XML Signature Research Articles

XML Encryption and Signature for Securing Web Services

In this research, we have focused on the most challenging issue that Web Services face, i.e. how to secure their information. Web Services security could be guaranteed by employing security standards, which is the main focus of this search. Every suggested model related to security design should put in the account the securities' objectives; integrity, confidentiality, non- repudiation, authentication, and authorization. The proposed model describes SOAP messages and the way to secure their contents. Due to the reason that SOAP message is the core of the exchanging information in Web Services, this research has developed a security model needed to ensure e-business security. The essence of our model depends on XML encryption and XML signature to encrypt and sign SOAP message. The proposed model looks forward to achieve a high speed of transaction and a strong level of security without jeopardizing the performance of transmission information.

New XML Signature Scheme That is Resistant to Some Attacks

Supporting the execution of transactions through the use of electronic documents requires security. The scope of this security primarily involves ensuring the integrity, authenticity and non-repudiation of the origin of information. The signed XML document is a powerful tool that ensures the above features and the ease of processing and integration with various systems. An XML document may have many signatures, and each of them may sign different parts of the document. This feature is highly attractive, but in order to use it, the signature and structure of the document must be carefully designed. This article presents the existing risks associated with the use of XML signatures, focusing on XML signature wrapping vulnerability. This vulnerability is a consequence of the relationship between the XML signature and the signed document. The authors suggest that without neglecting the need for protection against the possibility of moving and replacing a fragment of the document, the use of secure XML signature references should also be considered and applied. The article proposes the use of secure signature templates as a countermeasure against the threat of an improper indication of the signed content defined in the signature reference. This threat is serious in automatic signature processing, where it is important to correctly indicate the signed content.

XML Encryption and Signature for Securing Web Services

In this research, we have focused on the most challenging issue that Web Services face, i.e. how to secure their information. Web Services security could be guaranteed by employing security standards, which is the main focus of this search. Every suggested model related to security design should put in the account the securities' objectives; integrity, confidentiality, non- repudiation, authentication, and authorization. The proposed model describes SOAP messages and the way to secure their contents. Due to the reason that SOAP message is the core of the exchanging information in Web Services, this research has developed a security model needed to ensure e-business security. The essence of our model depends on XML encryption and XML signature to encrypt and sign SOAP message. The proposed model looks forward to achieve a high speed of transaction and a strong level of security without jeopardizing the performance of transmission information.

Spatial Signature Algorithm (SSA): A New Approach in Countermeasuring XML Signature Wrapping Attack

This paper introduces a new approach in countermeasuring XML signature wrapping attack called the Spatial Signature Algorithm (SSA). The motivation for proposing the SSA approach is due to the limitation of the SOAP (Simple Object Access Protocol) in handling the XML signature wrapping attacks. A different strategy is to be planned in order to deter such attack without extensive computational expense. Spatial Signature Algorithm builds upon the notion of ratio signature that is recommended by a research in biotechnology. The research suggests the possibility of diagnosing a specific disease based on the idea of ratios, specifically on the comparative relationship between elements to detect the emergence of certain threats. Bridging this notion to security, the principle of using space and ratio to detect abnormality is extended to the application of spatial information and digital signature to detect and combat the XML wrapping signature attack.

Spatial Signature Method (SSM) Against XML Signature Wrapping Attacks

Living in cyber world with revolutionizes of Industrial 4.0, most of the users and organisations prefer to sell and buy products or services via website online transaction. This online transaction is done through a messaging protocol (SOAP) and signing entire SOAP (SESOAP) using Extensible Markup Language (XML). XML is implemented to secure the SOAP contents by applying the signing method called as XML Digital signature. However, the XML digital signature has issues related to XML signature wrapping (XSW) attacks specifically on Sibling Value Context and Sibling Order Context attacks. Therefore, this paper proposes an enhanced method called as Spatial Signature Method (SSM) which aims to resolve the limitation of SESOAP from the aspect of XSW attacks. It proposes new parameters for XML digital signature inspired by the concept of ratio and space in biotechnology to detect the XSW attacks. The experiment was conducted in a controlled lab by using the Ubuntu Linux system and PHP programming. Based on the comparison made with SESOAP and ID Referencing method (IDR), SSM has proven to defend against the XSW attacks. For the future work, the spatial signature method can be forged with more extensive spatial information for the digital signature and to integrate it with web services.

