Web服务消息级安全模型的设计及评价  

Message-level security model for web services and its security evaluation

作　　者：汤卫东[1] 周永权[1] 

机构地区：[1]广西民族学院计算机与信息科学学院,广西南宁530006

出　　处：《计算机工程与设计》2006年第10期1873-1875,1885,共4页Computer Engineering and Design

摘　　要：保证Web服务安全通信的机制有两种:传输级安全机制紧密耦合于下层平台,只能保证点到点的安全通信;而消息级安全机制能够提供异质环境的端到端安全保证。在WS-Security、SAML和XKMS等有关消息级安全的规范基础上,设计了一消息安全模型,并对其进行了安全性评价。该模型能够保证SOAP消息的机密性、完整性、不可否认性、认证和授权,能够保证Web服务的安全。There are two security mechanisms for web services： Transport-level security is tightly coupled to the underlying platform, and it only provide point-to-point secure guarantee, while message-level security can provide end-to-end secure guarantee in a heterogeneous environment. The specifications concerned with web services message-level security is put foruard, such as WS-security, SAML and XKMS. According to these specifications, a security model of SOAP message is designed which ensure the confidentiality, integrity, nourepudiation, authentication and authorization of SOAP message.

关 键 词：WEB服务安全 Web服务安全性语言 安全声明标记语言 XML密钥管理规范 XML签名 XML加密 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构] TP393.08[自动化与计算机技术—计算机科学与技术]