TELKOM
NIKA Indonesia
n
Journal of
Electrical En
gineering
Vol.12, No.4, April 201
4, pp. 2868 ~ 2
8
7
4
DOI: http://dx.doi.org/10.11591/telkomni
ka.v12i4.4734
2868
Re
cei
v
ed Se
ptem
ber 5, 2013; Re
vi
sed
No
vem
ber 4,
2013; Accept
ed No
vem
b
e
r
21, 2013
Security Interaction of Web Services in Heterogeneous
Platforms
Xu Tao
1
, Hu Xin
2
, Xie Ji
w
e
n*
3
, Sun Shujuan
4
1,3
Colleg
e
of Computer Sci
e
n
c
e and T
e
chno
log
y
, Civi
l
Av
iat
i
on U
n
ivers
i
t
y
of Chin
a, T
i
anjin, 3003
00, Ch
i
n
a
1,2,
3
Information T
e
chnolog
y R
e
search Bas
e
, Civil Avi
a
tio
n
Administrati
on of
Chin
a, T
i
anjin, 3003
00, Ch
ina
1,3,
4
Colle
ge of Comp
uter Scie
nce, Nan
jin
g U
n
iversit
y
of Aer
ona
utics an
d Astronaut
ics, Na
njin
g, 21
001
6,
Chin
a
*Corres
p
o
ndi
n
g
author, e-ma
i
l
: txu@ca
uc.ed
u
.cn
1
, xhu
@
ca
uc.edu.cn
2
, xiej
i
w
en
po
w
e
r@
1
63.com
3
,
sunsh
u
ju
an
87
@16
3
.com
4
A
b
st
r
a
ct
Currently,
ther
e ar
e
a l
a
rge
n
u
m
ber
of heter
oge
ne
ous pl
atforms.
T
h
e sta
n
dards
of W
e
b
Service
s
in d
i
fferent p
l
at
forms ar
e d
i
fferent an
d co
mpl
e
x. T
her
efore,
security i
n
terac
t
ion of W
eb s
e
rvices b
a
sed
o
n
hetero
g
e
neo
us
pl
atform has
beco
m
e i
n
cre
a
s
ingly
pr
o
m
in
e
n
t. In ord
e
r to
real
i
z
e
secur
i
ty interacti
on
of
hetero
g
e
neo
us
pl
atforms, a
s
e
curity interacti
v
e mo
del
of W
eb S
e
rvice
b
a
s
ed
on
W
ebSp
h
e
re
and
.NET
i
s
prop
osed i
n
thi
s
paper. T
he
mo
de
l ado
pts an ap
proac
h b
a
s
ed o
n
pred
ic
ate log
i
c to integrate the sec
u
rity
polic
ies
of
het
erog
ene
ous
pl
atforms
an
d
u
s
es the
int
egr
ated
po
licy to
sig
n
the
SO
AP messa
ge.
T
h
e
e
x
p
e
r
i
m
e
n
t
al
re
su
l
t
s sh
o
w
th
a
t
th
e
m
o
d
e
l
ca
n
e
n
s
u
r
e
the
sa
fe
ty o
f
SOAP m
e
ssag
e
tra
n
s
m
i
ssi
o
n
and
reali
z
e
the sec
u
rity sessio
n
b
e
tw
een these t
w
o heterog
ene
ous pl
atforms.
Ke
y
w
ords
:
he
teroge
ne
ous pl
atforms, secur
i
ty
interaction,
SOAP m
e
ssage, web services
Copy
right
©
2014 In
stitu
t
e o
f
Ad
van
ced
En
g
i
n
eerin
g and
Scien
ce. All
rig
h
t
s reser
ve
d
.
1. Introduc
tion
As the
fo
cus of IT i
ndu
stry in recent y
ears, SOA
(Service
O
r
ie
nted Archite
c
ture)
ha
s
grad
ually be
come th
e gu
iding ide
a
of
developi
n
g
IT system
s.
