Implementation Of Security Interaction Of Web Services Based On SOA

As the focus of IT industry in recent years, SOA (Service Oriented Architecture) hasgradually become the guiding idea of developing IT systems. Through a series of Standards andTechnology, Web Service has become the first choice for SOA integration of enterprises. It realizesa real sense of platform-independent and language-independent. With the wide use of Web Service,security interaction of Web Services has become increasingly difficult to achieve. Therefore, thespecifications on security interaction of Web Services are drawn up and constantly updated. SinceWeb Services Security Specification (WS-Security) involves message authentication mechanism,confidentiality and integrality, support privided by different application servers for securitymechanisms of Web Service are not the same. Therefore, how to achieve security interaction betweenapplications running under different environments becomes a difficult problem.Although SOA has solved the call of Web services in heterogeneous platforms, and there arerelevant security standards for information exchange between different platforms, but the support forthe WS-Security and the implementation of WS-Security in heterogeneous platforms are different. Forexample, certificate formats for WCF are pfx and cer, but WebSphere selects JKS repositories to storecertificates. It’s also different in the realization form of security policies, the security policy of WCF isin the.exe.config document, but the policy of WebSphere is in policy.xml and policySet.xml.Focusing on the above security problems of web services in heterogeneous platforms, securitymechanisms and strategies for interaction of Web services in heterogeneous platform are discussedfrom the perspective of the security of SOAP message. Security interaction of Web servicesbetween.NET and WebSphere is researched and a security interactive model between the twoplatforms is proposed. This model includes a key conversion module and a security policy integratedmodule. They are used to identify the key in different formats and integrate the security policies. Asecurity application scenario which includes three sides is built to ensure that the model is feasible. Byexperimental verification, the model achieves the encryption and signature of SOAP message inheterogeneous platforms and ensures the security of SOAP message in heterogeneous platform.