The Secure Agent Model Investigation And Implementation Of Web Service Based On RBAC

With the popularity of the Web Service's application, its security has become the key factor that constrains its development. How to provide a reasonable and comprehensive secure model to satisfy the special security need for Web Service and direct the development of turbo and all-sided secure platform has became a crucial research field in the area of Web Service.Based on the analysis of secure problem on Web Service, the security need aiming at the dynamic and extendable character of Web Service was generalized. The security needs concentrate on five facets: confidentiality, authentication and authorization, integrity and non-repudiation. Combined with these specific requirements of security, correlative techniques were discussed such as data encryption, certification and authorization.Based on these security techniques, the good and poor facets of some representational secure model were analysised, and a Web Service Secure Agent Model which is a light-weight Web Service Secure Mode was promoted. The model plays an important role in shell protection of Web Service. By this model, any user can be controlled and any message can be encrypted. RWSAM (Web Services Secure Agent Model based on RBAC) has been coined in this paper. The model inherits the strongpoint of present model such as secure message mechanism, network transportation security and so on. In the mean time, the model overcomes the flaws like difficulties of the Web service's development, poor extensibility and unilateral security consideration. Moreover, we can construct a Web Service Secure plat based on RBAC easily.Focusing on two secure components of RWSAM such as access control and secure message channel, this thesis mainly includes that:1,The access controller has been designed and implemented. It includes some functions such as account management, role management and basic user management. Meanwhile, a unique feature in this thesis is role management, which uses the idea of RBAC (Role-based Access Model) and realizes authorization function very well2,The secure message channel has been designed and implemented. By making use of this component, messages can be enciphered. So, request and response message can be transported safely.3,In the end, a completed Web Service application has been realized, which includes two type of services: one is RPC communication service, the other is Message exchange service. Meanwhile, this Web Service application integrates with RWSAM seamless. At last, RWSAM can reach a goal of access control and message secure transport by test.