A Proposed SOAP Model in WS-Security to Avoid Rewriting Attacks and Ensuring Secure Conversation

Service oriented architecture is a current and popular software engineering paradigm providing agile web services to consumers in a dynamically changing enterprise environment. The SOAP messages are used to establish communication between the web services which are vulnerable to rewriting attacks and insecure conversation. XML Signature as specified in WS-Security provides security to the contents of the SOAP messages but is insufficient. This paper proposes a SOAP model where rewriting attacks can be avoided and a secure conversation can be established as well. This paper recommends three steps, firstly using shared key for encrypting timestamp in the message body for generating corresponding signature; Secondly, using value referencing both for signature validation and message processing; and finally encrypting the whole SOAP body instead of sending an open SOAP Message in the network to prevent unauthorized access. The paper concludes that the proposed model successfully detects rewriting attacks and establishes secure conversation in the to-and-fro message transmission.

Survey on Signatured Xml Encryption for Multi-Tier Web Services Security

Web service is the technology tied up with SOAP, UDDI and WSDL of XML format, so web services searching based on XML keyword become essential. By systematic monitoring it has been observed that internet communication is less protected than intranet communication. The transaction exchange held through internet in web which is one among the distributed application is embodied to different vulnerability. In distributed environment, messages and data are exchanged as Extensible Markup Language (XML) format for its vast compatibility in transit. For facing the competitive environment, any business teams have to find their suitable web services among the bulk services prevails in market. In apt to this, survey has been made with different searching techniques and way to boost the security container filled with access permitted service alone. Our research work on XML based Web security is concentrated on providing the privacy, certification and integrity. We investigate the way to regulate and insist the security by applying XML Encryption and Signature for data or messages in transaction and in storage form. It also proves the performance improvement in searching data from vast resources, if so security constraint is provided. Search Engines Optimization (SEO) is enhanced with parsing the descriptive tags rather than chaos data. Traders need not have prior knowledge of web farms lifecycle and its protection.

Security Issues in Web Services: A Evaluation and Advancement Perspective Concerning Research Agenda

Web Service is comparatively emerging and also a significant area. The security challenges concerning Web Services in a dispersed environment are really a significant concern of research. Web service security measures are amongst the steady thrusts aspects of research both in industry as well as in academia. The existing efforts are primarily concentrating on specialized security issues of Web Services. The research is carried out according to the general framework of security issues. It is worthwhile for web service security to completely focus upon subject areas including access control, authentication, consistency in information, and also level of privacy. Security is so essential simply because web services communicate on a program to program factor. Main objective with these recommended efforts would be to explain the approach as well as applications of Multi–Part MultiSignature Document in the work flow environment as well as compares anywhere between XML signature security difficulties with the MPMSD. Furthermore, this work highlights the long term issues with regard to research as well as experimentation underneath the perspective of MPMSD

