Abstract

Web Services Security, used to ensure data integrity and confidentiality, has been so far provided and/or implemented as a library or a proxy. Both means present serious drawbacks, be it in terms of flexibility, level of abstraction, dynamic coupling and others. In this thesis we propose the use of Web Services to enforce Web Services Security. Available to both Web Service requestors and providers inside and outside its domain, Security Web Services can provide Web Services Security to many entities, including those that due to limited resources would not be normally able to secure their communications. Specific interfaces were devised for the proposed Security Web Service, giving access to granular security, through a high level interface, without pre-configurations. We also present a Case Study where each entity, participating in a three party transaction, uses either libraries or a Security Web Service to secure their messages. Performance measurements were conducted, both in terms of time delays and network loads. Despite the delay and the network load introduced, Security Web Service are an attractive method of providing WSS due to the high level of level and granularity provided, as well as the reduced local computation load (for encryption and signatures)