Security in Distributed Systems
Balogun Adebusola
Carleton University (Student ID: 101027260)
[Link]@[Link]
Abstract – Ever since the emergence of computers, Hadoop; which consists of the data and compute
technology and the Internet, security has been a dimension components named Hadoop
major limitation faced in various paradigms.
Hadoop, which was created by Doug Cutting for
Distributed File System (HDFS) and Hadoop
Google is now widely used in different platforms MapReduce respectively. Google created
like Facebook, Yahoo!, and other applications, Hadoop to index the Web, but over the years,
which require a high level of information security. other platforms have employed its use. Sensitive
Authentication, being one of the major goals of
information security, would be implemented in this data (like customer personal information, health
project using Security Assertion Markup Language records and so on) in these platforms are
(SAML) tokens. SAML increases security by processed and stored in Hadoop, thereby arising
eliminating additional credentials that will the need for efficient security to avoid identity
terminate opportunities for identity theft, and
guarantee authentication (verifying identity). This theft or threats and attack of any sort.
survey will discuss an extensive review of the There are five major goals of information
current state-of-the-art and the use cases of SAML security, namely; Confidentiality, Integrity,
tokens for authentication and other applications in Authentication, Authorization, and Non-
which it is useful, its challenges, as well as its
proven efficiency in past and recent works. repudiation. In this paper, the focus is on
Authentication using SAML tokens.
Keywords – Authentication, SAML, Tokens, Authentication establishes verification and
Hadoop, security, distributed systems.
identification of a legal user. The oldest and
widely known form of authentication is the use
of passwords, which are inefficient and
vulnerable, in the sense that short and easily
1. INTRODUCTION memorized passwords created by a user can be
guessed or found by an attacker. This has led to
The emergence of social networks and Internet the evolution of different upgrades, ideas, and
of Things (IoT) have made huge amount of data models to support and improve authentication
available. Analyzing these data efficiently and and authorization to enhance security in
rapidly to generate meaningful information distributed systems.
requires distributed high performance clusters/
frameworks e.g., HADOOP. In a distributed Generally, a token (or security/authentication
system, a collection of computers process, token) is a small secure device that performs
exchange and execute data over a network to authentication by the user; it can be in form of a
attain a goal. Huge data is processed using garage door opener or bank card. Tokens
implement a higher level of assurance; the use Internet SSO is a primary use case SAML
of a personal identification number (PIN) or enables. Below is a diagram that illustrates
passcode provided and known to only the user, SAML tokens.
to enable authentication.
The core of this report is on SAML tokens, which
was created by the Organization for the
Advancement of Structured Information
Services (OASIS) Security Services Technical
Committee, as a means of authentication to
achieve optimum security.
SAML (Security Assertion Markup Language) is a
secure eXtensible Markup Language (XML)
based communication process for exchanging
identities, sensitive data, o lie t’s pe so al [9]
information between data organisations. SAML The SAML framework comprises of three main
is known for its ability to eliminate multiple entities, which are;
weak passwords in multiple locations owned by
1. Identity Provider (IdP): a server that
a user, by enabling Single sign-on (SSO); this
manages an Active Directory (AD) of
provides a faster, easier, and secure access to
users and an authentication mechanism.
applications. An example of the SSO feature is
2. Service Provider (SP): a service that hosts
the MyCarletonOne account available to all
the target application or service.
Carleton University students; when students
3. The User: also known as the Principal,
sign in to MyCarletonOne Login Portal; they do
has an account at the IdP and requires
not have to continue entering their usernames
verification from both the IdP and SP.
and passwords in other secured portals like
CuLearn, Carleton Central or Carleton Student In a company for instance, these three will work
Email, they are only required to login once and together to increase security, enhance customer
then, gain access to every other portal satisfaction, boost employee productivity, and
embedded in MyCarletonOne. provide profitable business value by reducing
cost, as major benefits provided by a SAML
token.
2. LITERATURE REVIEW
The recent existence of the use of SAML tokens
has shown some in-depth use cases in its
efficiency and duty to promote security by Management as a Service (IDaaS). Here, two
verifying identities users or clients all over the major security goals were achieved; data
world today. This section covers major recent confidentiality and authentication in a SAML-
works that highlight its use cases, importance, based system. This proposition handled the
and efficiency. challenge of cost and time consumption
involved in managing identities.