SOA advocates a
n
idea t
hat
system
co
mp
onent
s d
e
veloped
in diffe
rent pla
tforms and
differe
nt tech
nique
s
can b
e
combi
n
ed
rapidly
and freely. The
s
e
compon
ents are stan
d-
alone
and ea
ch co
mpone
nt
can perfo
rm certa
i
n
function
s ind
epen
dently [1, 2].
Gene
rally, traditional i
n
te
gration
sol
u
tion of
ap
plications i
s
b
u
sine
ss-o
rie
n
ted an
d
informatio
n-o
r
iented,
whi
c
h is
difficult to suit
dema
n
d
s cha
nge
d with
the rapi
d
develo
p
me
nt
of
busi
n
e
ss. SO
A rebuild
s th
e existing
system
s and
d
e
sig
n
s a
ne
w application
system from t
h
e
view of software a
r
chite
c
tu
re. Con
s
e
que
ntly, it
suppo
rts to impleme
n
t the Enterprise Appli
c
atio
n
Integration
(E
AI) dynamica
lly. In addition, SOA
make
s the ente
r
pri
s
e
be
com
e
m
o
re
ela
s
tic a
n
d
flexible and can qui
ckly re
spo
nd to the variation
s
of busi
n
e
ss req
u
irem
ent, so
that the real-t
ime
enterp
r
i
s
e an
d dynamic e
n
t
erpri
s
e
can b
e
reali
z
ed.
With the mat
u
re
stand
ard
s
of Web Se
rvic
e a
nd the
popul
arity of its appli
c
atio
n, Web
Service p
r
ovi
des the
ba
si
s for
wide
sp
read impl
em
e
n
ting SOA [3]. It realizes
a real
sen
s
e
of
platform-i
nde
pend
ent and
languag
e-i
n
depe
ndent. Yet it brings challen
g
e
s
to se
cure issues.
W
i
th
th
e
w
i
d
e
us
e o
f
W
e
b Se
r
v
ic
e, s
e
c
u
r
i
ty inte
r
a
c
t
ion
o
f
W
e
b Se
r
v
ic
es
ha
s be
come
increa
singly
difficult to achieve. Theref
ore, the
sp
e
c
ificatio
ns on
security interactio
n of Web
Service
s
are dra
w
n up a
n
d
con
s
tantly updated [4].
Curre
n
tly, th
ere a
r
e a la
rge n
u
mbe
r
of
Web Se
rvice
s
Security Specificatio
n (WS
-
Secu
rity),
in
cludi
ng WS-Addre
s
sing, WS-Se
c
u
r
ity, WS
-Reli
abl
e Me
ssagi
ng
(WS-RM),
WS-
Secu
re Conv
ersation (WS
-
SC) a
nd so
on. These
specifi
c
ation
s
ensure the
secu
rity of We
b
Service from
different views a
nd ra
ng
es. A
pplication Servers
providin
g su
pport
s
for Web
Service are al
so
put
more and
mo
re attention to interoperability.
But different appl
ication
servers
provide different se
curity mech
ani
sm
s for Web Se
rv
ice [5, 6]. Therefore, how to
achieve secu
rity
intera
ction b
e
twee
n ap
pli
c
ation
s
runni
ng un
der
different e
n
viro
nments be
co
mes
a difficult
probl
em.
The interacti
on between
J2EE and
.NET
is an importa
nt part of Web Service
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
Sec
u
rity
Interac
t
ion of Web Serv
ic
es
in Heteroge
neo
us Platform
s
(Xu Tao
)
2869
Interoperability [7], how t
o
re
solve the interaction between th
em, therefore,
has become a
seri
ou
s p
r
o
b
l
e
m. In thi
s
pape
r, security inte
ractio
n of h
e
tero
g
eneo
us platf
o
rm
ba
sed
on
WebSp
h
e
r
e
and .
N
ET is studi
ed. By analyzi
ng
th
e security m
e
ch
ani
sms of
heteroge
neo
us
platform
s, a secu
rity intera
ctive model
o
f
W
eb Servi
c
e in hete
r
oge
neou
s platfo
rms is
pro
p
o
s
ed.
