Scribd
Upload
41 views

EB Ervice Ecurity: Ntroduction

WS-Security provides mechanisms at the message layer to securely construct SOAP messages and protect their contents. It addresses security issues like integrity, confidentiality, and authentication by using specifications that offer data integrity with XML Signature, confidentiality with XML Encryption, and authentication with different types of security tokens in WS-Security headers. Some examples of security tokens it supports include usernames, X.509 certificates, Kerberos tickets, and SAML tokens. XML Encryption can be used for symmetric or asymmetric encryption, and XML Signature is used to ensure message integrity.

Uploaded by

Vancy Ng
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
41 views

EB Ervice Ecurity: Ntroduction

WS-Security provides mechanisms at the message layer to securely construct SOAP messages and protect their contents. It addresses security issues like integrity, confidentiality, and authentication by using specifications that offer data integrity with XML Signature, confidentiality with XML Encryption, and authentication with different types of security tokens in WS-Security headers. Some examples of security tokens it supports include usernames, X.509 certificates, Kerberos tickets, and SAML tokens. XML Encryption can be used for symmetric or asymmetric encryption, and XML Signature is used to ensure message integrity.

Uploaded by

Vancy Ng
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 2

WEB SERVICE SECURITY

INTRODUCTION
There are various mechanisms are available at different layer to safeguard the web service environment. At the transport layer, Transport Layer Security (TLS) or Secure Sockets Layer (SSL) do widely use to provide encryption and certificate-based authentication. However, they are based on point-to-point communication which is not suitable to ensure the integrity in a multi-step or multi-party web service transactions. Besides, they are designed to encrypt the whole document but then we may only need to secure certain parts of the document in the web service environment. Therefore, Web Service Security (WS-Security) at message layer was introduced to enhance and accommodate the variety of encryption technologies and security models including Kerberos, SSL and Public Key Infrastructure. The purpose of WS-Security is to construct the SOAP message securely and offering quality of protection of the SOAP message. WS-Security is to address the security issues: integrity (message is not modified in transit), confidentiality (message cannot be viewed by eavesdroppers or unauthorized user) and authentication (message is accessible for the one with verified identity).

DISCUSSION
WS-Security specifies SOAP security extensions that offer data integrity using XML Signature, confidentiality using XML Encryption and authentication using different types of binary or security tokens in WS-Security headers. Integrity Confidentiality Message is not modified maliciously or accidently during transit. Message cannot be viewed by eavesdroppers who monitor and intercept the network traffic. Authentication Web service provider must be able to verify the identity of web service requester and requester must be able to verify the message is come from trusted web service provider.

WS-Security Tokens
Username X.509 Certificate Kerberos Ticket SAML Token

XML Encryption
Symmetric encryption Asymmetric encryption

XML Signature

You might also like