Apart from Internet or Web Browser SSO
profile, SAML enables other use cases and A major application of SAML explored in [7] is its
profiles like Federation Use Cases, Single Logout, conjunction with Session Initiation Protocol (SIP)
and Enhanced Client & Proxy (ECP) Profile. [1] to develop a higher or double level of security; a
trait-based authorization. It is an upgrade of
The introduction of metadata in SAML 2.0 eases
identity verification to both identity and traits.
the process of setting up the partner entity
The paper describes the authentication for SIP
inside a Federation Software by reducing error
and its constructions with SAML in a SIP SAML
and saving time [2]. The metadata is a form of
profile.
standard document (used by both the IdP and
SP) containing information about certificates, An interesting report was carried out by authors
binding supports, keys and so on to create in [8] on an authentication flaw discovered in
agreement between system entities [3]. SSO protocols (SAML SSO & Open ID). The flaw
was because of hijacking of a user
In [4] the proposed model focused on Security
authentication attempt by a malicious SP. There
as a Service (SaaS) concept as a means of
was a use case of a severe attack on a SAML-
improving Service Oriented Architecture (SOA).
based SSO for Google Apps discussed in the
The use of SAML (for authentication and
report. Also, this paper described a formal
authorization), WS-Trust (for managing security
analysis performed on SAML SSO; using High
tokens like SAML assertions) and WS-Addressing
Level Protocol Specification Language (HLPSL++)
were mentioned standards and technologies
and SAT-based bounded model checker
available to be utilized in this framework. The
(SATMC) for security protocol, the root cause of
use of SAML or Open ID Authentication provides
the flaw, fixing of the vulnerabilities and other
authentication to users through an external IdP
security issues and attacks (comprising of a
that is capable of tracking users and, allowed
client, an honest IdP, an honest SP and a
a ess to use ’s i fo ation. The authors in [5]
malicious SP).
proposed a solution by building an
authentication framework that hides a website Based on the above study, the use of SAML
from both the external IdP and SP to enhance tokens has a wide deployment in security of
privacy of the user. distributed systems applications due to its
efficiency in verifying user identification, time,
In [6] the privacy of the user is also considered.
and cost savings (Blind IdM), as well as
The paper proposes BlindIdM as a shift from
guarantee user privacy preservation.
basic identity management to Identity
3. USE CASES ➢ unauthorized access and,
➢ disclosure of configuration data.
To emphasize the importance of SAML tokens in
various security mechanisms, this section Handling these requires adequate infusion of
describes its impact on several scenarios in security in every possible layer of the web.
which it is deployed. SSO, Authorization service XML signature, XML encryption and encoding of
and Back office transaction are three major use binary tokens (like X.509 Certificates or Kerberos
cases developed by SAML. [10] tickets), constitute the WS-Security protocol.
SAML has three different versions; SAML 1.0, SAML indirectly certifies and enables the
SAML 1.1 and SAML 2.0. The major difference functions of XML signature and XML encryption
between SAML versions 1.1 and 2.0 is the name which are to provide data Integrity and
of their assertion identifier attribute; for SAML Confidentiality respectively, by using Secure
V1.1, the a e is Asse tio ID hile fo “AML Sockets Layer (SSL) over Hyper Text Transfer
v2.0, the name is ID . I oth e sio s, the type Protocol (HTTP) at the transport layer and
of the identifier attribute is xs:ID. [13] enabling the SSO feature.
These use cases serve as a background or basis WS-Security in [13] explores a standard set of
in which they can be applied, combined, and Simple Object Access Protocol (SOAP)
developed into more efficient techniques to extensions that implement SOAP message
guarantee optimum security in areas where they authentication and encryption. Their
are utilized. Some of them are explored and specification defines SAML assertions as security
presented in this paper. tokens from the <wsse:Security> header block.
Also, describes how SAML assertions may be
referenced in four contexts;
3.1. WS-Security a. From a <wsse:Security> header
element. Here, the assertion is relayed
Web Service Security (WS-Security) is a vital case
by reference in the message.
study in which all forms of security goals are
b. the SAML assertion can be referenced
necessarily and indisputably taken into
from a <ds:KeyInfo> element of a
consideration; since messages are exchanged
<ds:Signature> element in a
over the Internet, securing them is crucial.
