Sanae BEKKAR – My Blog –

SOA implemented by Web services adds a new set of requirements to the security landscape:

• Authentication—Verifying that the user is who she claims to be. A user’s identity is verified based on the credentials presented by that user, such as:
  1. Something one has, for example, credentials issued by a trusted authority such as a passport (real world) or a smart card (IT world).
  2. Something one knows, for example, a shared secret such as a password.
  3. Something one is, for example, biometric information.

  Using a combination of several types of credentials is referred to as « strong » authentication, for example using an ATM card (something one has) with a PIN or password (something one knows).

• Authorization (or Access Control)—Granting access to specific resources based on an authenticated user’s entitlements. Entitlements are defined by one or several attributes. An attribute is the property or characteristic of a user, for example, if « Marc » is the user, « conference speaker » is the attribute.
• Confidentiality, privacy—Keeping information secret. Accesses a message, for example a Web service request or an email, as well as the identity of the sending and receiving parties in a confidential manner. Confidentiality and privacy can be achieved by encrypting the content of a message and obfuscating the sending and receiving parties’ identities.
• Integrity, non repudiation—Making sure that a message remains unaltered during transit by having the sender digitally sign the message. A digital signature is used to validate the signature and provides non-repudiation. The timestamp in the signature prevents anyone from replaying this message after the expiration. For more information.