JAVA webservice教程4.pdfVIP

Strategies for Securing Web Services Jim Ducharme Director of Development Netegrity, Inc. Session 1372 Overall Presentation Goal Provide an understanding of the issues around securing Web services and some of the technologies and solutions being developed to help address them 2 Session 1372 Learning Objectives • As a result of this presentation, you will be able to: – Understand some of the key concepts of application security – Understand how these concepts apply to Web services and what issues arise – Learn about new technologies and solutions being developed to address these issues – Understand how these technologies and solutions can be leveraged in a centralized model 3 Session 1372 Agenda • What do we mean by security? • Access Control and identity management – Authentication techniques – Hosted identity services – Sharing user identity information • Secure content • Centralized access control model 4 Session 1372 What Is Security? • Access control – Identity management—Who are your users? – Authentication—verifying user identity – Authorization—what a user can do – Auditing—keep track of what a user does • Secure communication – Keeping the conversation between two parties private 5 Session 1372 Identity Management Knowing Who Your Users Are • Profile information • Authentication information • Shared secret • Public key information • Certificate information • Authorization entitlements • Gold card member • Administrator • Web servi