Security for federated servers

Encryption

Encryption provides a level of security that goes beyond what is provided by just a name and password. The Internet standard for encryption between endpoints is Secure Socket Layer (SSL) and Transport Layer Security (TLS). SSL uses signed certificates to ensure secure communications. A certificate is a digital document that provides assurance of a user's or server's identify. A certificate is signed by a certificate authority, such as VeriSign, or can be self-signed. Each communications partner determines whether or not to accept a particular certificate as being authentic.

Each communications partner has a certificate store, or keystore. The keystore holds the certificates that the partner accepts from others, as well as the certificates that represent itself. Each endpoint determines whether or not it will send a certificate when opening communications and whether or not it will accept communications from a partner who does not supply a certificate.

The interaction between SSL and a proxy depends on the type of proxy. In general, SSL communications are tunneled, or relayed, through a proxy. The proxy session is established in clear text.

The IBM® Global Security Kit (GSKit) provides encryption services for wrappers and user-defined functions.

Proxies

In an effort to foil numerous kinds of Internet attacks, many companies implement a firewall. A firewall is a network configuration that is usually comprised of both hardware and software and that is often located at a communication boundary, for example between a corporate intranet and the Internet. The firewall acts as a gatekeeper to regulate traffic across the boundary. In most cases, the firewall prevents unwanted communications from crossing the boundary; however, occasionally the firewall can block legitimate communications

To ensure that all legitimate communications pass through the firewall, you implement a proxy. A proxy is a server program that is authorized to communicate through the firewall. Then when a user program needs to connect to a remote server, the user program makes a request to the proxy, which connects to the remote server. After making the connection, the proxy controls the traffic between the user program and the remote server. This process ensures that the user program can cross the firewall and enforces security: the remote server knows only the address of the proxy, not the address of the user program.

SOCKS and HTTP proxy servers control the traffic between user programs and remote servers. A SOCKS proxy operates at the transport layer and relays arbitrary transport messages (TCP or UDP) between two addresses. The federated server supports both SOCKS4 and SOCKS5. SOCKS4, which supports IPv4, does not support user authentication. Therefore, anyone can communicate through a SOCKS4 proxy without having to provide user credentials. SOCKS5, which supports IPv6, supports several modes of user authentication. The Internet Engineering Task Force (IETF) approved SOCKS5 as a standard. For more information, go to www.ietf.org and see RFC1928, RFC1929, and RFC1961.

To use a SOCKS proxy, the transport layer must be configured, in advance, to use a proxy. After opening a connection to the proxy, the transport layer requests that the proxy open a connection to the remote server. If configured to require authentication, the SOCKS proxy might ask the program to provide an ID and password before opening the connection to the remote server.

An HTTP proxy works with the HTTP protocol, which is an application-layer protocol. After opening a TCP/IP connection to the proxy, the user program sends a request that includes the name of the remote server. Then the user program continues to submit requests through the proxy server. This process changes slightly if the remote server requires authentication. If the remote server requires authentication, the proxy server sends a response message that includes the proxy-authenticate challenge header. This header includes information about the kind of authentication to be performed. The user program then resubmits the request and includes a proxy-authorization header, which contains the response to the authentication challenge.