论文信息 - Verifying a Secure Session Protocol for Web Services

Verifying a Secure Session Protocol for Web Services

The security of protocols for Web Services needs to be verified for variety and internal semi-structure of XML messages and composition of standard Web services specifications. Relying on the specifications of WS-Trust and WS-Secure Conversation, a secure session protocol based on trust brokering model has been presented, which protects a SOAP message as well as protects a session between Web services by the derivation of keys. Furthermore, the security of the protocol is verified by using a security analysis tool, AVISPA, which compares with another tool.

Liao Lejian | Ye Xiaolie | Liao Lejian | Ye Xiaolie

[1] Steve Anderson,et al. Web Services Secure Conversation Language (WS-SecureConversation) , 2005 .

[2] Yannick Chevalier,et al. A High Level Protocol Specification Language for Industrial Security-Sensitive Protocols , 2004 .

[3] Bruno Blanchet,et al. An efficient cryptographic protocol verifier based on prolog rules , 2001, Proceedings. 14th IEEE Computer Security Foundations Workshop, 2001..

[4] Luca Viganò,et al. Automated Security Protocol Analysis With the AVISPA Tool , 2006, MFPS.

[5] Sebastian Mödersheim,et al. Symbolic and Cryptographic Analysis of the Secure WS-ReliableMessaging Scenario , 2006, IACR Cryptol. ePrint Arch..

[6] Giovanni Della-Libera,et al. Web Services Trust Language (WS-Trust) , 2002 .

[7] Andrew D. Gordon,et al. Secure sessions for web services , 2007, SWS '04.

[8] Andrew D. Gordon,et al. Verified Interoperable Implementations of Security Protocols , 2006, CSFW.

[9] Andrew D. Gordon,et al. TulaFale: A Security Tool for Web Services , 2003, FMCO.