Research And Application Of Web Services Security

With the rapid development of Web Services, security problems are becoming increasingly conspicuous. In order to cope with the new challenges and threats to Web Services, specialists have drafted a lot of specifications to protect Web Services. Web Services Security Specification (WS-Security) adds a framework to the existing specifications to embed these mechanisms into a Simple Object Access Protocol (SOAP) message. WS-Security doesn't guarantee security itself, and doesn't provide a complete security scheme.The thesis gives a careful analysis of the defects in traditional security system and the new security requirements of Web Services, carries out a research on the structure, syntax and trust mechanism of Web Services Security Specification; The thesis puts forward a Web Services security model based on message layer, then describes its security process modules, and analysis methods to improve the performance under the condition of ensured security of Web Services; The thesis implements a network file service system and its subscriber's program according to the Web Services security model based on message layer. Web Services in network file service system use the WS-Attachments specification to send and receive files. WS-Attachments specification is a proposed Web services standard that utilizes the Direct Internet Message Encapsulation (DIME) message encapsulation protocol to facilitate the sending attachments together with SOAP messages.The security model based on message layer not only ensures the confidentiality and integrality, but also proposes the security and expansibility from end to end, which provides the Web Services with an overall security guarantee. The security analysis of the network file service system is able to validate the security of model.