<wsse:Security> header.
Microsoft and IBM jointly created WS-Security,
c. the SAML assertion reference can be
in conjunction with OASIS. Five major key
referenced from a <ds:Reference>
threats and vulnerabilities the security of web
element within the <ds:SignedInfo>
services presented in [11] are;
element of a <ds:Signature> element
➢ network eavesdropping, in a <wsse:Security> header.
➢ message replay, d. the SAML assertion reference could
➢ manipulation of parameter, occur as encrypted content within an
<xenc:EncryptedData> element SAML tokens authenticity. One important
referenced from a challenge in efficiently using SAML for
<xenc:DataReference> element within delegation involves checking the validity of the
an <xenc:ReferenceList> expressed delegation. [12]
The referenced assertion could either be local or The authors implemented the SAML delegation
remote in all the contexts mentioned above; framework on both the Microsoft .NET platform
and Java/Tomcat. The .NET platform contains
• lo al – when it is included in the
class libraries that enable XML, XML Signatures,
<wsse:Security> header containing the
and Web Services, while Microsoft provides the
reference.
Web Service Enhancements (WSE) toolkit to
• e ote – when it is not included in the enable advanced web service features such as
<wsse:Security> header containing the WS-Security, SOAP messaging and user defined
reference, but could be present in another part XML tokens. A SAMLGenerator, Delegatee,
of the SOAP message or available at the location Delegater and SAMLToken are the components
identified by the reference which may be an described in the paper that portray how
assertion authority. [13] assertions are created and consumed via
protocol requests and response.
3.2. Delegation for Web & Grid
Services 3.3. Simple SAML PHP
In [12], the authors presented a delegation Simple SAML php is one interesting application
framework for web and grid services by written in native Hypertext Preprocessor (PHP)
exploiting the inherent extensibilities of SAML, that provides authentication; it is a software
using the SAML 1.1 version. Basically, three mechanism that is beneficial for the security of
types of assertions are defined by SAML, applications and the privacy of users. The core of
namely; Authentication, Attribute, and SimpleSAMLphp is enabling support for SAML
Authorization Decision. 2.0 as both a Service Provider (SP) and an
Identity Provider (IdP). It also enables other
The attribute assertion was implemented in
identity protocols and frameworks, such as
their framework; including three XML-based
Shibboleth 1.3, OpenID, WS-Federation, or
components: delegation assertions, protocol
OAuth. [15]
requests and protocol responses.
The integration of Simple SAML php as both SP
WS-Security SAML token discussed in 3.1.
and IdP can be used in Federated Identity.
described how SAML assertions can be included
in security header blocks. The confirmation The tutorial in [16] illustrates how WordPress
method for delegation assertions is holder-of- and Simple SAML php were combined; to allow
key ; a sig atu e is e ui ed to alidate the SSO using SAML, using [Link] as an IdP,
where data is mapped from its source and back 4. Some Limitations of SAML
as users locally within the site. Tokens (SSO)
Despite the great benefits of the deployment of
3.4 . Security Tokens and SAML tokens in SSO according to some scenarios
illustrated in this paper and more, some
Claims
limitations to the mechanism hinders it from
SAML tokens are basically XML representations been the perfect technique. This section
of claims. Issued tokens are SAML tokens describes a few of them. [20]
▪
Windows Communication Foundation (WCF)
If the IdP component in SSO is
uses in federated security cases; messages are
unavailable, there will be failure in the
by a security token service (STS) about a user in
authentication on the SPs and the
a system, which signs the SAML token to show
utilization of their services.
▪
the accuracy of the messages in the token. [17]
There’s no total privacy, in terms of the
In addition, the cryptographic key of the user of ability of IdP to view and save the user’s
the SAML token guarantees and assures the activities.
relying party that the SAML token was issued to ▪ The security of a company could be at
that user. For instance, when a STS gets a SAML risk if the IdP is not securely deployed.
token requested by a client, authenticating to
that STS by using Windows credentials, the STS
issues a SAML token, with a signed certificate CONCLUSION
related to the service and a cryptographic key
for the target service to the client; the client gets In general, SAML offers several benefits, some of
a copy of the key as well. Then, the SAML token them are;
to the relying party is presented by the client • Interoperability - SAML is interoperable
and signs the message with the same key. The due to its ability to allow different
signed certificate on the SAML token tells the systems communicate data about
relying party that the STS issued the token. The security.
