Improving information security in cloud computing using the SAML standard

Master's Thesis of Information Technology Engineering, Information Systems Management

Abstract

The world of internet and computer is becoming more complex and evolving every day. One of the products of this evolution is cloud computing. Due to this issue, data sensitivity and information privacy seriously become an important concern for organizations. Companies pay special attention to software service providers (ASPs) or software as a service (SaaS) vendors to provide specialized web-based services, which reduce costs and provide specific and focused applications to users. This approach eliminates the complexity of designing, installing, configuring, expanding, and supporting the system by internal resources, which provides many benefits to organizations.

Organizations have recently been using central authentication sources for internal applications and web-based portals for most of their operations. Single sign-on authentication, when properly configured, provides strong security in the sense that users do not need to write down and remember passwords for different systems. It also makes it easier to manage and audit users. This problem can be solved by using a standard to authenticate information for exchange on the Internet. The Security Proof Markup Language provides a secure, XML-based solution for exchanging user information between identity providers (organizations) and service providers (ASPs or SaaS). The Security Proof Markup Language standard defines rules and syntactic commands for information exchange, at the same time it is flexible and allows the transfer of customized data to the external service provider.

In this thesis, it is tried to make the best use of the advantages of cloud computing and single sign-on and use it to improve single sign-on systems and specifically for single sign-on using the Security Proof Markup Language standard. For this purpose, the related basic concepts and definitions including cloud computing, security proof markup language, authentication and single sign-on have been studied. Then, a short review on authentication methods has been done in order to provide a better, more complete model that fits what is needed. Also, a number of models presented for each of the above topics and the combination of these topics have been examined. By combining and summarizing the obtained methods and information, a model for single sign-on based on cloud computing using security proof markup language has been proposed and simulated in order to help the single sign-on process in user authentication. Finally, after stating the advantages of the proposed model, possible problems are examined and suggestions are made to solve these problems as well as future studies. Keywords: In Persian: Information security in cloud computing, security proof markup language in cloud computing In Latin: Information security in cloud computing, SAML in cloud computing

Chapter One

Introduction

Introduction

The world of information technology is expanding day by day. About 72 years have passed since computers entered human life. During these years, the thirst for progress has led to the emergence of new technologies. Also, not much time has passed since the internet has been available to users. The Internet has brought about a tremendous change in the exchange of information. Of course, at that time, no one thought that one day the Internet could be used as a powerful processing system in addition to information exchange. But nowadays, many processes are done by servers. The basic concepts of cloud computing have been developed since 1162 AD. But cloud computing as we currently know it and available to everyone has been used by Amazon since 2226. Cloud computing is an old idea of ??computing resources that has been used as a tool. Cloud computing is Internet-based computing that provides shared resources, software and information, for computers and devices on demand. Cloud computing allows people to share distributed resources and services. Therefore, cloud computing uses distributed resources in an open environment.. As a result, it provides security and assurance for data sharing in the development of cloud computing applications.

Data sensitivity and information privacy are increasingly becoming an area of ??concern for organizations. Aspects of authentication and proof of identity include the use, maintenance and protection of information collected for users. Preventing unauthorized access to information resources in the cloud is also an important factor. As web services become more common, businesses are looking to offer hybrid services to customers who share them. This process is a difficult responsibility for customers who must remember different usernames and passwords and maintain different reservations on different web browser sections with non-uniform user interfaces indicating different reservation statuses [1, 2 and 3].

Security Proof Markup Language[1] is a standard for secure single-user login to the web, first introduced in January 2001 by the Information Standards Development Organization. A structured framework was introduced and an extensible markup language-based framework was used for authentication and authentication information exchange and information exchange security. It was last updated in 2005. The security proof markup language entered the global Internet market in several versions. The first version of the Security Assertion Markup Language was released under the name SAML1. Then came its version SAML1.1, which was completely identical to SAML1 in terms of functionality except for minor differences. Finally, the last version of the security proof markup language called SAML2 was released in 2005. It had fundamental differences with the previous versions of this standard [4]. Although both versions of this standard monitored the same use cases, SAML2 is incompatible with its previous versions. Early versions of the Security Assertion Markup Language did not support any specific protocols in their queries, while the final version of the Security Assertion Markup Language (SAML2) supports many protocols, most of which are brand new. Both SAML1 and SAML2 use digital signatures (based on the XML signature standard) for authentication and message integrity. Using XML encoding, SAML2 provides elements for encrypted identity specifiers, encrypted attributes, and encrypted assertions (SAML1 does not have encryption capabilities) [5].

The most important thing that SAML addresses require is a web browser's single entry. Single sign-on solutions are usually at the intranet level (for example, using cookies), but the development of these solutions beyond the intranet becomes problematic and leads to the deployment of non-interoperable proprietary technologies. The security proof markup language aims to solve these shortcomings, which was developed by the Structured Information Standards Development Organization. Security proof markup language aims to solve the problem of secure information exchange by providing a framework based on the developed markup language. The most important advantage of the markup language is the proof of security, its expansion and its optional growth in the industry. It is commonly used between organizations and their customers, business partners and cloud providers. Proof-of-Security Markup Language has proof-level security, scalability, and reliability in thousands of globally developed products.

Proof-of-Security Markup Language Proofs in Web Services Security are also used for the security of Web service messages. Securing Web Services Using Markup Language Proofs Security proofs in the form of a security token with a token profile The Proof of Security Markup Language defines the security of web services. Security Web Services is a set of specifications that define tools to provide message security protection. A security proof markup language consists of a number of building block components that, when linked together, allow support for a number of use cases. The Security Proof Markup Language specification defines the structure and content of proofs that describe a principle proved by a proof section [4 and 6]. 1-2 Problem Definition Cloud computing uses the idea that work done on the client side can move to some invisible cluster of resources on the Internet [1].