This mod
e
l u
n
ifies
se
cu
rity poli
c
e
s
of
he
teroge
neo
us
platform
s by
conve
r
ting
th
e security p
o
l
i
cy
descri
bed in
XML into assertion re
presented in pr
e
d
icate. On th
is basi
s
, with
an example
of
ticket re
se
rv
ation se
rvice
,
the safe handli
ng
of SOAP (Simple Object A
c
cess Proto
c
ol)
messag
es in
hetero
gen
eo
us platfo
rms i
s
achieved.
T
h
is security model p
r
ovid
es theo
ry su
p
port
for the
se
cu
rity intera
ctio
n of
Web S
e
rvice
s
i
n
h
e
terog
ene
ou
s platform
s.
By experime
n
tal
verification, the model
can
ensu
r
e the secu
rity
intera
ction of We
b Service
s
effe
ctively.
2.
Securit
y
Me
chanisms o
f
Heterog
e
neo
u
s Platform
s
One of th
e chara
c
te
risti
c
s of SOA is t
hat it
allo
ws
each servi
c
e
to use its
re
spe
c
tive
techn
o
logy a
nd platform. I
n
this case, in ord
e
r to a
c
hieve the int
e
ra
ction am
o
ng se
rvices, the
definition
s
of servi
c
e
cont
ract a
nd the
comm
uni
ca
ti
on protocol
must comply
with the ind
u
stry
stand
ard
s
[8]. As a
d
e
si
gn
idea,
SOA d
oes not
spe
c
i
f
y the imple
m
entation
m
e
thod to
a
c
hi
eve
intera
ction of
Web Se
rvice
s
. The
r
efore, softwa
r
e
com
panie
s
have l
aun
che
d
their own p
r
od
uct
s
for SOA.
2.1. Securit
y
Mechanism
of .NET
WCF (Wind
o
ws Comm
unication F
ound
ation V
3
.0) i
s
a
com
p
lete
techni
cal
frame
w
ork
de
sign
ed by
Mi
cro
s
oft fo
r S
O
A. It s
upp
o
r
ts the
ind
u
stry stand
ards and th
e
co
re
proto
c
ol
s of Web Se
rvice
[9]. And it u
n
ifies a
vari
e
t
y of distribut
ed tech
nolo
g
i
e
s p
r
od
uced
by
Mic
r
osoft [9],
inc
l
uding:
1) Web Servi
c
e
s
and
WSE [10].
2) .NET Remoting.
3) .NET Enterprise Services
.
4) Micro
s
oft Messag
e Qu
eue (MSM
Q).
The a
r
chitect
u
re
of WCF (sho
wn
as
Fi
gure
1) i
n
cl
u
des th
e follo
wing
aspe
cts su
ch a
s
contract, me
ssag
e, and ru
n
t
ime behavio
r of service, host and
so on
.
Figure 1.
Architecture of WCF
In the a
r
chite
c
ture
of
WCF
,
the spe
c
ific
definition of
transmi
ssion
for SOAP m
e
ssage
is
defined i
n
po
licy and
bindi
ng of the
co
n
t
ract. Bindin
g
define
s
a
co
mmuni
cation
mode
with th
e
outsid
e
, which is con
s
i
s
te
d of a set of binding el
ements
whi
c
h are combi
ned to form
a
comm
uni
cati
on infra
s
tru
c
t
u
re. The bi
ndi
ng co
ntain
s
the followi
ng a
s
pe
cts:
1) Co
mmuni
cation proto
c
ol
s, su
ch a
s
HT
TP, TCP, etc.
2) Me
ssage e
n
co
ding mo
d
e
, such as bi
nary co
ding,
MTOM, etc.
3) Security st
rategie
s
of m
e
ssag
e.
The graphi
cs
will stay in the “s
econd”
column, but you can drag
them to the first
colum
n
.
Make the graphic
wider to push
out any text that may
try to fill in ne
xt to
the graphic.
2.2. Securit
y
Mechanism
of We
bSphe
re
WebSp
h
e
r
e Applicatio
n
S
e
rver (WAS)
V7.0
su
ppo
rts a
nd exte
nds th
e
WS-Secu
r
ity
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 4, April 2014: 2868 – 2
874
2870
specification:
1) In a
dditio
n
to the b
a
sic types of
t
o
ke
ns
(Username
and X
509) [11], WAS also
sup
port
s
cu
st
omize
d
t
y
pe of
t
o
ken
s
,
su
ch a
s
LTP
A
t
o
ke
n.