•
message signature created with the key tells the
Open Solution - SAML was created to
relying party that the client has the token. [17]
work in accordance with multiple
Two leading users of SAML are Liberty and Sun industry-standard transport protocols
such as HTTP, SMTP, and more.
•
One Identity Server. Liberty [18] is a leading
identity federation and management project Single Sign On Across Sites - SAML
and makes significant use of SAML, and Sun One permits web-based SSO service features
Identity Server 6.0 [19] which deployed the across various sites because of its open
Liberty protocol also enables delegation. and interoperable framework. [14]
Finally, the exploration of various use cases of [6] Nuñez, et al: A privacy-preserving
SAML led to even greater evolution of greater approach for identity management as a
models like OpenSAML (an open source library service." International Journal of
Information Security 13.2 (2014): 199-
for creating SAML 1.1 assertions and messages,
215.
which has two versions; C++ and Java) and [7] Tschofenig, Hannes, et al. "Using SAML to
WSS4J (an open source implementation of WS- protect the session initiation protocol
Security for Java from Apache; Apache Web (SIP)." IEEE Network 20.5 (2006): 14-17.
Services Security for Java (WSS4J) enables [8] Armando, Alessandro, et al. "An
processing various types of SAML tokens).[12] authentication flaw in browser-based
SAML is now ubiquitous due to its ability to Single Sign-On protocols: Impact and
deliver cross-merchant interoperability of SSO. remediations." Computers & Security 33
(2013): 41-58.
[9] [Link]
REFERENCES n-us/articles/228558707-C-Adding-
Single-Sign-On-to-Halo.
[1] Assertions and Protocols for the OASIS [10] Maler, E. "SAML basics-A technical
Security Assertion Markup Language (SAML) introduction to the Security Assertion
Ver.2.0. Markup Language."
[Link]
[11] King, Stuart. "Threats and Solutions to
[Link]/security/saml/v2.0/saml-core-2.0-
Web Services Security." Network
[Link]
Security 2003.9 (2003): 8-11.
[2] Lewis, Kelly D. "Web single sign-on
authentication using SAML." arXiv [12] Wang, Jun, David Del Vecchio, and
preprint arXiv:0909.2368 (2009). Marty Humphrey. "Extending the
[3] Metadata for the OASIS Security security assertion markup language to
Assertion Markup Language (SAML) Ver. support delegation for web services and
2.0. grid services." Web Services, 2005. ICWS
[Link] 2005. Proceedings. 2005 IEEE
[Link]/security/saml/v2.0/ International Conference on. IEEE, 2005.
[4] Kumar, Satish, and Avadhesh Kumar [13] Nadalin, A., et al. "Web service security:
Gupta. "A Conceptual Technique for
SAML token profile 1.1. OASIS Standard
Modelling Security as a Service in
Service Oriented Distributed Systems." wss-v1. 1-spec-os-SAMLTokenProfile."
JOURNAL OF COMPUTER SCIENCE 1.2 (2006).[Link]
(2014). [Link]/wss/v1.1/wss-v1.1-spec-os-
[5] Iso, Yuto, and Takamichi Saito. "A [Link]
Proposal and Implementation of an ID [14] Khalil, Ibrahim, and Ahmed Saleh. "A
Federation that Conceals a Web Service
Survey of Security Standards in Service
from an Authentication Server."
Advanced Information Networking and Oriented Architecture."
Applications (AINA), IEEE 2015. [15] [Link]
[16] [Link]
U1lD_M5qkY
[17] [Link]
us/library/ms733083(v=vs.110).aspx
[18] Liberty Alliance Project,
[Link]
s/[Link]
[19] Sun One Identity Server,
[Link]
ts/dentity_srvr/home_identity.html
[20] On Web-Security and Insecurity
[Link]
[Link]/2014/10/single-
[Link]?m=1