一种基于SOA的SOAP消息安全传输机制  

SOAP Message Security Transport Mechanism Based on SOA

作　　者：华悦 徐涛[1,2] 

机构地区：[1]南京航空天航大学计算机科学与技术学院,南京210016 [2]中国民航大学计算机科学与技术学院,天津300300

出　　处：《计算机科学》2012年第6期77-80,共4页Computer Science

基　　金：国家自然科学基金(60979011);天津市应用基础与前沿技术研究计划项目(09JCYBJC02300);中国民航大学科研启动基金项目(07QDXX)资助

摘　　要：随着SOA技术的发展与普及应用,基于SOA的Web服务安全问题日益突出,而SOAP消息传输的安全性是决定Web服务安全的重要因素。目前SOAP消息的传输主要依赖于WS安全标准,但由于WS安全标准存在种种缺陷,因此SOAP消息在传输过程中会受到XML注入攻击等Web攻击。提出了一种新的SOAP消息安全传输机制,即在现有的基于WS安全标准的安全传输机制基础上添加SOAP Validation节点。最后通过实验验证,该安全传输机制能检测出XML注入攻击,提高SOAP消息传输的安全性。With the technology development and popularization of SOA applications,the security issues of Web services based on SOA have become increasingly prominent.The security of SOAP message is of great importance to Web servicesecurity.Currently SOAP message transport mainly depends on the WS-Securitystandards.However,the WS-Security standards have some drawbacks.The SOAP messages in transport will be attacked by XML injection attacks and other Web attacks.Therefore,this paper designed a new SOAP message security transport mechanism which added the SOAP Validation node into the existing Web services security transport framework based on the WS standards.At last the experiments demonstrate that this security transport mechanism can truly detect some of XML attacks and improve the security of SOAP message.

关 键 词：SOA SOAP 安全传输机制 XML注入攻击 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]