2) WAS allo
ws to add time
stamp in the
sign
ature a
n
d
encryptio
n.
3) WAS supp
orts the
certifi
c
ation
ca
che
mech
ani
sm, and then imp
r
oves the effici
ency.
WAS V7.0 propo
se
s the concept of poli
c
y set.
When
use
r
s
ch
oo
se different p
o
licy set
s
for a
pplicatio
ns, the
Q
o
S (Q
uality of
Service
)
i
s
di
fferent. Since
WAS V7.0
empha
si
ze
s t
h
e
sep
a
ratio
n
of
the Web Se
rvice
and th
e
se
cu
rity
poli
c
y, develop
ers only
nee
d to consi
d
e
r
th
e
busi
n
e
ss
l
ogi
c without kn
owin
g
the secu
rity-rel
a
te
d detail
s
. After d
eployin
g
the ap
plication,
admini
s
trato
r
can co
nfigu
r
e
app
rop
r
iate policy set
for the
appli
c
atio
n
acco
rdi
ng
t
o
the
n
eed
s
i
n
the
ma
nag
e
m
ent con
s
ol
e
or
in the ma
nner of Jy
tho
n
, Jacl scri
pt. When the secu
rity dema
n
d
cha
nge
s, a
d
m
inistrator j
u
st ne
ed
s to
reco
nfi
gure th
e poli
c
y set
without
ch
an
ging th
e p
r
og
ram
cod
e
.
3.
Securit
y
Interactiv
e Model on Heter
o
g
e
neou
s Platforms
3.1.
Securit
y
Interactiv
e Model of Web Ser
v
ice in Heter
ogeneo
u
s Platforms
Secu
rity fram
ewo
r
ks
and
config
uratio
n
s
for differe
nt
platform
s a
r
e quite
different, and
each platform use
s
its o
w
n security policy and
te
chnolo
g
y to meet the se
cu
rity requirem
e
nts
[12]. Therefore, in order to
achieve the
se
curi
ty interaction of We
b Service
s
in
heterog
ene
o
u
s
platform
s, a
middle
w
a
r
e
or a
n
a
gent
must
be
a
dded. T
he
middle
w
a
r
e
can
unify
se
curity
config
uratio
n
s
of h
e
terog
eneo
us
platform
s,
and
then u
s
e
the
agreed
co
n
f
iguration
for the
se
curity
pro
c
essing
of SO
AP messa
ge.
In o
r
de
r to
achi
eve
safe
han
dling
of
SOAP message
excha
nging
betwe
en het
erog
ene
ou
s platform
s,
a se
curity se
rvice proxy is adde
d betwe
en
WebSp
h
e
r
e
and .NET. Th
is proxy inclu
des a
se
cu
rity policy integ
r
ated mo
dule
.
Figure 2
sh
ows
the se
curity intera
ctive mo
del of Web S
e
rvice in h
e
te
roge
neo
us pl
atforms.
3.2. Securit
y
Polic
y
Integrated M
odul
e
WCF can u
s
e the
config
uration
file to en
su
re
the
se
cu
rity of Web S
e
rvice
,
that is,
throug
h
setting ap
propri
a
te authe
nticati
on in
cu
stomi
z
ed
bindi
ng.
WCF ha
s fiv
e
authe
nticati
on
mode
s whi
c
h
are sho
w
n a
s
below:
1) Use
r
Name
OverT
r
an
spo
r
t;
2) Mutual
Ce
rtificate;
3) Use
r
nam
e
F
orCertificate
;
4) Anonymo
u
s
Fo
rCertificat
e
;
5) Kerb
eros.