A Proposal and Evaluation of User Centric Trusted Log Archival Architecture

Internet services of numerous types are widely implemented at countless sites in today’s worldwide computing environment, which is on-premises or cloud computing, and the generated system and application service logs they produce are important for assuring such systems work correctly. When the owners of such logs are auditors or system managers, it has been thought that from the standpoint of manageability, it is better to accumulate logs at one site rather than multiple sites. However, when the owner of a log generated by an application service is a system user, he or she might want to express a preference from the available log archival sites. Furthermore, there are often cases when a service site is located far away from the log archival site. It should also be mentioned that if sites providing services do so in a cloud computing environment, it is particularly necessary to use a secure and fast messaging method between the service and log archival sites. In this paper, we define a “user centric log archival architecture” concept, examine related works and technical specifications, and propose a new trusted model via both abstract and practical methods. By extending the Simple Object Access protocol (SOAP) based Security Assertion Markup Language (SAML), and using SAML assertions, we show how log messages can be exchanged with confidentiality, integrity, and availability, before they are written securely to storage devices. In order to verify the effectiveness of the proposed architecture, the latencies of a XML messages that contain a SAML assertion and a XML signature are measured and considered in a cloud computing environment.

On the insecurity of XML Security

Abstract XML Encryption and XML Signature describe how to apply encryption and signing algorithms to XML documents. These specifications are implemented in a wide range of systems and frameworks processing sensitive data, including banking, eGovernment, eCommerce, military, and eHealth infrastructures. The article presents practical and highly critical attacks which allow to forge signed XML documents or reveal contents of encrypted XML data.

A Stream based Implementation of Secured SOA Model using XML Encryption and XML Signature

A Stream based Implementation of Secured SOA Model using XML Encryption and XML Signature

Choosing Optimal Platform to Host Web Services with XML Signature and XML Encryption

Choosing Optimal Platform to Host Web Services with XML Signature and XML Encryption

A Cross-Layer Security Scheme of Web-Services-Based Communications for IEEE 1451 Sensor and Actuator Networks

IEEE 1451 standard has been proposed to provide a common communication interface and transducer electric data sheet format for wired and wireless distributed applications in smart transducers (sensors and actuators). Currently, a unified Web service for IEEE 1451 smart transducers is a must. However, ensuring the security of web-services-based communications for IEEE 1451 smart transducers is an unsolved problem. In this paper, we proposed a cross-layer security mechanism that deals with the requirements of authentication, integrity, confidentiality, and availability across the communication process in IEEE 1451 smart transducers. The scheme contains three cross-layer components logically, including XML Encryption and Signature, SOAP Security Extension, and Web Services Description Language (WSDL) Security Checking. The former two components satisfy the requirements of confidentiality, availability, integrity, authentication, nonrepudiation, and freshness. The third component satisfies the requirement of availability, which can protect the system against denial-of-service (DoS) attack. The three cross-layer security components are integrated seamlessly in our scheme. To evaluate the overhead, we perform tests to evaluate the effect of message size on the performance of the access inquiry web service. The result supports the usefulness and feasibility of our scheme.

Survey on the Web Services Security Specifications

Web Services security specifications include SSL/TLS (Secure Socket Layer/Transport Layer Security), XML Encryption, XML Signature, WS-Security specification family, PKI-related specifications etc. SSL/TLS are implemented in non-XML frameworks at the transport level, and others are implemented in XML frameworks at the application level. These specifications can satisfy the different requirements of Web Services security (confidentiality, integrity, authenticity, authorization, authentication and nonrepudiation). XML-based specifications are propitious to the integration and interoperability of Web Services security. SSL/TLS is sufficient for the basic generic security of internal Web Services projects. WS-Security is probably overkill, especially with the heavy XML processing that is involved in WS-Security.

Prevention of SQL Injection Attacks having XML Database

XML-based Web applications are broadly utilized in computer world, whose main applications are remote operation performance and bring arbitrary data. It is recently used in cloud interfaces, E-Government, Service Oriented Architectures etc. Due to abundant acceptance of this technology large attacks are raised like Denial of Service attacks, attacks on XML Encryption, and XML Signature Wrapping attacks. To stop these types of attacks different techniques were proposed however they're not enough to stop all varieties of attacks. The existing SQLIA prevention techniques can validate the client side data, one by one. It complicates the developer's task to write different validation codes for each data receiving page in the server. This paper proposed an idea of XML based SQLIA prevention technique which can validate the entire client side data by one single call of the dedicated validation function. In this process, the client will submit data in XML format and the server will verify the entire incoming XML file, based on some pr-decided rules called data-rules.

