WS-Security
705474
223679283
2008-07-05T06:18:31Z
218.227.145.110
/* External links */ +ja
'''WS-Security''' ('''Web Services Security''') is a [[communications protocol]] providing a means for applying security to [[Web service]]s. On April 19 2004 the WS-Security 1.0 standard was released by [[OASIS (organization)|Oasis-Open]]. On February 17 2006 they released version 1.1.
Originally developed by [[IBM]], [[Microsoft]], and [[VeriSign]], the protocol is now officially called WSS and developed via committee in Oasis-Open.
The protocol contains specifications on how integrity and confidentiality can be enforced on Web services messaging. The WSS protocol includes details on the use of [[Security Assertion Markup Language|SAML]] and [[Kerberos (protocol)|Kerberos]], and certificate formats such as [[X.509]].
WS-Security describes how to attach signatures and encryption headers to SOAP messages. In addition, it describes how to attach security tokens, including binary security tokens such as X.509 certificates and Kerberos tickets, to messages.
WS-Security incorporates security features in the header of a [[SOAP]] message, working in the [[application layer]]. Thus it ensures end-to-end security.
==Associated specifications==
The following draft specifications are associated with WS-Security:
*[[WS-SecureConversation]]
*[[WS-Federation]]
*[[WS-Authorization]]
*[[WS-Policy]]
*[[WS-Trust]]
*[[WS-Privacy]]
*[[WS-Test]]
==See also==
* [[List of Web service specifications]]
*[[WS-I Basic Security Profile]]
*[[Web Services]]
*[[SAML]]
*[[XML firewall]]
*[[XACML]]
*[[X.509]]
==Alternative(s)==
In point-to-point situations [[confidentiality]] and [[data integrity]] can also be enforced on Web services through the use of [[Transport Layer Security]] (TLS), for example, by sending messages over [[https]]. WS-Security however addresses the wider problem of maintaining integrity and confidentiality of messages until after a message was sent from the originating node, providing so called [[End-to-end|end to end security]].
Applying TLS can significantly reduce the overhead involved by removing the need to encode keys and message signatures into [[ASCII]] before sending. A challenge in using TLS would be if messages needed to go through a [[proxy server]], as it would need to be able to see the request for routing. In such an example, the server would see the request coming from the proxy, not the client; this could be worked around by having the proxy have a copy of the client's key and certificate, or by having a signing certificate trusted by the server, with which it could generate a key/certificate pair matching those of the client. However, as the proxy is operating on the message, it does not ensure [[End-to-end|end to end security]], but only ensures point-to-point security.
==See also==
* [[Web Services Enhancements (.NET)]]
==External links==
*[http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=wss OASIS Web Services Security TC] (Contains links to download specification documents)
*[http://www-128.ibm.com/developerworks/library/specification/ws-secure/ WS-Security Specification]
*[http://www.ws-i.org/Profiles/BasicSecurityProfile-1.0.html WS-I Basic Security Profile]
*[http://www.cgisecurity.com/ws/ Web Services Security Documentation]
*[http://msdn2.microsoft.com/en-us/library/aa480545.aspx Web Service Security Patterns]
*[http://ws.apache.org/wss4j/ WSS4J] (WS-Security Java Implementation from Apache)
*[http://ws.apache.org/rampart/ Apache Rampart] (WS-Security Java Implementation from Apache Axis2)
*[https://wsit.dev.java.net/ WSIT] Web Services Interoperability Technologies (WSIT) that enable interoperability between the Java platform and Windows Communication Foundation (WCF)
{{OASIS Standards}}
{{compu-network-stub}}
[[Category:World Wide Web]]
[[Category:Web service specifications|Security]]
[[Category:Security software]]
[[Category:XML-based standards]]
[[es:WS-Security]]
[[fr:WS-Security]]
[[ja:WS-Security]]
[[sv:WS-Security]]
[[zh:WS-Security]]