Florent Martin, head of Security and IAM at Smartwave went deep in the implementation details of a digital transformation in manufacturing industry. This presentation focused on enforcing a partnership between a manufacturing company and its resellers dispatched all around the world. We learned about the benefits of using an API gateway as a non-intrusive approach for identity mediation between existing identity infrastructure at customer and modern HTML5 / JavaScript applications at resellers.

2. Digital Transformation
Use Case in Manufacturing Industry
Florent MARTIN – Head of Security
–
June 23th 2016

3. Agenda
June, 23th 2016Digital Transformation in Manufacturing Industry 3
Introduction of SmartWave
Customer context
Customer Challenges
Digitalization
Solution & Benefits

4. SMARTWAVE
June, 23th 2016Digital Transformation in Manufacturing Industry 4

5. Our mission
We improve organisation's
business processes and information
management
by delivering tailored and innovative IT
software solutions.
January2016SmartWave - GeneralIntroduction 5

6. Our offer: a catalog of 6 solutions
Driven by business
needs
• Prioritized by
business value
• Focused on
business process
analysis
Based on field
experience
• Successful
implementations
• Good practices
• Expert team
Built on top of
products
• Panel of software
editor partners
• Strong editor
partnership
• Promote
configuration
June, 23th 2016Digital Transformation in Manufacturing Industry 6

7. Our solutions
June, 23th 2016Digital Transformation in Manufacturing Industry 7
Process
Automation
Enterprise
Applications
Applications
& Cloud
Integration
Content
Management
Application
Security
Data
Management

8. Facts
Reliable: established in 2000 with a steady growth
trend
Swiss: based in Geneva
Independent: profitable, no debt, owned by
management
Major Player: turnover 10 MCHF, 50 large clients
Expert: 40 consultants with high skills profiles
June, 23th 2016Digital Transformation in Manufacturing Industry 8

9. Delivery modes
Consulting Contract staff Project Smart Shore
June, 23th 2016Digital Transformation in Manufacturing Industry 9

10. Customer Challenges
June, 23th 2016Digital Transformation in Manufacturing Industry 10

11. Customer Context
June, 23th 2016Digital Transformation in Manufacturing Industry 11
Manufacturing
Company
International
Environment
Goods
Population of
Resellers
Sales
Support
Maintenance

12. Business Challenges
June, 23th 2016Digital Transformation in Manufacturing Industry 12
In an International context:
• Provide an homogeneous level of service, world wide,
• Enforce the control of their corporate identity,
• Setup a more efficient ordering process

13. Identified Levers
June, 23th 2016Digital Transformation in Manufacturing Industry 13
Provide Resellers with:
• Reliable and up-to-date information on products,
• Training regardless of where they are,
• A common platform for orders processing

14. Digitalization
June, 23th 2016Digital Transformation in Manufacturing Industry 14

15. Definition
June 23th 2016 15
Gartner:
“Digitalization is the use of digital technologies to change a business
model and provide new revenue and value-producing opportunities; it is
the process of moving to a digital business.”
“More fundamentally, Digitalization shift implies the need for
companies to adapt business models and processes in response to a
world that increasingly wants to do business online.”

16. Challenges of Digitalization
•Access
• To provide access to companies resources from everywhere (location,
devices)
• To open up resources that cannot always be accessed physically by users,
e.g. fragile cultural materials, papers
• Enhanced services
• To use existing resources in new or different ways
• To compose innovative content packages in response to user demand
27 Avril 2106#ESSP16 16

17. Challenges of Digitalization
• Better Customer experience
• Provide with seamless access to resources
• Provide with a great user interface
• Build customer specific experience based on history, preferences
• Partnerships
• To build partnerships between institutions to improve the quality of
digitization projects by sharing resources, adopting common standards and
facilitating good practice and the exchange of information and expertise
27 Avril 2106#ESSP16 17

18. Digitalization & Security
• At the epicenter of digital transformation comes security with its the
ability to recognize, identify, authenticate and protect their
customers and partners
• To expose business functionality securely is a significant challenge
that has to be addressed along the whole information chain from
frontend systems to endpoint applications.
27 Avril 2106#ESSP16 18

