Architecting Secure Web Services using Model Driven Agile Modeling

摘要

The importance of the software security has been profound, since most attacks to software systems are based on vulnerabilities caused by poorly designed and developed software. Design flaws account for fifty percent of security problems and risk analysis plays essential role in solid security problems. Service Web Services are an integral part of next generation Web applications. The development and use of these services is growing at an incredible rate, and so too security issues surrounding them. If the history of inter-application communication repeats itself, the ease with which web services architectures publish information about applications across the network is only going to result in more application hacking. At the very least, its going to put an even greater burden on web architects and developers to design and write secure code. Developing specification like WS-Security should be leveraged as secure maturity happens over firewalls. In this paper, we want to discuss security architectures design patterns for Service Oriented Web Services. Finally, we validated this by implementing a case study of a Service Oriented Web Services application StockTrader Security using WS-Security and WS-Secure Conversation.