SOAP Messages Research Articles

Evaluation mechanism of local universities’ faculty construction based on SOAP technology

Abstract Accelerating the construction of a high-quality faculty that can adapt to the development of schools is one of the important issues facing universities today. In this paper, we build a comprehensive evaluation system for university teachers based on SOAP technology and hierarchical analysis, adding new security feature elements to the extended namespace of SOAP messages to achieve the system’s ability to handle access control, data confidentiality, and integrity. The system uses hierarchical analysis to hierarchize complex problems, decomposing them into different constituent factors according to the problem and the goals to be achieved and aggregating and combining the factors at different levels according to their interconnectedness and affiliation to form a multi-level analysis structure model. Using this system to analyze the teaching evaluation of college teachers and the six factors of teaching, we get a combined 91.35 and 84.35 for teacher 1 and teacher 2, respectively. From the comparison results, we can see that the teaching effect of Teacher 1 is generally higher than the other five factors, and the teaching attitude of Teacher 1 is lower than the other five factors, which shows that the teaching of Teacher 1 can achieve a good teaching effect. Therefore, the comprehensive evaluation system of college teachers established in this paper based on SOAP technology and hierarchical analysis method has good practicality.

Digital Signature with RSA Public Key Cryptography for Data Integrity in SOSE-Based E-Government Systems

Purpose: SOSE is a novel software paradigm suitable for development of flexible, loose-coupled and end-to-end E-government system. However, the use of this innovation for E-government system is dwindled by security challenge. Apparently, the TLS (transport layer security) solution traditionally applied to protect SOSE-based E-government systems is inadequate since it can only secure point-to-point channels of communicating. Whereas, an end-to-end security protection is necessary to adequately protect SOSE-based applications. Design/Methodology/Approach: Consequently, this paper proposed use of Digital Signature by RSA (Rivest-Shamir-Adleman) public key cryptographic algorithm at the message level to achieve data integrity in SOSE-based E-government system. Findings/Result: The SOAP message content shows adequate formulation of digital signature with appropriate indicators of RSA public key to ensure data integrity. The SOAP message shows that SignedInfo, Signature Value and KeyInfo were formulated correctly. The SignedInfo contains Canonicalization Method, Signature Method and Reference subelements. Also, SignatureValue element has encrypted digest and the KeyInfo element has security token reference. Originality/Value: This security solution integrates many technologies including OASIS’s web service security standard and W3C’s (World Wide Web Consortium) XML digital signature into SOAP envelope to ensure data integrity for E-government system at the message level. Paper Type: Applied Research.

XML Encryption and Signature for Securing Web Services

In this research, we have focused on the most challenging issue that Web Services face, i.e. how to secure their information. Web Services security could be guaranteed by employing security standards, which is the main focus of this search. Every suggested model related to security design should put in the account the securities' objectives; integrity, confidentiality, non- repudiation, authentication, and authorization. The proposed model describes SOAP messages and the way to secure their contents. Due to the reason that SOAP message is the core of the exchanging information in Web Services, this research has developed a security model needed to ensure e-business security. The essence of our model depends on XML encryption and XML signature to encrypt and sign SOAP message. The proposed model looks forward to achieve a high speed of transaction and a strong level of security without jeopardizing the performance of transmission information.

XML Encryption and Signature for Securing Web Services

In this research, we have focused on the most challenging issue that Web Services face, i.e. how to secure their information. Web Services security could be guaranteed by employing security standards, which is the main focus of this search. Every suggested model related to security design should put in the account the securities' objectives; integrity, confidentiality, non- repudiation, authentication, and authorization. The proposed model describes SOAP messages and the way to secure their contents. Due to the reason that SOAP message is the core of the exchanging information in Web Services, this research has developed a security model needed to ensure e-business security. The essence of our model depends on XML encryption and XML signature to encrypt and sign SOAP message. The proposed model looks forward to achieve a high speed of transaction and a strong level of security without jeopardizing the performance of transmission information.

AN ONTOLOGY-BASED APPROACH FOR DETECTING SOAP MESSAGE ATTACKS

An ontology-based detection approach aiming to check SOAP messages for XML rewriting attacks is presented. The approach comprises a SOAP message ontology and a set of policy filters. The ontology is used in preserving the message structure including its constituent elements and their relationships. The policy filters check if the message complies with denial-of-service vulnerability restrictions. Message integrity is preserved using the ontology-based checker, which checks that the message has not been modified during the transmission process. Message confidentiality is preserved by encrypting a copy of the message in a log file combined with the message. Time efficiency is achieved by executing the policy filters in a concurrent manner.

