Survey on the Web Services Security Specifications

2013 ◽  
Vol 655-657 ◽  
pp. 1809-1814
Author(s):  
Xiao Fen Zhang ◽  
Yi Hou ◽  
Jia Lin Ma
Keyword(s):  
Web Services ◽  
Transport Layer ◽  
Secure Socket Layer ◽  
Transport Layer Security ◽  
Xml Encryption ◽  
Xml Signature ◽  
Web Services Security ◽  
The Web

Web Services security specifications include SSL/TLS (Secure Socket Layer/Transport Layer Security), XML Encryption, XML Signature, WS-Security specification family, PKI-related specifications etc. SSL/TLS are implemented in non-XML frameworks at the transport level, and others are implemented in XML frameworks at the application level. These specifications can satisfy the different requirements of Web Services security (confidentiality, integrity, authenticity, authorization, authentication and nonrepudiation). XML-based specifications are propitious to the integration and interoperability of Web Services security. SSL/TLS is sufficient for the basic generic security of internal Web Services projects. WS-Security is probably overkill, especially with the heavy XML processing that is involved in WS-Security.

Web Services Security

2008 ◽  
pp. 334-408
Author(s):  
Manuel Mogollon
Keyword(s):  
Web Services ◽  
Key Management ◽  
Markup Language ◽  
Access Protocol ◽  
Xml Encryption ◽  
Extensible Markup ◽  
Xml Signature ◽  
Web Services Security ◽  
Open Standards ◽  
Security Assertion Markup Language

A service is an application offered by an organization that can be accessed through a programmable interface. Web services allow computers running on different operating platforms to access and share each other’s databases by using open standards, such as extensible markup language (XML) and simple object access protocol (SOAP). In this chapter, the following Web services mechanisms are discussed: (1) XML encryption, XML signature, and XML key management specification (XKMS); (2) security assertion markup language (SAML); and (3) Web services security (WS-security).

Web Services Security Based on XML Signature and XML Encryption

2010 ◽  
Vol 5 (9) ◽  
Author(s):  
Yue-sheng Gu ◽  
Meng-tao Ye ◽  
Yong Gan
Keyword(s):  
Web Services ◽  
Xml Encryption ◽  
Xml Signature ◽  
Web Services Security

scholarly journals Rancang Bangun Keamanan Web Service Dengan Metode Ws-Security

2012 ◽  
Vol 6 (1) ◽  
Author(s):  
Ari Muzakir ◽  
Ahmad Ashari
Keyword(s):  
Web Services ◽  
Web Service ◽  
Public Key Cryptography ◽  
Web Security ◽  
Security Model ◽  
Model Library ◽  
Request Message ◽  
Xml Encryption ◽  
Xml Signature ◽  
The Web

AbstrakWeb service menggunakan teknologi XML dalam melakukan pertukaran data. Umumnya penggunaan web service terjadi pertukaran data ataupun informasi penting yang perlu dijaga keamanannya. Bentuk pengamanan yang diterapkan pada web services adalah dengan penggunaan teknik kriptografi kunci-publik. Adapun serangan dapat berupa pengintaian, perusakan maupun pencurian data. Salah satu cara penyelesaian terbaik adalah dengan membuat data tersebut tidak dapat dibaca orang lain. Implementasi yang telah dilakukan dengan menggunakan library keamanan akan memberikan kemudahan dalam membangun keamanan web service karena dengan dukungan library XMLSEC sebagai library pendukung dan library class_wss yang telah dibangun mampu mengatasi masalah keamanan pada jalur transport khususnya untuk otentikasi, otorisasi, dan konfidensialitas pesan SOAP request. Model WS-Security dengan menggunakan XML Signature, XML Encryption, serta Security Token yang memanfaatkan algoritma kriptografi RSA dengan panjang kunci 1024 bit mampu memberikan perlindungan terhadap transmisi data antara client dan server web service. Pengujian yang dilakukan pada web service dengan menerapkan model library class_wss sebagai keamanan web service yang dibangun memberikan hasil yang baik, yaitu pesan SOAP request terenkripsi dan mampu didekripsi dengan baik serta dapat tertandatangani dan dicek keasliannya.Kata kunci— Keamanan Web Service, XML Signature, XML  Encryption, Security Token. Abstract Web service uses XML technology to exchange data in. Generally, the use of the web service exchanges data or important information that needs to be guarded security. Form of security is applied to web services is to use public-key cryptography techniques. The attack can be a reconnaissance, destruction or theft of data. One way the best solution is to create data that can not read anyone else, even if someone else managed to retrieve the data, he will not be able to read it.            The implementation was done by using the security library will provide facilities in developing a web security service for the library support XMLSEC as library supporters and library class_wss that have been built able to overcome the problem of security on the transport path, especially for authentication, authorization, and confidentiality request SOAP message. Model WS-Security using XML Signature, XML Encryption, and Security Token which utilizes the cryptographic algorithm RSA with 1024 bit key length to provide protection against transmission of data between client and server web service. Tests performed on the web service by implementing a security model class_wss library web service that is built to give good results, the SOAP request message is encrypted and decrypted with a good and able to sign and check their authenticity too.Keywords— Web Service Security, XML Signature, XML Encryption, Security Token

