken as they are or be composed into new policies that exactly
match a user's needs. While we are currently exploiting our ideas within
the Cwasar scenario, the approach taken securing systems by integrating
application-specific security policies - is sufficiently general to be
applicable in many areas where security is a major concern. More info on
the CWASAR project at: http://set.gmd.de/~kuehnhsr/ CWASAR.html
Please contact:
Winfried Kühnhauser - GMD
Tel: +49 2241 14 2480
E-mail: Winfried.Kuehnhauser@gmd.de
