Security of STS in Cryptography

What is STS?

An STS is a known web service that acts as a trusted third party to the broker trust relationships between a web service requester and a web service provider. 

Similarly to a certificate authority in an SSL handshake, the STS guarantees that the requester and provider can "trust" the credentials provided in the message. The exchange of security tokens represents this trust.

An STS can issue the security token, exchange and validate the token and establish trust relationships, allowing web services from different trusted domains to communicate successfully.

Configuring the secure token service (STS)

The Secure Token Service (STS) is a kind of web service that issues security tokens. He makes claims based on evidence he trusts the one who trusts him (or the specific recipients). 

To communicate trust, a service requires a valid proof, such as a signature, demonstrating the knowledge of a security token or a set of security tokens. The service itself can generate tokens or rely on a separate STS to issue security tokens with its own credential. This forms the basis of trust mediation.

The security model of an issued token includes a target server, a client-server, and a trusted third party called a Security Token Service (STS). Policies go from server to client and from STS to client. The policy can be embedded in an issued token claim or obtained from the hand. There can be an explicit trust relationship between the server and STS. There must be a trusting relationship between the client and STS.

Specify the Issuer endpoint and the issuer (Mex) STS metadata exchange address on the service side.

Specifying an STS on the Service Side

In this section, we'll specify the STS on the service side:

1. Click on the right of the node for the web service you want to secure, 
2. Go to Edit Web Service Attributes and click it.
3. Select Secure Service.
4. Choose a Security Mechanism from the list that mentions STS.
5. To specify the STS data, click Configure.
6. Enter your Issuer Address and the Issuer Metadata Address.
7. Set the algorithm suite value so that it coincides with the algorithm suite value of the STS for the service.

Specifying an STS on the Client Side

1. Expand the web services client node in the Projects.
2. Then expand the Web Service References node.
3. Click the right mouse button on the node of the web service reference for which you want to adjust security settings.
4. Go to Edit Web Service Attributes and click it.
5. Specify the information about the Secure Token Service:

• Endpoint- the endpoint of the STS.
• WSDL Location- Location of the WSDL for the STS.
• Metadata- Metadata address for the STS.
• Service Name- Service name of the STS.
• Port Name- Port name of the STS.
• Namespace- Namespace for the service in the WSDL.

Image source: Configuring the secure token service

Frequently Asked Questions

What is a token?

A security token is a supplementary tool used to get access to an electronically restricted resource. The token can be used in place of a password. 

What is STS?

The security model for issued tokens involves a target server, a client-server, and a trusted third party called the Security Token Service (STS).

What is a Secure Token Service?

A Secure Token Service (STS) is known as a web service that issues security tokens. It makes a claim against a person (or a particular recipient) who trusts it based on the evidence they trust.

What is a Provider Endpoint URL?

An endpoint URL is the URL of an external service accessed by a business service.

Life Time of Issued Tokens?

Lifetime of issued tokens is two weeks (20,160 minutes)

Conclusion

This blog has extensively discussed Secure Token Service and the security aspects of STS.

If you want to learn more deeply, check out the excellent content on the Coding Ninjas Website:

MTI Key Agreement Schemes , Known Session Key Attacks on MTI/A0 

Refer to our guided paths on the Coding Ninjas Studio platform to learn more about DSA, DBMS, Competitive Programming, Python, Java, JavaScript, etc. 

Refer to the links problems, top 100 SQL problems, resources, and mock tests to enhance your knowledge.

For placement preparations, visit interview experiences and interview bundle.