Web Services Security Model

With evolution of web 2.0, web services has become an integral part of the business hence the security of Web Services (WS) has become more critical.
Although there's no single set of WS standards has been agreed on the industry is continuallly developing and evaluating specifications.
The W3C working group is currently working on three basic specifications for Web Services:
  • XML Signature: For verifying the integrity of data sent via web services and validating the sender.
  • XML Encryption:for encoding the XML message
  • XKMS:For using PKI in web services
In 2002 Microsoft,IBM and Verisign announced Web Services Security Specification (WSS ) that proposed for addressing security in web services.
Organization for Advancement of Structured Information Standards came up with following:
  • SOAP Message Security 1.0
  • The Web Services Security Token Profile 1.0
  • The Web Services Security X.509 certificate token profile 1.0
The OASIS WSS message- security model has three main components:
  • security token
  • digital signature
  • claim


Popular posts from this blog

SQL Injection in search field

File Upload through Null Byte Injection