Figure 2. Security Interacti
v
e Model of W
eb Se
rvice
in Heteroge
n
eou
s Platforms
WAS do
esn’t have th
e
co
nce
p
t of a
u
th
enticatio
n mo
de. In o
r
d
e
r t
o
a
c
hieve
the
se
cu
rity
intera
ction b
e
t
ween
WCF
and WAS, a f
easi
b
le aut
h
e
n
tication m
o
d
e
sho
u
ld b
e
chosen from t
h
e
five modes to gene
rate
a solution. In this
pape
r,
authenticati
on mode
Mu
tualCe
rtificate
is
sele
cted to
achi
eve the se
curity interacti
on. Thi
s
mode
supp
ort
s
X.509 aut
hentication a
nd
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
Sec
u
rity
Interac
t
ion of Web Serv
ic
es
in Heteroge
neo
us Platform
s
(Xu Tao
)
2871
SOAP extension.
Secu
rity policies of WCF and WAS are
different
not only in the content, but also in the
reali
z
ation fo
rm. Secu
rity policy of
WCF
is in
th
e .exe.config
do
cu
ment, but se
curity p
o
licy
of
WAS is in pol
icySet.xml.
For a
c
hievin
g se
curity intera
ction b
e
twee
n WCF and WAS
,
the secu
rity policy
integrate
d
m
o
dule i
s
used t
o
an
alysi
s
the
se
cu
rity
poli
c
ies
of differe
n
t
platform
s a
n
d ge
nerate a
n
integrate
d
se
curity poli
c
y.
In orde
r to a
c
hieve the inte
gration
of se
cu
rity polici
e
s,
an ap
pro
a
ch
based o
n
predicate
logic to
co
nvert secu
rity p
o
licy from XM
L de
script
ion
into pre
d
icate
is ad
opted.
A se
curity pol
icy
can
be
cla
ssi
fied into thre
e types of
se
curity
requi
re
ments:
signat
ure, en
cryption an
d security
token. A p
r
ed
icate
sign
ature (sho
wn a
s
Figure 3)
i
s
u
s
ed to
de
scri
be the
sign
ature
req
u
ire
m
ent,
whe
r
e
sigId
is the Id of th
e
sign
ature
for
a varia
b
le
in
variable
list v
a
r, an
d the
to
kenId
is th
e I
d
of
a se
curity token u
s
ed fo
r signatu
r
e. The sign
at
ure
algorithm salgo, t
he tra
n
sform algo
ri
thm
talgo, and the dige
st algorithm dal
g
o
are used
in this appro
a
ch. Similarl
y, the predicate
encryption is
defined for th
e encry
ption
requi
rem
ent, whe
r
e
kalgo i
s
the algo
rith
m use
d
for key
encryption
an
d dalg
o
i
s
th
e algo
rithm
u
s
ed fo
r d
a
ta
encryption. T
he p
r
edi
cate
token i
s
fo
r t
h
e
se
curity toke
n requi
rem
e
n
t, where vari
a
b
le
t
represen
ts the token t
y
pe, such as
X509v3.
Figure 3. Security Policy
Assertion
Both the
WCF and
WAS
use
XML to
descri
be th
e
se
curity p
o
licy. Therefo
r
e,
they ca
n
be co
nverte
d
into assertio
n sho
w
n a
s
Figure 3.
Accordin
g to the rule
s of gen
e
r
ating inte
gra
t
ed
se
curity poli
cy, secu
rity po
licie
s of hete
r
ogen
eou
s
pla
tforms
can b
e
unified, the
n
the integ
r
at
ed
se
curity poli
cy is used to
sign and e
n
crypt SOAP
message. F
i
gure 4
sho
w
s the rule
s for
integratin
g signature req
u
irem
ents. Predi
cate
i
s
IntegrityCon
si
stent i
s
a
co
nstraint
for
con
s
i
s
ten
c
y of data integrity. It returns true wh
en
the variable cVar of
t
he client’s
operation cO
pp
and the vari
a
b
le sVa
r
of the se
rver’
s
o
perat
io
n sOp
p
have the
same si
gnatu
r
e req
u
ire
m
en
ts.
The predi
cate
reque
stInteg
r
ity return
s true if a variabl
e requi
re
s int
egrity.
