基于SOAP信息通信加密传输机制研究学士学位论文.doc

理工大学学士学位论文 PAGE XXI PAGE I PAGE XXI 学士学位论文 基于SOAP信息通信加密传输机制研究 摘 要 论文在研究基于SOAP信息通信加密传输机制的基础上，充分研究了XML加密组件、XML签名组件和访问控制组件。论文主要通过把XML加密组件在Python中集成实现，提高了Web服务通信的安全性。 本文首先对Web服务及其关键技术SOAP、WSDL、UDDI、XML和WS-Security规范等进行了研究。然后，结合二进制安全令牌对XML签名组件进行了研究，该组件为消息提供了完整性，由于安全令牌传输的数字证书代表了用户的身份，签名组件同时还能提供身份验证和不可否认性。结合WS-Security规范设计实现了XML加密组件，该组件满足了SOAP消息的机密性。此外，为了适应Web服务动态性和开放性的要求，论文结合更加灵活的基于角色的访问控制模型，对基于角色授权的访问控制组件进行了研究，该组件能够为服务提供授权，它通过以角色为中介，实现了用户权限与资源访问的映射，降低了授权管理的复杂度。最后，通过Python软件，结合RSA算法对XML加密传输进行了设计、实现以及测试，最后通过对经过安全处理后的消息进行分析，验证了论文所设计的安全组件的安全性和可行性。 关键词：Web服务；XML签名；XML加密；基于角色的访问控制 Abstract With the research of a mechanism for SOAP-based communication encrypted transport,XML Encryption component,XML Signature component and access control component are designed and implemented in this thesis.The security for Web Services communications is improved by integrating and implementing these separate security components by Python. Firstly,These theories are studied,including Web Services,SOAP,WSDL,UDDI,XML and WS-security standard in this thesis.Secondly,XML Signature component is designed and implemented combined with binary security token.The component provide integrity,and also authentication,non-repudiation,because the user’s identity is included in digital certifications of security token;Combined with WS-Security standard,XML Encryption component is designed which ensures the confidentiality of the SOAP messages;To meet the dynamic and open nature of Web Services,a role-based access control component is designed and implemented combined with the more flexible role-based access control model.The component provides authorization for services and realizeds the mapping of user’s permission and resources,so the complexity of authorized management is reduced,by making role as intermediaries.Thirdly,Through the Python software, combined with RSA algorithm on the XML encryption transmission was designed, implemented and tested, and finally through the analysis of the security after