- WS-Security
WS-Security (Web Services Security) is a
communications protocol providing a means for applying security toWeb service s. On April 19 2004 the WS-Security 1.0 standard was released by Oasis-Open. On February 17 2006 they released version 1.1.Originally developed by
IBM ,Microsoft , andVeriSign , the protocol is now officially called WSS and developed via committee in Oasis-Open.The protocol contains specifications on how integrity and confidentiality can be enforced on Web services messaging. The WSS protocol includes details on the use of SAML and Kerberos, and certificate formats such as
X.509 .WS-Security describes how to attach signatures and encryption headers to SOAP messages. In addition, it describes how to attach security tokens, including binary security tokens such as X.509 certificates and Kerberos tickets, to messages.
WS-Security incorporates security features in the header of a
SOAP message, working in theapplication layer . Thus it ensures end-to-end security.Associated specifications
The following draft specifications are associated with WS-Security:
*WS-SecureConversation
*WS-Federation
*WS-Authorization
*WS-Policy
*WS-Trust
*WS-Privacy
*WS-Test ee also
*
List of Web service specifications
*WS-I Basic Security Profile
*Web Services
*SAML
*XML firewall
*XACML
*X.509 Alternative(s)
In point-to-point situations
confidentiality anddata integrity can also be enforced on Web services through the use ofTransport Layer Security (TLS), for example, by sending messages overhttps . WS-Security however addresses the wider problem of maintaining integrity and confidentiality of messages until after a message was sent from the originating node, providing so called end to end security.Applying TLS can significantly reduce the overhead involved by removing the need to encode keys and message signatures into
ASCII before sending. A challenge in using TLS would be if messages needed to go through aproxy server , as it would need to be able to see the request for routing. In such an example, the server would see the request coming from the proxy, not the client; this could be worked around by having the proxy have a copy of the client's key and certificate, or by having a signing certificate trusted by the server, with which it could generate a key/certificate pair matching those of the client. However, as the proxy is operating on the message, it does not ensure end to end security, but only ensures point-to-point security.ee also
* .NET Web Services Enhancements
External links
* [http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=wss OASIS Web Services Security TC] (Contains links to download specification documents)
* [http://www-128.ibm.com/developerworks/library/specification/ws-secure/ WS-Security Specification]
* [http://www.ws-i.org/Profiles/BasicSecurityProfile-1.0.html WS-I Basic Security Profile]
* [http://www.cgisecurity.com/ws/ Web Services Security Documentation]
* [http://msdn2.microsoft.com/en-us/library/aa480545.aspx Web Service Security Patterns]
* [http://ws.apache.org/wss4j/ WSS4J] (WS-Security Java Implementation from Apache)
* [http://ws.apache.org/rampart/ Apache Rampart] (WS-Security Java Implementation from Apache Axis2)
* [https://wsit.dev.java.net/ WSIT] Web Services Interoperability Technologies (WSIT) that enable interoperability between the Java platform and Windows Communication Foundation (WCF)
Wikimedia Foundation. 2010.