Figure 4. Rul
e
s for Integ
r
a
t
ing Signature Req
u
ire
m
e
n
ts
Similarly, the other req
u
irements
(su
c
h as
en
crypt
i
on and security token)
can be
defined.
4. Ticket
Res
e
r
v
ation
Ser
v
ice
The a
ppli
c
ati
on
scena
rio i
s
d
e
si
gned
a
s
follo
ws (sh
o
wn
in Fi
gure
5). T
he u
s
e
r
se
nd
s a
requ
est
me
ssage to
the t
r
a
v
el se
rvice; t
he SOAP
m
e
ssage
contai
ns th
e b
a
si
c i
n
formatio
n (such
as u
s
e
r
nam
e, password, et
c.) an
d authe
ntication to
ke
n. The user
must be a
u
th
enticate
d
bef
ore
invokin
g
the
airline
se
rvice
.
The travel
service
and th
e airlin
e servi
c
e run o
n
different te
chn
o
l
ogy
platform
s, therefore their secu
rity polic
ie
s and te
chni
cal sup
port
s
are different.
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 4, April 2014: 2868 – 2
874
2872
Figure 5. Sce
nario of
T
i
cke
t
Rese
rvation
Service
The ba
sic
se
curity dem
an
ds of the sce
nario a
r
e:
1) T
he t
r
avel
servi
c
e
and
t
he u
s
e
r
, the
trav
el
se
rvice
and th
e ai
rlin
e servi
c
e
ca
n
validate
each other.
2) In the pro
c
ess of tran
sm
issi
on, co
nf
id
entiality and integrity must
be en
sured.
4.1. Variables of Ticke
t Reserv
a
tion Serv
ice
Table 1 lists t
he variabl
es i
n
the process of
the ticket
reservatio
n service. The u
s
erMsg
is the i
n
forma
t
ion that is
su
bmited to tra
v
el se
rvice
b
y
the user. T
he custo
m
erI
D
an
d pa
ssword
rep
r
e
s
ent th
e
user’
s
n
a
me
and
pa
sswo
rd
re
spe
c
ti
vely. The ai
rMsg is the info
rmation that i
s
submite
d
to t
he airli
ne
se
rvice
by the travel se
rvice.
The ai
r
line
N
o
rep
r
e
s
ent
s the flight num
ber
of the use
r
.
Table 1. Vari
able
s
of Ticket Reservatio
n Service
Message Variables
userMsg
airMsg
customerID pa
ssw
ord
airlineNo
4.2. Integra
t
e the Secu
rity
Policies
1) Security Policy of Trave
l
Service
The travel se
rvice ne
ed
s to intera
ctive with
both the use
r
and the
airline
servi
c
e, so two
se
curity poli
c
ies are req
u
i
r
ed. The tra
v
el serv
ice a
nd the client
run on the
same pl
atform,
therefo
r
e, th
eir security p
o
licy asse
rtio
ns a
r
e the
same. Figu
re
6 sho
w
s the
se
curity poli
c
y
assertio
n of t
he travel
se
rvice, SOAP m
e
ssag
e that
the u
s
er
provides to t
r
avel
servi
c
e in
clu
d
e
s
use
r
'
s
name
and pa
ssword. The sig
nat
ure alg
o
rithm
s
rsa
s
ha1, th
e tran
sform a
l
gorithm ex
c1
4n,
the dige
st algorithm
sha
1
,
t
he encrypti
on algo
rithm
exc14
n
,
and
the data en
cryption algorit
hm
sha
1
are u
s
e
d
. The SOAP message i
s
signed by u
s
ername token.
Figure 6. Security Policy
Assertion
b
e
tween
T
r
avel Service a
nd Cli
ent
The se
cu
rity policy a
sse
rti
on between the travel
se
rvice an
d the airline service is sh
own
in Figure 7.
Figure 7. Security Policy
Assertion b
e
tw
een
T
r
avel Service a
nd
Airline Service
2) Security Policy of Trave
l
Service
The se
cu
rity
policy
of airli
ne servi
c
e (shown
in
Fi
gu
re 8) spe
c
ifies that all the v
a
riabl
es
are si
gne
d wi
th x509v3, and use
r
'
s
SAML token i
s
ne
eded.