A Proposed SOAP Model in WS-Security to Avoid Rewriting Attacks and Ensuring Secure Conversation

Service oriented architecture is a current and popular software engineering paradigm providing agile web services to consumers in a dynamically changing enterprise environment. The SOAP messages are used to establish communication between the web services which are vulnerable to rewriting attacks and insecure conversation. XML Signature as specified in WS-Security provides security to the contents of the SOAP messages but is insufficient. This paper proposes a SOAP model where rewriting attacks can be avoided and a secure conversation can be established as well. This paper recommends three steps, firstly using shared key for encrypting timestamp in the message body for generating corresponding signature; Secondly, using value referencing both for signature validation and message processing; and finally encrypting the whole SOAP body instead of sending an open SOAP Message in the network to prevent unauthorized access. The paper concludes that the proposed model successfully detects rewriting attacks and establishes secure conversation in the to-and-fro message transmission.

An Ontology-Based Approach for Detecting SOAP Message Attacks

An ontology-based detection approach aiming to check SOAP messages for XML rewriting attacks is presented. The approach comprises a SOAP message ontology and a set of policy filters. The ontology is used in preserving the message structure including its constituent elements and their relationships. The policy filters check if the message complies with denial-of-service vulnerability restrictions. Message integrity is preserved using the ontology-based checker, which checks that the message has not been modified during the transmission process. Message confidentiality is preserved by encrypting a copy of the message in a log file combined with the message. Time efficiency is achieved by executing the policy filters in a concurrent manner.

An Ontology-Based Approach for Detecting Soap Message Attacks

An Ontology-Based Approach for Detecting Soap Message Attacks

A New Partitioning Algorithm to Enhance Performance of SOAP Message Security Processing

A New Partitioning Algorithm to Enhance Performance of SOAP Message Security Processing

Secure model for soap message communication in web services

Simple object access protocol (SOAP) is the communication protocol used by web services to communicate between systems. Since SOAP messages have the ability to bypass firewalls and directly get processed by web servers, their security is critical to the security of the web servers. Secure transit of SOAP messages plays a critical role for the applicability of web services. At present, internet users authenticate themselves using credential are vulnerable to security threats in presence of active attackers. This imposes a burden on users to manage their credentials in different ways. Along with the thorough development and application for web services, the security of it has taken people's attention more and more. While web services security (WSS) can exchange safe SOAP message and enhance the security of web services, it will also have certain influence to the performance of web services. This paper explore the security vulnerability of SOAP message transaction and taking advantage of the existing technologies and solutions related to SOAP and web services, we developing a highly developed security model. This model is useful for solving the problem between security and performance contradiction.

Cyber security for wireless semantic (SCADA/DCS) systems

Supervisory control and data acquisition and distributed control systems named (SCADA/DCS) have played a key role in the design of modern power smart applications, particularly in the automatic management of real-time energetic platforms. In this work, we present a semantic cyber security vulnerabilities add to classic one, with the use of semantic embedded application in smart devices in semantic wireless (SCADA/DCS) systems, focusing on the semantic attacks. In this work, we present a new security semantic wireless protocol as a secure communication support for these modern semantic wireless systems named (ZIGBEE/SOAP/SECURITY), obtained by the combination between wireless ZIGBEE protocol, SOAP protocol and the integration of our security mechanism, in the global message header obtained by the fusion between ZIGBEE message and SOAP message.

Cyber security for wireless semantic (SCADA/DCS) systems

Supervisory control and data acquisition and distributed control systems named (SCADA/DCS) have played a key role in the design of modern power smart applications, particularly in the automatic management of real-time energetic platforms. In this work, we present a semantic cyber security vulnerabilities add to classic one, with the use of semantic embedded application in smart devices in semantic wireless (SCADA/DCS) systems, focusing on the semantic attacks. In this work, we present a new security semantic wireless protocol as a secure communication support for these modern semantic wireless systems named (ZIGBEE/SOAP/SECURITY), obtained by the combination between wireless ZIGBEE protocol, SOAP protocol and the integration of our security mechanism, in the global message header obtained by the fusion between ZIGBEE message and SOAP message.

A Mobile Cloud Middleware to Support Mobility and Cloud Interoperability

With the recent advances in cloud computing and the improvement in the capabilities of mobile devices in terms of speed, storage, and computing power, Mobile Cloud Computing (MCC) is emerging as one of important branches of cloud computing. MCC is an extension of cloud computing with the support of mobility. In this paper, the authors first present the specific concerns and key challenges in mobile cloud computing. They then discuss the different approaches to tackle the main issues in MCC that have been introduced so far, and finally focus on describing the proposed overall architecture of a middleware that will contribute to providing mobile users data storage and processing services based on their mobile devices capabilities, availability, and usage. A prototype of the middleware is developed and three scenarios are described to demonstrate how the middleware performs in adapting the provision of cloud web services by transforming SOAP messages to REST and XML format to JSON, in optimizing the results by extracting relevant information, and in improving the availability by caching. Initial analysis shows that the mobile cloud middleware improves the quality of service for mobiles, and provides lightweight responses for mobile cloud services.

