Vulnerable cloud: SOAP message security validation revisited

2009 IEEE International Conference on Web Services, ICWS 2009

Volumn , Issue , 2009, Pages 625-631

  Gruschka, Nils ^a   Iacono, Luigi Lo ^a  

^a NEC LABORATORIES EUROPE   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

PRACTICAL GUIDELINES; SOAP MESSAGES; SOFTWARE SYSTEMS;

INFORMATION SERVICES; MARKUP LANGUAGES; SERVICE ORIENTED ARCHITECTURE (SOA); SOFTWARE ARCHITECTURE; WEB SERVICES;

SECURITY OF DATA;

EID: 70449472667     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICWS.2009.70     Document Type: Conference Paper

References (25)

1. Amazon Elastic Compute Cloud (EC2).
2. G. Alonso, F. Casati, H. Konu, and V. Machiraju. Web Services. Springer, 2004.
3. S. Anderson, et al. Web Services Trust Language (WSTrust). 2005.
4. S. Anderson and et al. Web Services Secure Conversation Language (WS-SecureConversation). 2005.
5. K. Ballinger, D. Ehnebuske, C. Ferris, M. Gudgin, C. K. Liu, M. Nottingham, and P. Yendluri. Basic Profile Version 1.1. WS-I Organisation, 2004.
6. M. Bartel, J. Boyer, B. Fox, B. LaMacchia, and E. Simon. XML-Signature Syntax and Processing. W3C Recommendation, 2002.
7. K. Bhargavan, C. Fournet, and A. D. Gordon. A semantics for Web Services authentication. Theoretical Computer Science, 340(1):102-153, 2005.
8. K. Bhargavan, C. Fournet, A. D. Gordon, and G. OShea. An advisor for Web Services Security policies. In SWS '05: Proceedings of the 2005 workshop on Secure Web Services, pages 1-9, New York, NY, USA, 2005. ACM Press.
9. D. Box, D. Ehnebuske, G. Kakivaya, A. Layman, N. Mendelsohn, H. F. Nielsen, S. Thatte, and D.Winer. Simple Object Access Protocol (SOAP) 1.1. W3C Note, 2000.
10. T. Erl. Service-Oriented Architecture - Concepts, Technology, and Design. Prentice Hall, 2005.
11. D. C. Fallside and P.Walmsley. XML Schema Part 0: Primer Second Edition. W3C Recommendation, 2004.
12. S. Gajek, L. Liao, and J. Schwenk. Breaking and fixing the inline approach. In Proceedings of the 2007 ACM Workshop on Secure Web Services (SWS'07), pages 37-42, Fairfax, Virginia, USA, November 2007. Association for Computing Machinery.
13. P. Grosso, E. Male, J. Marsh, and N.Walsh. Xpointer framework. W3C Recommendation, 2003.
14. N. Gruschka. Protection Web Service by extended and efficient message validation. PhD thesis, University of Kiel, 2008.
15. N. Gruschka and N. Luttenberger. Protecting Web Services from DoS Attacks by SOAP Message Validation. In Proceedings of the IFIP TC-11 21. International Information Security Conference (SEC 2006), pages 171-182, 2006.
16. N. Gruschka, N. Luttenberger, and R. Herkenhoner. Eventbased SOAP message validation for WS-SecurityPolicyenriched Web Services. In Proceedings of the 2006 International Conference on Semantic Web & Web Services, pages 80-86, 2006.
17. M. Gudgin, M. Hadley, N. Mendelsohn, J.-J. Moreau, and H. F. Nielsen. SOAP Version 1.2 Part 1: Messaging Framework. W3C Recommendation, 2003.
18. M. Gudgin, M. Hadley, and T. Rogers. Web Services Addressing 1.0 - SOAP Binding. W3C Recommendation, May 2006.
19. M. Jensen, N. Gruschka, R. Herkenhöner, and N. Luttenberger. Soa and web services: New technologies, new standards - new attacks. In Proceeding of the 5th IEEE European Conference on Web Services (ECOWS '07), pages 35-44, 2007.
20. C. Kaler and A. Nadalin. Web Services Security Policy Language (WS-SecurityPolicy) 1.1. 2005.
21. M. McIntosh and P. Austel. XML signature element wrapping attacks and countermeasures. In SWS '05: Proceedings of the 2005 workshop on Secure web services, pages 20-27, New York, NY, USA, 2005. ACM Press.
22. M. McIntosh, M. Gudgin, K. S. Morrison, and A. Barbir. Basic security profile version 1.0. WS-I Organisation, 2007.
23. A. Nadalin, C. Kaler, R. Monzillo, and P. Hallam-Baker. Web Services Security: SOAP Message Security 1.1 (WSSecurity 2004). 2006.
24. M. A. Rahaman, A. Schaad, and M. Rits. Towards secure SOAP message exchange in a SOA. In SWS '06: Proceedings of the 3rd ACM workshop on Secure Web Services, pages 77-84, New York, NY, USA, 2006. ACM Press.
25. The Apache Software Foundation. Apache wss4j.