19. Customer Strategy
June 23th 2016 19
A Digital transformation of:
• Products information and data services
• Training services
• Ordering processes

20. Objective
June 23th 2016 20
Provide RESELLERS with DIGITAL services:
• Products catalog,
• eLearning service,
• Ordering service

21. Current Situation
June, 23th 2016Digital Transformation in Manufacturing Industry 21

22. Existing Components
June 23th 2016 22
Data
Applications
Services
Application
Infrastructure
Web
PortalWAF
Heterogeneous
Technologies
Threat protection
Authentication
SAML IdP
IDP
ID
Repositories
eLearning
catalog
Orders

23. Technical Challenges
June 23th 2016 23
Data
Applications
Services
Application
Infrastructure
Web
PortalWAF
Heterogeneous
Technologies
Threat protection
Authentication
SAML IdP
IdP
Repositories
Integration
A super translator. Performs mediation
tasks like protocol translation, message
transformation.
Security
Provides authentication and authorization
. Tight integration with your enterprise
identity management infrastructure
Control
Provides monitoring of service quality and
performance, metering usage and
throttling of traffic.
eLearning
catalog
Orders

24. The Solution
June, 23th 2016Digital Transformation in Manufacturing Industry 24

25. Customer Constraints
June 23th 2016 25
Data
Applications
Services
Application
Infrastructure
Web Portal
WAF
Heterogeneous
Technologies
Threat protection
SAML IdP
IDP
eLearning
catalog
Orders
• The use of simple page apps developed in HTML5/JS
• Service consumption at client level
• Needs to propagate identity at each API consumption

26. Solution Architecture
• A loose coupled approach:
• Virtualize Company services to provide with REST APIs
• Transform SAML 2 xml tokens to Oauth JWT tokens
June 23th 2016 26
Data
Applications
Services
Application
Infrastructure
API Gateway
• Virtualize API
• Access control
WAF
• Access control
• IdP SAML2
• Threat protection
Web Portal
WAF
eLearning
catalog
Orders

27. The diagram flow
June 23th 2016 27
GetJWTtoken()
ConsumeVirtualAPIs() Enrichment()

28. The diagram flow
June 23th 2016 28
AccessToPortal()
LoadApplication()
AuthenticateUser()
RedirectToSAMLIdP()
SendSAMLresponse()
ReturnJWTtoken()
ConsumeVirtualAPIs() Enrichment()
AuthenticateToIdP()

29. Implementation Details
• API GW and IdP are in different domains
• According to RFC a http-redirect code will be blocked at browser
for verbs other than GET, HEAD, because of CORS security issues
• Cross-origin resource sharing (CORS) is a mechanism that
allows restricted resources to be requested from another domain
outside the domain from which the resource originated
June 23th 2016 29

30. Implementation Details
• In a cross-domain scenario
• We simply post a hidden form
June 23th 2016 30

31. Implementation Details
• HTML5 applications are not hosted in an application server
• Implicit Oauth profile allow for token stored in browser like a
secured cookie
• Thus storage of tokens has be moved to browser, and securited
June 23th 2016 31

32. Implementation Details
• Securing token using:
• Short life tokens : Less than 2 minutes
• Encryption & Signature : to protect data in cookie and avoid
tampering
• HTTP only cookies : Not readable by JS application running in
Browser
June 23th 2016 32

33. Sessions Management
• Users has a session at IdP, valid for a couple of hours
• API GW generate JWT tokens with life-time <<< session duration
• We issue new tokens each time it expires
June 23th 2016 33

34. Sessions Management
• Seamless JWT expiration management
• Apps request for a new JWT at API GW using “prompt:none”
directive
• API GW issue a SAML request using “isPassive” attribute
• If session is active at IdP
• A valid SAML response is issued by IdP
• API GW generate the new JWT
• Else
• An invalid SAML response is issued
• User is prompted to provide credentials to IdP
June 23th 2016 34