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
Sec
u
rity
Interac
t
ion of Web Serv
ic
es
in Heteroge
neo
us Platform
s
(Xu Tao
)
2873
Figure 8. Security Policy
Assertion of
Airline Service
3) Security Policy of Trave
l
Service
There are three variabl
es i
n
the ticket rese
rvation se
rvice an
d ea
ch one ha
s a relevant
solutio
n
. By com
b
ining
these th
re
e
solutio
n
s,
a
n
integrat
ed
se
curity p
o
licy asse
rtion
is
gene
rated. A
nd in th
e p
r
o
c
e
s
s of integ
r
ating securi
ty
polici
e
s, it i
s
found th
at th
e airli
ne
se
rvice
need
s the
user’s SAML to
ken th
ro
ugh t
he p
r
edi
cate
token, b
u
t what the u
s
e
r
provide
s
to t
he
travel se
rvice
is use
r
na
me
token. Th
eref
ore,
the username token n
eed
s to be mappe
d as SA
ML
Toke
n.
4.3. Experimental Results
Figure 9
sho
w
s the
SOAP me
ssage
wit
h
SAML to
ke
n captu
r
ed
from the
ai
rline
se
rvice
serve
r
by usi
ng TCP/IP monitor.
Thro
ugh Fig
u
r
e 9 it can be see
n
that the SO
AP messa
ge has b
een
su
ccessfully sign
ed.
And a
c
cordin
g with
the i
n
tegrate
d
se
cu
rity po
licy, th
e tra
n
sfo
r
m
algorith
m
ex
c14n, the
dig
e
s
t
algorith
m
sh
a
1
, the signatu
r
e algo
rithm
s
rsa
s
h
a1 an
d X509 toke
n for sig
natu
r
e a
r
e used.
Figure 9. SOAP
Message
with SAML
T
o
ken
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 4, April 2014: 2868 – 2
874
2874
5. Conclu
sion
In this pap
er, the se
cu
rity issue
s
of We
b
Se
rvice in th
e SOA architecture are st
udied. In
orde
r to solv
e these issu
es, a se
cu
rity inte
ractive model of We
b Service for heterog
ene
o
u
s
platform
s is p
r
opo
se
d. The
model ad
opt
s an ap
pr
oa
ch based on p
r
edi
cate logi
c to integrate the
se
curity p
o
licies
of hete
r
o
gene
ou
s plat
forms,
and
then
uses the
integrated
p
o
licy to
sig
n
the
SOAP messa
ge. By experi
m
ental verifi
cation, this
mo
del can en
su
re the secure
transmissio
n
of
SOAP message. Howeve
r, the illust
ra
tive example
involved in
this pa
per
o
n
ly reali
z
e
s
the
sign
ature
of
messag
e. Fo
r en
cryption
and
acce
ss
control, a
p
p
r
o
p
riate
sol
u
tio
n
metho
d
h
a
s
n
o
t
been p
r
op
ose
d
, which will
be a study e
m
pha
sis in fu
rther
re
sea
r
ch.
Ackn
o
w
l
e
dg
ements
The
wo
rk is su
ppo
rted
by the
Nati
onal
Natu
ral
Scien
c
e
F
ound
ation of
Chi
na:
"Information
Exchang
e in
Civil Aviation Integr
ation
Applicatio
n Base
d on SO
A(No. 60
979
011)"
and Tia
n
jin
Rese
arch P
r
og
ram of Ap
plicati
on Fo
unda
tion and A
d
vanced T
e
ch
n
o
logy: "Secu
r
ity
Tech
nolo
g
y Re
sea
r
ch o
n
Informatio
n Exchan
ge
in Service
-
Ori
ented A
r
chite
c
ture
(No.
09JCYBJC0
2
300)".
Referen
ces
[1]
Chai Xia
o
lu. W
eb
Service T
e
chnolog
y,
A
r
chitec
ture
an
d App
licati
ons.
Beiji
ng: El
ectronic In
dust
r
y
Press (in Ch
in
ese). 200
3; 6-9
.
[2]
Sam W
eber, P
aul
a Austel, Mi
chae
l McIntosh
.
