Web Services Encryption And Signature Technology

Web Service is a new type of component technology not more than three years' old from the first time its concept was brought out. It has big impact on the method of application designing, developing and deploying. Based on a series of protocols, it is featured for loose couple, platform independent, language independent and device independent. It has showed great potential in fields of Enterprise Application Integration (EAI) and E-business. When putting web service into business application, the problem of how to secure the delivering message is still unsolved. Current studies focus on how to build a unified security solution.This article studies the working theory of Web Service, explains the relationship and actions between SOAP roles. Then it focuses on the structure of SOAP message used during a service invoking. It is a simple protocol base on XML, used to transmit the structured information and type information. During a Web service invoking, the SOAP message may contain secret information, and should take measure to ensure it. But the protocol does not define the method of how to deal with security information. So this article uses SOAP extension to add customized security information. In order to make this information unified, this article illustrates how to encrypt and sign a SOAP message according to the XML encryption and signature standard of W3C. It also demonstrates the necessary XML elements and the semantic relationship between the elements. Finally, this article illustrates how to add the security information into a SOAP message and implements a secured Web Service example with WSDK based on filter model. It fulfills the requirements of confidentiality, security, authentication and non-reputation.