Web Service Security

Security
WebService is used in a wide range of fields as a convenient service and has become a good dish for hackers. Here, this article will briefly introduce the improvements that can be made to WebService security.
Security in WebService is divided into the following three aspects.
Encrypted connections over SSL/HTTPS instead of Data Transmission
Message Data Encryption (XML encryption) digital signature (XML-DSIG)
Underlying architecture utilizes Application Service Security Mechanisms

The security during transmission is the easiest way to be added to your WebService application. Using the existing SSL and HTTPS protocols, you can easily obtain the security during connection.

However, this security implementation method has two weaknesses. First, it can only ensure the security of data transmission, rather than the security of data itself. Once data arrives somewhere, it can be viewed by anyone. In WebService, a piece of data may arrive at multiple places, but the data should not be viewed by all recipients. Second, it provides either full or no protection. You cannot choose which part of the data to be protected. This kind of selectivity is also frequently used in WebService.

The second layer protects messages. You can use the existing XML security extension standard to implement the digital signature function, so that your message is not modified by a specific party. XML file encryption technology enhances the security of WebService to a greater extent. It can customize whether the data can be viewed by the recipient after transmission, further improving the security after transmission, the industry is constantly developing security standards for WebServices, such as SAML and WS-Security.

The last layer of protection relies on the security of the underlying architecture, which is more from the protection of the operating system and some middleware. For example, in J2EE, the Web service application server is hosted. Currently, many J2EE application servers support Java authentication and authorization Service (JAAS), which was recently added to j2se 1.4. It is natural to use the server hosting WebService to implement some security mechanisms. Another security method that uses the underlying architecture is to create an independent server responsible for security, and users and creators of WebService need to gain security trust.