Securing Web Services With Ws-Security: Demystifying Ws-Security, Ws-Policy, Saml, Xml Signature, and Xml Encryption

The most up to date, comprehensive, and practical guide to Web services security, and the first to cover the final release of new standards SAML 1.1 and WS-Security.

• Comprehensive coverage and practical examples of the industry standards XML Signature and XML Encryption, and the first book to cover the final WS-Security and SAML 1.1 specifications.
• Authors Jothy Rosenberg and David Remy are security experts who co-founded GeoTrust, the #2 Web site certificate authority and currently work for Service Integrity and BEA Systems, respectively.
• According to IBM, American Express, Sun Microsystems, and other industry leaders, well-defined security standards and procedures are a crucial element to the adoption of web services in industry

• Table of Contents

  Forewords.
  

• Introduction.
  

  Who This Book Is For. About This Book. How This Book Is Organized.
  1. Basic Concepts of Web Services Security.
  
  Web Services Basics: XML, SOAP, and WSDL. Application Integration. Security Basics. Web Services Security Basics. Summary.
  2. The Foundations of Web Services.
  
  The Gestalt of Web Services. XML: Meta-Language for Data-Oriented Interchange. SOAP: XML Messaging and Remote Application Access. WSDL: Schema for XML/SOAP Objects and Interfaces. UDDI: Publishing and Discovering Web Services. ebXML and RosettaNet: Alternative Technologies for Web Services. The Web Services Security Specifications. Summary.
  3. The Foundations of Distributed Message-Level Security.
  
  The Challenges of Information Security for Web Services. Shared Key Technologies. Public Key Technologies. Summary.
  4. Safeguarding the Identity and Integrity of XML Messages.
  
  Introduction To and Motivation for XML Signature. XML Signature Fundamentals. XML Signature Structure. XML Signature Processing. The XML Signature Elements. Security Strategies for XML Signature. Summary.
  5. Ensuring Confidentiality of XML Messages.
  
  Introduction to and Motivation for XML Encryption. XML Encryption Fundamentals. XML Encryption Structure. XML Encryption Processing. Using XML Encryption and XML Signature Together. Summary.
  6. Portable Identity, Authentication, and Authorization.
  
  Introduction to and Motivation for SAML. How SAML Works. Using SAML with WS-Security. Applying SAML: Project Liberty. Summary.
  7. Building Security into SOAP.
  
  Introduction to and Motivation for WS-Security. Extending SOAP with Security. Security Tokens in WS-Security. Providing Confidentiality: XML Encryption in WS-Security. Providing Integrity: XML Signature in WS-Security. Message Time Stamps. Summary.
  8. Communicating Security Policy.
  
  WS-Policy. The WS-Policy Framework. WS-SecurityPolicy. Summary.
  9. Trust, Access Control, and Rights for Web Services.
  
  The WS-* Family of Security Specifications. XML Key Management Specification (XKMS). eXtensible Access Control Markup Language (XACML) Specification. eXtensible Rights Markup Language (XrML) Management Specification. Summary.
  10. Building a Secure Web Service Using BEA's WebLogic Workshop.
  
  Security Layer Walkthrough. WebLogic Workshop Web Service Walkthrough. Summary.
  Appendix A. Security, Cryptography, and Protocol Background Material.
  
  The SSL Protocol. Testing for Primality. RSA Cryptography. DSA Digital Signature Algorithms. Block Cipher Processing. DES Encryption Algorithm. AES Encryption Algorithm. Hashing Details and Requirements. SHA1. Silvio Micali's Fast Validation/Revocation. Canonicalization of Messages for Digital Signature Manifests. Base-64 Encoding. PGP.
  Glossary.
  Index

這是一本最新、全面且實用的網路服務安全指南，也是第一本涵蓋最終版本的新標準SAML 1.1和WS-Security的書籍。

• 全面涵蓋並提供實際範例，介紹了行業標準XML Signature和XML Encryption，並且是第一本涵蓋最終版本的WS-Security和SAML 1.1規範的書籍。
  


• 作者Jothy Rosenberg和David Remy是安全專家，共同創辦了GeoTrust，全球第二大網站憑證授權機構，目前分別在Service Integrity和BEA Systems工作。
  


• 根據IBM、美國運通、Sun Microsystems和其他行業領導者的說法，明確的安全標準和程序是在行業中採用網路服務的關鍵因素。
  


• 
  

  目錄

  
  

  前言。

  
  


• 
  

  引言。

  
  

  
  

  
  
  本書適合對象。關於本書。本書的組織方式。
  
  
  
  1. 網路服務安全的基本概念。
  

  
  

  
  
  網路服務基礎知識：XML、SOAP和WSDL。應用程式整合。安全基礎知識。網路服務安全基礎知識。摘要。
  
  
  
  2. 網路服務的基礎。
  

  
  

  
  
  網路服務的整體概念。XML：資料導向交換的元語言。SOAP：XML訊息和遠端應用程式存取。WSDL：XML/SOAP物件和介面的架構。UDDI：發佈和發現網路服務。ebXML和RosettaNet：網路服務的替代技術。網路服務安全規範。摘要。
  
  
  
  3. 分散式訊息層安全的基礎。
  

  
  

  
  
  網路服務資訊安全的挑戰。共享金鑰技術。公開金鑰技術。摘要。
  
  
  
  4. 保護XML訊息的身份和完整性。
  

  
  

  
  
  XML簽章的介紹和動機。XML簽章基礎知識。XML簽章結構。XML簽章處理。XML簽章元素。XML簽章的安全策略。摘要。
  
  
  
  5. 確保XML訊息的機密性。
  

  
  

  
  
  XML加密的介紹和動機。XML加密基礎知識。XML加密結構。XML加密處理。使用XML加密和XML簽章。摘要。
  
  
  
  6. 可攜式身份、驗證和授權。
  

  
  

  
  
  SAML的介紹和動機。SAML的運作方式。使用SAML和WS-Security。應用SAML：Project Liberty。摘要。
  
  
  
  7. 在SOAP中建立安全性。
  

  
  

  
  
  WS-Security的介紹和動機。使用安全性擴充SOAP。WS-Security中的安全性標記。提供機密性：WS-Security中的XML加密。提供完整性：WS-Security中的XML簽章。訊息時間戳記。摘要。
  
  
  
  8. 傳遞安全策略。
  

  
  

  
  
  WS-Policy。WS-Policy框架。WS-SecurityPolicy。摘要。
  
  
  
  9. 網路服務的信任、存取控制和權限。
  

  
  

  
  
  WS-*系列安全規範。XML金鑰管理規範（XKMS）。可擴展存取控制標記語言（XACML）規範。可擴展權限標記語言（XrML）管理規範。摘要。
  
  
  
  10. 使用BEA的WebLogic Workshop建立安全的網路服務。