Web Services Security

Abstract

This chapter surveys the context for web services security and discusses the issues and standards at every level of architectural. The authors attempt to evaluate the status of industrial practice with respect to the security of web services. They look at commercial products and their supporting levels, and end with some conclusions. They see a problem in the proliferation of overlapping and possibly incompatible standards. Reliability is also an important aspect. They discuss some of its issues and consider its effect on security. A basic principle of security is the need to secure all levels of architecture; any weak levels will permit attackers to penetrate the system. These levels include: Business workflow level, catalog and description of web services level, communications level (typically SOAP), and storage of XML documents. There is a variety of standards for web services security and reliability and the authors will look at most of them.

A Pattern-Driven Generation of Security Policies for Service-Oriented Architectures

“…Delessy and Fernandez defined several security patterns for SOA and Web Service security [4,6] that describe best practices and concepts such as identity provider and identity federation. These patterns provide an informal description, although parts of the pattern's solution are formalised using UML diagrams.…”