A Fram
ework
for Multi-Platform
SOA Secur
i
ty Analyses
.
Procee
din
g
s of
IEEE Internationa
l C
onf
erenc
e on Web Serv
ice. 200
7; 102-
109.
[3]
Jin S
ongc
ha
n
g
, Jin
So
ngh
e
,
Yang
Sh
uqi
a
ng, et
al.
Desi
gn
of a
Para
ll
el
and
Distri
b
uted
Net
w
or
k
Securit
y
Simulation P
l
atform.
T
e
lko
m
nik
a
In
don
esia
n Jo
ur
nal
of Electrica
l
Engi
ne
erin
g
, 201
3, 11(6)
:
317
8-31
86.
[4] John
Vi
eg
a.
Why Apply
i
ng St
and
ards to W
eb Services is n
o
t Enoug
h
. Proceedings of IEEE Securit
y
and Priv
ac
y
.
2
006; 25-
31.
[5]
Ji Ho
ngb
in, Z
hao F
e
ng
yu,
Xu
T
ao.
Secu
rity Policy
Co
nfigur
ation
An
alysis for W
e
b Servic
es o
n
Hetero
gen
eo
u
s
Platfor
m
s
. Pr
ocee
din
g
s
of Internati
o
n
a
l
Co
nf
erenc
e
on S
e
rvice
Scie
nce,
Man
agem
en
t
and En
gi
neer
in
g. 2010; 1
82-1
85.
[6]
Gao Yan, Z
h
a
ng Sha
o
x
in, Z
han
g Bin. SO
A-Based W
eb
Services Com
positi
on S
y
ste
m
.
Journal of
Chin
ese C
o
mp
uter Systems
.
200
7; 28(4): 72
9-73
3.
[7]
Rob
e
rt Bung
e, Sam Chu
ng, B
a
rbar
a End
i
cot
t
Popovsk
y
,
et al.
An Operati
o
nal F
r
a
m
ew
ork
for Service
Oriented
Archit
ecture
Netw
ork Secur
i
ty
. Proc
eed
ings
of th
e
41st
Ha
w
a
ii
Internati
o
n
a
l
C
onfere
n
ce
o
n
S
y
stem Sci
enc
es. 2008; 3
12-
320.
[8]
Ma Anfeng, Z
hao F
e
n
g
y
u. On axis
2 W
e
b
Service Secu
rit
y
Base
d on
Ramp
art Modu
le.
Co
mp
ute
r
Appl
icatio
ns an
d Softw
are
. 2009; 26(9): 3
1
-3
3.
[9]
Steve Resn
ick, Richar
d Cra
n
e
,
Chris Bo
w
e
n.
Ess
ential W
i
n
d
o
w
s C
o
mmun
i
catio
n
F
oun
da
tion. Beij
in
g:
Posts &
T
e
leco
m Press (in Ch
ines
e). 200
9; 21-25.
[10]
Xu T
ao, Yi Ch
un
xi
ao.
SOAP-Based S
e
curit
y
Interaction of
W
eb Service i
n
Hetero
ge
neo
us Platforms
.
Journ
a
l of Infor
m
ati
on Sec
u
rit
y
. 2011; 2(1): 1
-
7.
[11]
Xu T
ao, Yi Chun
xiao.
Si
gna
ture and E
n
cryption o
n
Part
s of SOAP Messag
e
Base
d
on Ra
mp
art
.
Procee
din
g
s o
f
2nd Internati
ona
l Conf
eren
ce on
Intell
ig
e
n
t S
y
stems an
d Appl
icatio
ns.
2010; 1
218-
122
3.
[12]
Muhamm
ad I
mran T
a
riq. T
o
w
a
r
d
s Inform
ation
Se
c
u
rit
y
Metrics F
r
am
e
w
ork f
o
r C
l
o
ud
Comp
utin
g.
Internatio
na
l Journ
a
l of Clo
ud
Computi
ng a
n
d
Services Sci
ence
. 20
12; 1(
4): 209-2
17.
Evaluation Warning : The document was created with Spire.PDF for Python.