基于SOAP信息交互时间戳机制研究与仿真.docxVIP

摘要Web Services作为下一代电子商务的核心已经得到了广泛的应用，但随之而来的问题也日益突出。SOAP作为Web Services技术的核心协议，承载着Web Services安全的绝大部分责任，而SOAP标准在制定过程中，安全方面成了突出的问题，因此需要在SOAP消息加入时间戳来解决。本文首先分析了SOAP协议及原理，然后将研究集中在SOAP消息传递中的安全性研究，从而设计了在SOAP消息中加入时间戳，以此满足在电子商务中电子文档的时间确定性问题。时间戳除了用于对数据在某一特定时刻的存在性进行时间举证外，它还具有唯一性的特点。于是，本文通过对SOAPHeader的扩展，将时间戳应用到SOAP消息的交换过程中。本次设计基于SOAP时间戳工作流程即：请求-签发-查证进行系统设计，达到了增强SOAP消息传递安全框架抵御抵赖和抗重放攻击的能力目的。关键词：SOAP；时间戳；不可否认性；抗重放攻击AbstractWeb Services at the core of the next generation of e-commerce has been widely used, but the resulting problem is increasingly outstanding. SOAP at the core of Web Services technology agreement, carrying most of Web Services security responsibility, the SOAP standard in develop process, security problems become prominent, so you need to add a timestamp.This article first analyzes the SOAP protocol and the principle, and then will study focused on the SOAP messaging in the safety study, so as to design the timestamp in the SOAP message, to satisfy the electronic documents in the electronic commerce time uncertainty problems. Timestamp except for the existence of data at a particular moment in time proof, it also has the characteristics of uniqueness. Then, this article through to the expansion of the SOAP headers, apply timestamp to the SOAP message exchange process. This design is based on SOAP timestamp workflow: request - issued - check for system design, to achieve enhanced SOAP messaging security framework against denial and the ability to resist replay attacks.Key word: SOAP;Time-Stamps;Non-Repudiation; Anti-Replay Attacks1 绪论1.1研究的背景与意义SOAP是在分布式环境中交换信息的简单协议。相对于COM和CORBA而言，它更简单，使用的范围更广泛。1998年，Userland Soft-ware、Microsoft和Develop Mentor公司起草了最初的SOAP规范。之后，Develop Mentor、Rogue Wave’s Nou-veau ORB、Frontier、IONA Portal Suite等公司都公开声明了支持SOAP协议的计划。2000年6月，Microsoft公司宣布了.Net计划，它提供了一种在网络中传递结构化信息的方法。SOAP正是其核心概念、网络服务的实现基础。简单对象访问协议(SOAP)定义了用XML和HTTP访问服务、对象和服务器的方法,是一个将不同类型的软件组件连接起来的协议。其主要目的是促进不同技术之间的可互用性,真正克服平台和防火墙的限制,使通信各方在互联网上实现畅通无阻的信息交流。要在整个互联网范围内实现程序间的远程调用和信息传递，挖掘出现有技术