A Black-Box Approach to Detect Vulnerabilities in Web Services Using Penetration Testing

Web services work over dynamic connections among distributed systems. This technology was specifically designed to easily pass SOAP message through firewalls using open ports. These benefits involve a number of security challenges, such as Injection Attacks, phishing, Denial-of-Services (DoS) attacks, and so on. The difficulty to detect vulnerabilities,before they are exploited, encourages developers to use security testing like penetration testing to reduce the potential attacks. Given a black-box approach, this research use the penetration testing to emulate a series of attacks, such as Cross-site Scripting (XSS), Fuzzing Scan, Invalid Types, Malformed XML, SQL Injection, XPath Injection and XML Bomb. In this way, was used the soapUI vulnerability scanner in order to emulate these attacks and insert malicious scripts in the requests of the web services tested. Furthermore, was developed a set of rules to analyze the responses in order to reduce false positives and negatives. The results suggest that 97.1% of web services have at least one vulnerability of these attacks. We also determined a ranking of these attacks against web services.

Privacy Issues in SOAP Message Exchange Pattern for Social Services

A Web service is defined as an autonomous unit of application logic that provides either some business functionality or information to other applications through an Internet connection. Web services are based on a set of eXtensible Markup Language XML standards such as Universal Description, Discovery and Integration UDDI, Web Services Description Language WSDL, and Simple Object Access Protocol SOAP. Nowadays Web services are becoming more and more popular for supporting different social applications, thus there are also increasing demands and discussions about Web services privacy protection in information. In general, privacy policies describe an organization's data practices on what information they collect from individuals e.g., consumers and what e.g., purposes they do with it. To enable privacy protection for Web service consumers across multiple domains and services, the World Wide Web Consortium W3C published a document called “Web Services Architecture WSA Requirements” that defines some specific privacy requirements for Web services as a future research topic. This paper presents a mathematical model to construct the privacy policies in SOAP Message Exchange Patterns MEP for social services. Further, this paper also presents the privacy policies in security tokens with SOAP messages.

Tagged-Sub Optimal Code (TSC) Compression for Improving Performance of Web Services

Abstract Compression can be used to reduce the size of files and speeding up the transmission time over networks. However, not all compression techniques have the same features and capabilities to improve the performance of transmission over networks. This paper shows a comparison between different compression algorithms in order to improve the performance of web-services over the Internet. Nowadays, Service Oriented Architecture (SOA) being used heavily between applications as interaction between loosely coupled services, which are function independently. Therefore, fast and efficient services offered through the web services are needed. Enhancing performance of web services, would improve overall system's performance. As a result, compressing and reducing the size of SOAP messages traveling over the network, improves the webs-service performance. This paper compares the performance of web-services by compressing SOAP messages using Tagged Sub-optimal Code (TSC) and Huffman Encoding Algorithms. Experimental results show that web-services compressed using TSC speeds up the performance of web-services compared to normal web-services and web-services compressed using Huffman encoding.

An Online Jewelry Cert Print Service Based on Web Service

For implementing jewelry cert print in the web environment, based on web service and ActiveX technology, an online jewelry cert print service is proposed by encapsulation the jewelry cert print module running in the local network environment. The service can implement the cert typesetting and batch print, and can communicate soap message with other web services. The practicability and validity of the online jewelry cert print service is verified through the application in the jewelry inspection business management system.

An Online Balance Weigh Service Based on Web Service

For implementing jewelry weigh with balance in web environment, based on web service, an online balance weigh service is developed by encapsulating RS232 interface with ActiveX technology, and then other web services can call the weigh service to get quality of jewelry ornament with SOAP message request. Practicability and validity of the online balance weigh service is verified through the application in jewelry business management system.

TECHNOLOGY OF FEDERATED IDENTITY AND SECURE LOGGINGS IN CLOUD COMPUTING

Federated services are becoming widely implemented at many sites in multiple domain networks for cloud computing across many industry segments. New technology is required not only for federated authentication, but also for services operating distributed attributes, which are both static and dynamic. In addition to the technology, the sites that provide services across multiple domain networks are required to store every log as audit trails. This paper focuses on SAML and ID-WSF, which are the technology and the architecture for identity management and secure web services, discusses deployments and problems in the real world, then proposes a fast and safe technology that extends the ID-WSF for services and logs. To verify the effectiveness of the proposed technology and architecture, the latencies of SAML SSO that exchange SOAP messages are measured and considered in a cloud computing environment.

Security Interaction of Web Services in Heterogeneous Platforms

Currently, there are a large number of heterogeneous platforms. The standards of Web Services in different platforms are different and complex. Therefore, security interaction of Web services based on heterogeneous platform has become increasingly prominent. In order to realize security interaction of heterogeneous platforms, a security interactive model of Web Service based on WebSphere and .NET is proposed in this paper. The model adopts an approach based on predicate logic to integrate the security policies of heterogeneous platforms and uses the integrated policy to sign the SOAP message. The experimental results show that the model can ensure the safety of SOAP message transmission and realize the security session between these two heterogeneous platforms. DOI : http://dx.doi.org/10.11591/telkomnika.v12i4.4734