WSDL (see [29]) In order to bind to a web services, its network end points (operations and binding) and the (SOAP) structure of input and output message can be described using the Web Services Description Language (WSDL). More precise, WSDL is a W3C note that defines a model and the XML notation to describe web services to support ease of use by the following elements: The element describes the messages that can be received and send by the web service The element contains information about the functionality of the web “interface” service The element has the information of how to access the web service “binding” The element provides the actual network endpoint where the web service “service” can be accessed WSDL 2.0 supports a full HTTP binding including GET / POST (/ DELETE / PUT / etc.) and SOAP. WS-Addressing (see [30]) Web Services Addressing is a W3C Recommendation that supersedes the WS-Referral & initiatives by Microsoft. It specifies a transport neutral mechanism to communicate addressing information for messages and service endpoint references. Using SOAP and HTTP(/HTTPS) the sender relies on TCP/IP to route the message to the right receiver. Once delivered, the receiver uses information from the SOAP message itself to figure out what to do with the message. WS-Addressing allows to disconnect this relationship by inserting metadata information (structured in XML) into the SOAP Header. Looking at it from a security point of view, this enables communication partners to securely exchange synchronous but more important asynchronous (unsolicited) messages. In order to ensure a trusted processing, XML Digital Signature can be applied to make WS-Addressing metadata tamper resistant and authentic. In Services Policy Attachment for Endpoint Reference (see [31]) is “Web described, how to use WS-Policy (see [32]) Information into the Endpoint Reference provided by WS-Addressing. This enables to express service security requirements that ought to be met in order to access (execute) the referenced service.
WSDL (see [29]) In order to bind to a web services, its network end points (operations and binding) and the (SOAP) structure of input and output message can be described using the Web Services Description Language (WSDL). More precise, WSDL is a W3C note that defines a model and the XML notation to describe web services to support ease of use by the following elements: The element describes the messages that can be received and send by the web service The “interface” element contains information about the functionality of the web service The “binding” element has the information of how to access the web service The “service” element provides the actual network endpoint where the web service can be accessed WSDL 2.0 supports a full HTTP binding including GET / POST (/ DELETE / PUT / etc.) and SOAP. WS-Addressing (see [30]) Web Services Addressing is a W3C Recommendation that supersedes the WS-Referral & initiatives by Microsoft. It specifies a transport neutral mechanism to communicate addressing information for messages and service endpoint references. Using SOAP and HTTP(/HTTPS) the sender relies on TCP/IP to route the message to the right receiver. Once delivered, the receiver uses information from the SOAP message itself to figure out what to do with the message. WS-Addressing allows to disconnect this relationship by inserting metadata information (structured in XML) into the SOAP Header. Looking at it from a security point of view, this enables communication partners to securely exchange synchronous but more important asynchronous (unsolicited) messages. In order to ensure a trusted processing, XML Digital Signature can be applied to make WS-Addressing metadata tamper resistant and authentic. In “Web Services Policy Attachment for Endpoint Reference (see [31]) is described, how to use WS-Policy (see [32]) Information into the Endpoint Reference provided by WS-Addressing. This enables to express service security requirements that ought to be met in order to access (execute) the referenced service.
ARE3NA-AAA_D112&D122_AAA-for-Data-and-Services_For-Review.docx