TLS, SSL, and SET

2008 ◽  
pp. 300-333
Author(s):  
Manuel Mogollon
Keyword(s):  
Credit Card ◽  
Web Server ◽  
Point Of View ◽  
Transport Layer ◽  
The Internet ◽  
Secure Socket Layer ◽  
End User ◽  
Credit Card Number ◽  
Transport Layer Security ◽  
Commercial Transaction

In an Internet commercial transaction, the secure Web server and the buyer’s computer authenticate each other and encipher the data transmitted using transport layer security (TLS) or secure socket layer (SSL) protocols. When a purchase is made online using a credit card, does the customer’s bank need to know what was purchased? Not really. Does the seller need to know the customer’s credit card number? Actually, the answer is no. The responses to these questions were the main premises of the secure electronic transaction (SET). In the late 1990’s, SET was approved as the credit card standard, but it failed to be accepted because of its cost and the problems regarding distribution of end-user certificates. However, SET is explained in this chapter as an ideal protocol, from the point of view of certificates, digital signatures, and cryptography for securing credit card transactions over the Internet.

scholarly journals The Arithmetic Of elliptic Curve for Prime Curve Secp-384r1 Using One Variable Polynomial Division for Security of Transport Layer Protocol

2019 ◽  
Vol 8 (2) ◽  
pp. 4770-4774
Keyword(s):  
Elliptic Curve ◽  
Transport Layer ◽  
Mathematical Function ◽  
Secure Socket Layer ◽  
Prime Field ◽  
Security Services ◽  
Transport Layer Security ◽  
Digital Signature Algorithm ◽  
Ssl Protocol ◽  
Transport Layer Protocol

In this paper, we present a new method for solving multivariate polynomial elliptic curve equations over a finite field. The arithmetic of elliptic curve is implemented using the mathematical function trace of finite fields. We explain the approach which is based on one variable polynomial division. This is achieved by identifying the plane p with the extension of and transforming elliptic curve equations as well as line equations arising in point addition or point doubling into one variable polynomial. Hence the intersection of the line with the curve is analogous to the roots of the division between these polynomials. Hence this is the different way of computing arithmetic of elliptic curve.Transport layer security provides endto-end security services for applications that use a reliable transport layer protocol such as TCP. Two Protocols are dominant today for providing security at the transport layer, the secure socket layer (SSL) protocol and transport layer security (TLS) protocol. One of the goals of these protocols is to provide server and client authentication, data confidentiality and data integrity. The above goals are achieved by establishing the keys between server and client, the algorithm is called elliptic curve digital signature algorithm (ECDSA) and elliptic curve DiffieHellman (ECDH). These algorithms are implemented using standard for efficient cryptography(SEC) prime field elliptic curve secp-384r1 currently specified in NSA Suite B Cryptography. The algorithm is verified on elliptic curve secp384r1and is shown to be adaptable to perform computation

Ancaman Keamanan pada Transport Layer Security

2016 ◽  
Vol 7 (2) ◽  
pp. 70-75
Author(s):  
Muhamad Fadhli ◽  
Fityan Ali Munshi ◽  
Taufik Adi Wicaksono
Keyword(s):  
Web Security ◽  
Transport Layer ◽  
Secure Socket Layer ◽  
Transfer Layer ◽  
The Public ◽  
Transport Layer Security ◽  
Public Networks ◽  
Index Terms ◽  
In Transit

Secure Socket Layer (SSL) also known as Transfer Layer Security (TLS) is de facto standard for web security. It provides confidentiality and integrity of information in transit across the public networks using their powerful cipher suites but it still contains some loopholes or flaws in its foundation. In this paper we discuss TLS standard along with various attacks found in recent years, such as BEAST, CRIME, BREACH, Lucky 13, and their proposed mitigation. Index Terms— Attack, Compression, Mitigation, Security, TLS.

Introduction to OpenFlow

2018 ◽  
pp. 52-71 ◽  
Author(s):  
Mohit Kumar Jaiswal
Keyword(s):  
Control Mechanism ◽  
Internal Flow ◽  
Transport Layer ◽  
Secure Socket Layer ◽  
Transport Layer Security ◽  
Flow Table ◽  
Network Switch ◽  
Sdn Controller ◽  
Ethernet Switch

The SDN controller is interfaced with the hardware of the network (i.e., with switches and routers) using OpenFlow. Basically, OpenFlow is an open interface used for configuring the forwarding tables of network switch according to the desired path derived by the SDN controller. OpenFlow enables more innovation in controller platforms and applications, and describes a solution for each frame or packet flow. OpenFlow is based on an ethernet switch with an internal flow-table and a standardized interface to add and remove flow entries of forwarding table of the system. The control mechanism from each one of the switch and router up to SDN controller are encrypted with the transport layer security (TLS) and secure socket layer (SSL) OpenFlow protocols to provide the additional security inside the network.

Sign in / Sign up

Export Citation Format

Share Document