一种面向Web Services的安全中间件  

A security middleware in web services

作　　者：罗东俊[1,2] 

机构地区：[1]华南理工大学计算机科学与工程学院,广州510641 [2]广东商学院信息学院,广州510320

出　　处：《哈尔滨工业大学学报》2009年第9期218-221,共4页Journal of Harbin Institute of Technology

基　　金：广东省自然科学基金资助项目(06023960)

摘　　要：针对W eb Service广泛应用中存在的安全问题,构建了一种面向W eb Services的安全中间件(Security M idd leware inW eb Services,SMW S),设计了SMW S中间件的体系架构,并着重从用户管理和身份认证两方面深入探讨了具体实现技术.该中间件根据PGP信任模型进行用户管理,将公钥管理与用户管理结为一体,并在此基础上通过三方对等安全协议进行两两相互认证.分析与实验表明,该中间件能简单、安全、有效地解决W eb Services的认证、授权、抗否认、抗重放的安全问题,并能简单地实现单点登录.In allusion to the security problem in process of extensive use of web service, this paper proposes a security middleware in web services （SMWS）, designs its architecture, and discusses its concrete implementation technology from aspects of user management and identity authentication. The middleware manages user information by PGP model, and processes authentication each other by means of a triple-peer security protocol based on the combination of public-key management and user management. The analyses and experiment show that the middleware is simple, secure and effective to solve the security problem of web services such as authentication, permission, denying resistance, playback resistance. And it is capable to easily implement Single Sign-On.

关 键 词：安全 中间件 用户管理 身份认证 WEBSERVICE 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]