35. A complete solution
June 23th 2016 35
Data
Applications
Services
Application
Infrastructure
Policy Approach
Configurable Policies
200+ Pre-built Operations, 50+ Pre-built Connectors
Cache
Alert
Log
AuthN
AuthZ
OAuth
Transform
Block / Route
Filtering
Inspect
Verify
Enrich
Redact
Encrypt
Signing
Monitor & Govern
Operational
Monitoring
Analytics
& Reporting
Meter
& Control
Dynamic
Policy Control
Identities TokensRepositories
Security Infrastructure
Authorization

36. API Gateway
June, 23th 2016Digital Transformation in Manufacturing Industry 36

37. Identity Mediation and SSO
Single Sign-on from different IAM Systems to Backends to overcome Silos
Mediation between different Standards like HTTP Header/ API Key to SAML
Support latest Standards like OAuth 2.0 and OpenID Connect
Solution
API ManagementLogin
Browser Request
with IAM Identity
Login
to Backend
Convert from IAM to Backend login
Enterprise
Service

38. • Protocol Translation
• HTTP, JMS, …
• Message Transformation
• REST, SOAP, JSON …
• Message Enrichment
• Token Translation
• Service Virtualization
Principles
Define inputs
Manage
Integration
Secure
exchanges Control Datas
Expose
services
Web & Social
networks
Back-ends /
Legacy
Cloud
Mobile
DB & Big Data
Web & Social
networks

39. Web & Social
networks
Back-ends /
Legacy
Cloud
Mobile
DB & Big Data
Web & Social
networks
• Policy Enforcement Point
• Auth’N, Auth’Z, Audit
• WS-*, SAML, ...
• XML Firewall
• Encryption & Signing
• Key Management
• Data Privacy Filtering
Principles
Define inputs
Manage
Integration
Secure
exchanges Control Datas
Expose
services

40. • SLA Monitoring & Audit
• API Usage Tracking
• Traffic Throttling
• Traffic Smoothing
• Content Routing
• Content Blocking
• Service Usage Analysis
Web & Social
networks
Back-ends /
Legacy
Cloud
Mobile
DB & Big Data
Web & Social
networks
Principles
Define inputs
Manage
Integration
Secure
exchanges Control Datas
Expose
services

41. Protection Summary
Applications & services
Clients
API-Gateway
External Firewall
Internal Firewall
API Server policies (3 levels of protection)
Level 1: public
• Preventing denial-of-service attacks
• XML threat-awareness
• Complexity, Message-Size, Schema-Valid., etc.
Level 2: protected
• Access Control
• Authentication
• Per-service authorization
• IP-Address based
Level 3: confidential
• Integrity
• XML signatures
• Confidentiality
• XML en- and decryption
• Intrusion detection
• Prevention of Denial of Service (DoS) attack
• Transformations
• Internal WebServices are authenticated

42. 42
Securing inbound and outbound traffic
Consuming
app
Axway API Gateway Internal WS
Applications
Inbound security
Outbound security
Virtualized
services
AnalyticsMon. & Alert
1
2
3

43. A Policy configuration approach

44. Securing incoming requests

45. Example of IP blacklisting policy

46. Securing outgoing responses

47. High Availability Architecture
Axway API Gateway
Analytics
Internal Admin ZoneLoad Balancer
DMZ
Intranet
Applications
2 API Gateway
appliances
Virtual Machine
MySQL Database
Consumers
High availability architecture:
• Active/Passive
• Active/Active

48. Root Cause analysis

49. Trace log

50. Benefits
June, 23th 2016Digital Transformation in Manufacturing Industry 50

51. Benefits
November 2015Digitalization & Security 51
A loose Coupled Approach:
• Segregation of perimetricand applicative authentication
• Segregation of APIs
A non intrusive approach
• Virtual APIs on top of existing applications
A flexible Approach:
• Translation of tokens, to meet different authentication scenarii
Quick Start Approach:
• OOTB features and methods
• Configuration driven approach
Extensible Solution
• Customization via scripts or Java code

52. THANK YOU
FLORENT MARTIN
Head of Security
fmartin@smartwavesa.com
SMARTWAVE SA
Switzerland
http://www.smartwavesa.com