Network Deployment (Distributed operating systems), v8.0 > Secure applications and their environment > Secure web services > Secure web services > Web Services security concepts > Web Services Security concepts


Web Services security provides message integrity, confidentiality, and authentication


Overview

WS-Security is a standard used to secure web services at the message level...

Message-level security makes security part of the message itself by...

Message-level security requirements include...

With message-level security, the SOAP message itself either contains the information needed to secure the message or it contains information about where to get that information to handle security needs. The SOAP message also contains information relevant to the protocols and procedures for processing the specified message-level security. However, message-level security is not tied to any particular transport mechanism. Because the security information is part of the message, it is independent of a transport protocol, such as HTTPS.

The client adds to the SOAP message header security information that applies to that particular message. When the message is received, the web service endpoint, using the security information in the header, verifies the secured message and validates it against the policy. For example, the service endpoint might verify the message signature and check that the message has not been tampered with. It is possible to add signature and encryption information to the SOAP message headers, as well as other information such as security tokens for identity (for example, an X.509 certificate) that are bound to the SOAP message content.

For WAS Versions 6 and later, Web Services Security can be applied as transport-level security and as message-level security. We can architect highly secure client and server designs by using these security mechanisms. Transport-level security refers to securing the connection between a client application and a web service with SSL.

We can apply various scenarios of Web Services Security according to the characteristics of each web service application. You have choices of how to protect your information when using Web Services Security. The authentication mechanism, integrity, and confidentiality can be applied at the message level and at the transport level. When message-level security is applied, you can protect the SOAP message with a security token, digital signature, and encryption.

Without Web Services Security, the SOAP message is sent in clear text, and personal information such as a user ID or an account number is not protected. Without applying Web Services Security, there is only a SOAP body under the SOAP envelope in the SOAP message. By applying features from the WS-Security specification, the SOAP security header is inserted under the SOAP envelope in the SOAP message when the SOAP body is signed and encrypted.

To maintain the integrity or confidentiality of the message, digital signatures and encryption are typically applied.

We can add an authentication mechanism by inserting various types of security tokens, such as the Username token ( <UsernameToken> element). When the Username token is received by the web service server, the user name and password are extracted and verified. Only when the user name and password combination is valid, will the message be accepted and processed at the server. Using the Username token is just one of the ways of implementing authentication. This mechanism is also known as basic authentication.

In addition to digital signatures, encryption, and basic authentication, other forms of authentication include identity assertion, LTPA tokens, Kerberos tokens, and custom tokens. These other forms of authentication are also extensions of WAS. We can configure these authentication mechanisms using the assembly tools to implement authentication.

With updates to Web Services Security in the v1.1 specification, it is possible to layer additional functionality on top of these basic mechanisms. Some v1.1 mechanisms are extensions of WAS, such as signature confirmation and the encrypted header. The security token profiles that are supported by WAS include the Username token profile, the X.509 token profile, and the Kerberos profile. In this case, when the message is received, the web service endpoint, using the security information in the header, applies the appropriate security mechanisms to the message. For example, the service endpoint might add signature and encryption information to the SOAP message headers, as well as other information, such as security tokens, that are bound to the SOAP message content. We can implement these new mechanisms by using a policy set.

WS-SecureConversation was introduced in WAS v6.1 with the Feature Pack for Web Services. Secure Conversation uses a session key to protect SOAP messages more efficiently, particularly when multiple SOAP messages are transmitted in a session.

Other enhancements include:


Related


High-level architecture for Web Services Security
XML digital signature
Collection certificate store
Certificate revocation list
XML encryption
Security token
LTPA and LTPA v2 tokens
Username token
XML token
Binary security token
Kerberos token
Security considerations for web services
Web Services Security token propagation
Overview of standards and programming models for web services message-level security

 

+

Search Tips   |   Advanced Search