Offline Data Sharing Model Based on Encrypted XML Files

A confidentiality system generally needs to operate under a non-network environment. Hence, the adoption of an offline model is necessary to realize data sharing. An offline data-sharing model based on encrypted Extensible Markup Language (XML) files is designed. The combination of various techniques, such as XML mode, XML encryption, and XML signature, and the introduction of the Security Solution Support Center enable the proposed model to achieve a safe point-to-point data interactive mode and a security-based software module. The software system based on this model can ensure that data files generated from the data provider could only be identified and verified by the authorized data receiver.

Enhancing Data Security in ERP Projects Using XML

Enterprise resource planning (ERP) is integrated packaged software, which addresses most fundamental business processing functionality across different functional areas and business units, in a single software system, with single database and accessible through a unified interface and channel of communication. Meeting security requirements for privacy, confidentiality and integrity is essential in order to move business online ERP System requires an accurate, precise and Data security in business concepts of the enterprise. The authors introduce basic features and security of ERP System using Extensible Mark-up Language (XML) technology. Traditionally, XML security has developed along two distinct though related lines of research, corresponding to two facts of the XML security notion. The first fact defines XML security as a set of security techniques (encryption, digital signature) tightly coupled with XML to maintain the main features of the XML semi-structured data model while adding to it all necessary security capabilities. In this paper we will explore XML Signature specification from W3C and its implementation in .NET.

Implementation an XML Multi-Signature Scheme for XML Data Authentication

XML signature is used to ensure XML data authentication. An XML multi-signature should satisfy multiple data authentication requirements for XML data which passes a hierarchical network of different responsibilities. Based on presented series-parallel XML multi-signature scheme, the implementation of a series-parallel XML multi-signature scheme is illustrated. The paper describes the algorithm for possible XPath in DTD, algorithm for series-parallel graph converting to sub-signing group, and the presentation for signed results.

Desain Sistem Keamanan Distribusi Data Dengan Menerapkan XML Encryption Dan XML Signature Berbasis Teknologi Web Service

Development of information technologies is often misused by an organization or a person to take criminal acts, such as the ability to steal and modify information in the data distribution for evil criminal purpose. The Rural Bank of Boyolali is conducting online financial transactions rather intensively, thus it requiring a security system on the distribution of data and credit transactions for their customer among branches offices to head office. The purpose of this study was to build a security system in credit transactions in Rural Bank of Boyolali for their customers among branches offices to head office. One way in protecting data distribution was used XML encryption and XML signature. The application of encryption technique in XML and digital signature in XML by using web service by using the AES (Advanced Encryption Standard) and RSA (Rivest-Shamir-Adleman) algorithms. This study was resulted the SOAP (Simple Object Access Protocol) message security system, with XML and WSDL (Web Services Description Language), over HTTP (Hypertext Transfer Protocol) to protect the customers’ credit transactions from intruders. Analysis of examination indicated that the data size (bytes) transferred as results of uncompressed XML encryption were larger than compressed XML Encryption, which leads to significant changes between the data transferred that was the processing time of the compressed data was faster than uncompressed XML encryption.

Redactable Signatures for Signed CDA Documents

The Clinical Document Architecture, introduced by Health Level Seven, is a XML-based standard intending to specify the encoding, structure, and semantics of clinical documents for exchange. Since the clinical document is in XML form, its authenticity and integrity could be guaranteed by the use of the XML signature published by W3C. While a clinical document wants to conceal some personal or private information, the document needs to be redacted. It makes the signed signature of the original clinical document not be verified. The redactable signature is thus proposed to enable verification for the redacted document. Only a little research does the implementation of the redactable signature, and there still not exists an appropriate scheme for the clinical document. This paper will investigate the existing web-technologies and find a compact and applicable model to implement a suitable redactable signature for the clinical document viewer.