基于soap信息通信加密传输机制研究学位论文

理工大学学士学位论文

学士学位论文

基于SOAP信息通信加密传输机制研究

I 理工大学学士学位论文

摘 要

论文在研究基于SOAP信息通信加密传输机制的基础上，充分研究了XML加密组件、XML签名组件和访问控制组件。论文主要通过把XML加密组件在Python中集成实现，提高了Web服务通信的安全性。

本文首先对Web服务及其关键技术SOAP、WSDL、UDDI、XML和WS-Security规范等进行了研究。然后，结合二进制安全令牌对XML签名组件进行了研究，该组件为消息提供了完整性，由于安全令牌传输的数字证书代表了用户的身份，签名组件同时还能提供身份验证和不可否认性。结合WS-Security规范设计实现了XML加密组件，该组件满足了SOAP消息的机密性。此外，为了适应Web服务动态性和开放性的要求，论文结合更加灵活的基于角色的访问控制模型，对基于角色授权的访问控制组件进行了研究，该组件能够为服务提供授权，它通过以角色为中介，实现了用户权限与资源访问的映射，降低了授权管理的复杂度。最后，通过Python软件，结合RSA算法对XML加密传输进行了设计、实现以及测试，最后通过对经过安全处理后的消息进行分析，验证了论文所设计的安全组件的安全性和可行性。

关键词：Web服务；XML签名；XML加密；基于角色的访问控制

II 理工大学学士学位论文

Abstract

With the research of a mechanism for SOAP-based communication encrypted transport,XML Encryption component,XML Signature component and access control component are designed and implemented in this thesis.The security for Web Services communications is improved by integrating and implementing these separate security components by Python.

Firstly,These theories are studied,including Web Services,SOAP,WSDL,UDDI,XML and WS-security standard in this thesis.Secondly,XML Signature component is designed and implemented combined with binary security token.The component provide integrity,and also authentication,non-repudiation,because the user’s identity is included in digital certifications of security token;Combined with WS-Security standard,XML Encryption component is designed which ensures the confidentiality of the SOAP messages;To meet the dynamic and open nature of Web Services,a role-based access control component is designed and implemented combined with the more flexible role-based access control model.The component provides authorization for services and realizeds the mapping of user’s permission and resources,so the complexity of authorized management is reduced,by making role as intermediaries.Thirdly,Through the Python software, combined with RSA algorithm on the XML encryption transmission was designed, implemented and tested, and finally through the analysis of the security after processing the message, verify the safety and feasibility of the design of the security component.

Keywords:Web Services,XML Signature,XML Encryption,Role-Based Access Control

III 理工大学学士学位论文

目 录

1 绪论 .......................................................................................................................... 1 1.1 研究背景及意义 ............................................................................................. 1 1.2 国内外研究现状 ............................................................................................. 2 1.3 本文结构 ......................................................................................................... 4 2 Web服务及安全传输机制特性分析 ..................................................................... 6 2.1 Web服务概述 ................................................................................................ 6 2.1.1 Web服务的概念及特征 ......................................................................... 6 2.1.2 Web服务协议栈 ..................................................................................... 8 2.2 SOAP协议分析.............................................................................................. 9 2.3 WS-Security规范 ......................................................................................... 11 2.4 XML技术 ..................................................................................................... 13 2.5 XML签名以及XML加密技术 .................................................................. 14 2.6 WSDL技术 .................................................................................................. 14 2.7 UDDI技术 .................................................................................................... 15 2.8 本章小结 ....................................................................................................... 15 3 基于SOAP信息传输加密机制分析研究............................................................ 16 3.1 密码学理论 ................................................................................................... 16 3.1.1 对称密码体制 ........................................................................................ 16 3.1.2 公开密码体制 ........................................................................................ 17 3.2 密码学技术 ................................................................................................... 18 3.2.1 完整性技术 ............................................................................................ 18 3.2.2 数字签名技术 ........................................................................................ 19 3.2.3 数字证书技术 ........................................................................................ 19 3.3 本章小结 ....................................................................................................... 20 4 基于SOAP信息通信加密传输机制的详细设计................................................ 21 4.1 基于SOAP的Web服务的安全性分析 ..................................................... 21 4.1.1 传统的安全传输机制的不足 ................................................................ 21 4.1.2 基于SOAP的Web服务的安全需求 .................................................. 22

IV