Message-Layer Security

Security mechanisms

In this case, there is a message and / or SOAP message attachment.

  • If anyone can translate in simple words (highlighted lines), into Russian, I will be very happy!

  • Not understanding about SOAP in this article; Message-Layer-Security is based solely on the SOAP protocol?

For example, it can be signed by a sender and encrypted for a particular receiver. It will be passed through the intermediate nodes. In this scenario, it can be decrypted only by the intended receiver. For this reason, the message-layer security is not required.

The advantages of the message-layer security include the following.

After the arrival, it arrives at its destination.

If you use XML Web Services Security, to attachments.

Message security can be used with intermediaries over multiple hops.

Message security is independent of the application environment or transport protocol.

It is relatively complex and adds some overhead to processing.

Closed due to the fact that off-topic participants Denis , Cerbo , aleksandr barakin , Nick Volynkin ♦ Jul 25 '16 at 16:18 .

  • Most likely, this question does not correspond to the subject of Stack Overflow in Russian, according to the rules described in the certificate .
If the question can be reformulated according to the rules set out in the certificate , edit it .

  • In simple words, highlighted lines: at the message level, all data that provides message security travels along with the message in the body of the SOAP message or in the attached SOAP data. Well, that is Metadata is not separated from data. - DimXenon
  • I vote for the closure of this issue as not relevant topic, because here is not a translation market. - Cerbo
  • one
    I vote for the closure of this issue, since the site is designed to communicate in Russian - aleksandr barakin

1 answer 1

Yes, the Message-layer security is part of the soap protocol. The translation may sound something like this: in the message-layer security, the security information is contained in the soap message itself and / or the attachment in the soap message, which allows this same security information to travel from server to server along with the soap message or attachment.

An example of such a soap message can be google, for example, in the ibm documentation.

<?xml version="1.0" encoding="UTF8"?> <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"> <SOAP-ENV:Header> <wsse:Security xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" SOAP-ENV:mustUnderstand="1"> <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" 1 ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509" wsu:Id="x509cert00">MIIChDCCAe2gAwIBAgIBADANBgkqhkiG9w0BAQUFADAwMQswCQYDVQQGEwJHQjEMMAoGA1UEChMD SUJNMRMwEQYDVQQDEwpXaWxsIFlhdGVzMB4XDTA2MDEzMTAwMDAwMFoXDTA3MDEzMTIzNTk1OVow MDELMAkGA1UEBhMCR0IxDDAKBgNVBAoTA0lCTTETMBEGA1UEAxMKV2lsbCBZYXRlczCBnzANBgkq hkiG9w0BAQEFAAOBjQAwgYkCgYEArsRj/n+3RN75+jaxuOMBWSHvZCB0egv8qu2UwLWEeiogePsR 6Ku4SuHbBwJtWNr0xBTAAS9lEa70yhVdppxOnJBOCiERg7S0HUdP7a8JXPFzA+BqV63JqRgJyxN6 msfTAvEMR07LIXmZAte62nwcFrvCKNPCFIJ5mkaJ9v1p7jkCAwEAAaOBrTCBqjA/BglghkgBhvhC AQ0EMhMwR2VuZXJhdGVkIGJ5IHRoZSBTZWN1cml0eSBTZXJ2ZXIgZm9yIHovT1MgKFJBQ0YpMDgG A1UdEQQxMC+BEVdZQVRFU0BVSy5JQk0uQ09NggdJQk0uQ09NhgtXV1cuSUJNLkNPTYcECRRlBjAO BgNVHQ8BAf8EBAMCAfYwHQYDVR0OBBYEFMiPX6VZKP5+mSOY1TLNQGVvJzu+MA0GCSqGSIb3DQEB BQUAA4GBAHdrS409Jhoe67pHL2gs7x4SpV/NOuJnn/w25sjjop3RLgJ2bKtK6RiEevhCDim6tnYW NyjBL1VdN7u5M6kTfd+HutR/HnIrQ3qPkXZK4ipgC0RWDJ+8APLySCxtFL+J0LN9Eo6yjiHL68mq uZbTH2LvzFMy4PqEbmVKbmA87alF </wsse:BinarySecurityToken> <xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> 2 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <wsse:SecurityTokenReference> <wsse:Reference URI="#x509cert00" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509"/> 3 </wsse:SecurityTokenReference> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>M6bDQtJrvX0pEjAEIcf6bq6MP3ySmB4TQOa/B5UlQj1vWjD56V+GRJbF7ZCES5ojwCJHRVKW1ZB5 4 Mb+aUzSWlsoHzHQixc1JchgwCiyIn+E2TbG3R9m0zHD3XQsKTyVaOTlR7VPoMBd1ZLNDIomxjZn2 p7JfxywXkObcSLhdZnc=</xenc:CipherValue> </xenc:CipherData> <xenc:ReferenceList> <xenc:DataReference URI="#Enc1"/> </xenc:ReferenceList> </xenc:EncryptedKey> </wsse:Security> </SOAP-ENV:Header> <SOAP-ENV:Body> <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="Enc1" Type="http://www.w3.org/2001/04/xmlenc#Content"> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/> 5 <xenc:CipherData> <xenc:CipherValue>kgvqKnMcgIUn7rl1vkFXF0g4SodEd3dxAJo/mVN6ef211B1MZelg7OyjEHf4ZXwlCdtOFebIdlnK 6 rrksql1Mpw6So7ID8zav+KPQUKGm4+E=</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedData> </SOAP-ENV:Body> </SOAP-ENV:Envelope>
  • I want to clarify the following: So all messages using the SOAP protocol are "secure"? - Maks.Burkov
  • Nothing like that. Most often, message-layer security is not used at all. However, when integrating, for example, with some services, Google will have to figure it out, because they require the support of this technology - Wyvie
  • You can find out why most often this layer is not used? - Maks.Burkov
  • because soap itself is not the easiest and most enjoyable protocol to use, and such precautions usually seem redundant to people, given that http traffic is usually wrapped around ssl. - Wyvie pm