Research And Implementation Of Web Services Security Based On .NET Platform

Web Services are a kind of communication specifications between applications. They are entirely built in the current standards of Internet, with the advantage of loose coupling, cross-language and cross-platform. With the development of Web Services in e-commerce and other fields, the security has become increasingly important. As to the structure based on message, the industry has a suit of transport layer security mechanisms, which have widely be accepted, for example, the Secure Sockets Layer (SSL) and the Internet Protocol Security (IPSec). However, being lack of the end-to-end protection, no-repudiation, selective protection, flexible authentication mechanism and message layer protection, the existing security mechanisms can not provide enough security in Web Services model. At the present time, the specifications related to security of Web Services message mainly have WS-Security, XKMS, SAML, SOAP Security Extension-Digital Signature, etc. Though these specifications can implement safety of message in some ways, they can not provide a whole security solution.This paper brings forward a Web Services security model based on .NET platform with the use of its security mechanism and WS-Security specification, and gives methods of implementation and example.(1) Based on WS-Security specifiation and the use of .NET platform's security mechanism, a Web Services security model was designed, which is extendable and flexible.(2) Studies the enhancement of Web server's security based on .NET platform and gives the implementation methods.(3) Implements the Web service security model at Message-level based on WS-Security and gives the methods through an example which can be used in authentication, digital signature, encryption/decryption and authorization to SOAP messages. It resolves the problem of end-to-end SOAP messages security between service applicants and service providers. So it gives the guarantee of confidentiality, integrity, non-repudiation, authentication and authorization to messages.