background image

Message Security Mechanisms

<< message-layer security | Web Services Security Initiatives >>
<< message-layer security | Web Services Security Initiatives >>
M
ESSAGE
S
ECURITY
M
ECHANISMS
235
services security, this chapter presents a brief introduction to using both the WSS
and XWSS functionality that is incorporated into the Sun Java System Applica-
tion Server.
This chapter includes the following topics:
· Message Security Mechanisms (page 235)
· Web Services Security Initiatives and Organizations (page 236)
· Using Message Security with Java EE (page 241)
Message Security Mechanisms
Encryption is the transformation of data into a form that is as close to impossible
as possible to read without the appropriate knowledge, which is contained in a
key. Its purpose is to ensure privacy by keeping information hidden from anyone
for whom it is not intended, even those who have access to the encrypted data.
Decryption is the reverse of encryption; it is the transformation of encrypted data
back into an intelligible form.
Encryption and decryption generally require the use of some secret information,
referred to as a key. For some encryption mechanisms, the same key is used for
both encryption and decryption; for other mechanisms, the keys used for encryp-
tion and decryption are different.
Authentication is as fundamentally a part of our lives as privacy. We use authen-
tication throughout our everyday lives - when we sign our name to some docu-
ment for instance - and, as we move to a world where our decisions and
agreements are communicated electronically, we need to have electronic tech-
niques for providing authentication.
The "crypt" in encryption and decryption is cryptography. Cryptography pro-
vides mechanisms for providing authentication, which include encryption and
decryption, as well as digital signatures and digital timestamps. A digital signa-
ture
binds a document to the possessor of a particular key, while a digital times-
tamp
binds a document to its creation at a particular time. These cryptographic
mechanisms can be used to control access to a shared disk drive, a high security
installation, or a pay-per-view TV channel.
Authentication is any process through which one proves and verifies certain
information. Sometimes one may want to verify the origin of a document, the
identity of the sender, the time and date a document was sent and/or signed, the
identity of a computer or user, and so on. A digital signature is a cryptographic