Openwings Security Specification Request

Openwings Specification Request (OSR)

Title:

Openwings Security Services (OSR_002)

Summary:

The charter of the Security Expert Team is to develop a comprehensive approach to system security for Service-Oriented Programming.  Though system security includes physical, platform, network, transport, code, and service security this team is focused on transport, code, and service security. The intent of the Openwings Security Specification is to use define the existing security technologies to achieve secure systems in a mobile environment. The Openwings Security Specification will address the architecture in whole to include authentication, non-repudiation, integrity, privacy, availability, and detection.

Section 1. Identification

Submitting Member and Specification Lead:

Expert Nominee Qualifications:

Candidate for this expert team should have the following qualifications:

1. Experience with the Java 2 platform (mandatory requirement)
2. Experience developing secure Java applications
3. Knowledge of Department of Defense security requirements
4. Knowledge of International Security Requirements, in particular the Common Criteria
5. Understanding of three or more of the following security technologies:
   • Java 2 security classes
   • Java Authentication Authorization Specification (JAAS)
   • Java Cryptology Extension (JCE)
   • RMI Security
   • Public Key Infrastructure (PKI)
   • Java Secure Socket Extension (JSSE)

Due to international laws on export of encryption technology, no actual encryption technologies will be exchanged between members of this expert team.  This caveat is provided to allow participation by non-US citizens.

Section 2: Request

2.1 Please describe the proposed Specification:

Though system security includes physical, platform, network, transport, code, and service security this team is focused on transport, code, and service security. The intent of the Openwings Security Specification is to use define the existing security technologies to achieve secure systems in a mobile environment. The Openwings Security Specification will address the architecture in whole to include authentication, non-repudiation, integrity, privacy, availability, and detection.

The Security Expert Team will be responsible for delivering the following:

1. Security Specification
2. Security Services Reference Implementation
3. Security Services Compatibility Test Suite

2.2 What is the target Java platform? (i.e., desktop, server, personal, embedded, card, etc.)

J2SE is largely targeted towards desktop and webtop applications on the front end.  J2EE is largely targeted towards E-Commerce and back end servers.  J2ME is targeted towards the device market.  This specification has a system focus on networked components, which includes the front end, back end, and devices; hence this specification targets all three Java platforms.  The J2ME configurations to be considered should go down to the CDLC configuration.

2.3 What need of the Openwings community will be addressed by the proposed specification?

A specification that implements security for Service-Oriented Programming does not exist.  In particular, handling of mobile code and services is absent from existing security works.

2.4 Why isn't this need met by existing specifications?

No other specification covers security in Openwings.

2.5 Please give a short description of the underlying technology or technologies:

This specification will utilize the following technologies:  the Java Security Model, Java Cryptography Extensions (JCE), Java Secure Socket Extension (JSSE), Java Authentication and Authorization Service (JAAS), and RMI (Remote Method Invocation) Security.  Descriptions of these technologies can be found at http://java.sun.com/security.

2.6 Is there a proposed package name for the API Specification? (i.e., javapi.something, org.something, etc.)

The proposed package for this specification is net.openwings.security.

2.7 Does the proposed specification have any dependencies on specific operating systems, CPUs, or I/O devices that you know of?

No.

2.8 Are there any security issues that cannot be addressed by the current Openwings security model?

This OSR defines that model.

2.9 Are there any internationalization or localization issues?

This OSR is targeted towards systems that may be internationally deployed and hence use the internationalization features of Java.  It is anticipated that the existing internationalization infrastructure will be sufficient for this OSR.

2.10 Are there any existing specifications that might be rendered obsolete, deprecated, or in need of revision as a result of this work?

The following specifications may require updates regarding this specification:  Openwings Connector Services, Openwings Connector Services, and the Openwings Platform Processing Services Specification.

2.11 Please describe the anticipated schedule for the development of this specification.

Currently a draft specification exists as a contribution and starting point.  The following schedule applies:

Once the expert team is formed the finalized schedule will be made available.

Section 3: Contributions

3.1 Please list any existing documents, specifications, or implementations that describe the technology.

The Motorola IISG (now General Dynamics C4 Systems)/Sun Openwings team, has previously generated work that is being contributed as a basis for this OSR.  In particular the following contributions available at http://www.openwings.org/download.cfm#specs are relevant.

• Openwings White Paper
• Openwings Naming Specification (Alpha version 0.7)
• Openwings Architecture Specification (Alpha version 0.7)
• Openwings Interface Specification (Alpha version 0.7)
• Openwings Component Services Specification (Alpha version 0.7)
• Openwings Connector Services Specification (Alpha version 0.7)
• Openwings Management Specification (Alpha version 0.7)
• Openwings Policy Specification (Alpha version 0.7)
• Openwings Platform – Processing Services Specification

In addition to these draft specifications an alpha reference implementation of connector services, component services, management services, and polices are being contributed.  The Openwings Security Specification in its current incomplete state is also being provided as a starting point for this specification.

3.2 Explanation of how these items might be used as a starting point for the work.

The existing specifications will serve as the starting draft for the specifications produced under this effort.

Section 4: Additional Information (Optional)

4.1 This section contains any additional information that the submitting Member wishes to include in the OSR.

None.

home | vision | search | in the news | faq | registration | open forum | tutorial | bug database
 API | download | expert teams | process management office | projects | links | terms of use

© Copyright 2001-2006 General Dynamics C4 Systems. All rights reserved.