Mechanics of user identification and authentication: Fundamentals of identity management

Mechanics of User Identification and Authentication: Fundamentals of Identity Management

Volumn , Issue , 2007, Pages 1-729

  Todorov, Dobromir ^a  

^a NONE

Author keywords

[No Author keywords available]

Indexed keywords

NETWORK SECURITY; PROCESS CONTROL;

ACCESS TO RESOURCES; ADVANCED APPLICATIONS; AUTHENTICATION , AUTHORIZATION , AND ACCOUNTINGS; AUTHENTICATION ARCHITECTURE; AUTHENTICATION MECHANISMS; SPECIFIC INFORMATION; USER AUTHENTICATION; USER IDENTIFICATION;

AUTHENTICATION;

EID: 85048576281     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1201/9781420052206     Document Type: Book

References (155)

1. I. Applied Cryptography, second edition, Bruce Schneier, ISBN 0-471-11709-9.
2. II. DCE/RPC over SMB, Luke Leighton, ISBN: 1578701503.
3. III. The Art of Deception: Controlling the Human Element of Security, Kevin D. Mitnick, ISBN 0471237124.
4. IV. Practical UNIX and Internet Security, second edition, Simson Garfinkel and Gene Spafford, ISBN: 1-56592-148-8.
5. V. Microsoft Windows Server(TM) 2003 Resource Kit, by Microsoft Windows Server Team, ISBN: 0735622329.
6. VI. Microsoft Windows Security Resource Kit, second edition, by Ben Smith and Brian Komar, ISBN: 0735621748.
7. VII. IPSec VPN Design, by Vijay Bollapragada, Mohamed Khalid, and Scott Wainner, ISBN: 1587051117.
8. VIII. Cisco Wireless LAN Security, by Andrew Balinsky, Darrin Miller, Krishna Sankar, and Sri Sundaralingam, ISBN: 1587051540.
9. 2 Guide to the CISSP Exam, by Susan Hansche, John Berti, and Chris Hare, ISBN: 084931707X.
10. X. HP-UX 11i Security, by Chris Wong, ISBN: 0130330620.
11. XI. Hacking Exposed, second edition, by Joel Scambray, Stuart McClure, and George Kurtz, ISBN: 0072127481.
12. XII. Building Enterprise Active Directory™ Services: Notes from the Field, by Microsoft Corporation, ISBN: 0-7356-0860-1.
13. MIT Athena Project: http://web.mit.edu/ist/topics/athena/index.html
14. DNSSEC How-to, Olaf Kolkman: http://www.ripe.net/projects/disi/dnssec_howto/dnssec_howto.pdf
15. PADL Software Pty Ltd.: www.padl.com
16. Windows 2000 Active Directory Display Specifiers: http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/deploy/prodspecs/actvdspl.mspx
17. The MD5 Message-Digest Algorithm: http://www.ietf.org/rfc/rfc1321.txt?number=1321
18. The Linux-PAM System Administrators' Guide: http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam.html
19. Making Login Services Independent of Authentication Technologies: http://www.sun.com/software/solaris/pam/pam_ste_talk.pdf
20. Open Software Foundation, Request For Comments: 86, V. Samar (SunSoft), R. Schemers (SunSoft): http://www.kernel.org/pub/linux/libs/pam/pre/doc/rfc86.0.txt.gz
21. The MD4 Message-Digest Algorithm, R. Rivest, MIT Laboratory for Computer Science and RSA Data Security, Inc., April 1992: http://www.ietf.org/rfc/rfc1320.txt?number=1320
22. An Attack on the Last Two Rounds of MD4, den Boer & Bosselaers, 15 Oct. 1991: http://citeseer.ist.psu.edu/denboer91attack.html
23. TechNet Webcast: Passwords Demystified-Level 200: https://www118.livemeeting.com/cc/mseventsbmo/viewRecordings? id=1032253148&role=attend&pw=webcast
24. BindView Security Advisory: Vulnerability in Windows NT's SYSKEY feature: http://archives.neohapsis.com/archives/ntbugtraq/1999-q4/0067.html
25. Windows NT password hash retrieval, Jeremy Allison: http://www.insecure.org/sploits/WinNT.passwordhashes.deobfuscation. html
26. Microsoft Windows 2003 TechCenter — Privileges: http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/589980fb-1a83-490e-a745-357750ced3d9.mspx
27. The Essentials of Replacing the Microsoft Graphical Identification and Authentication Dynamic Link Library: http://download.microsoft.com/download/b/7/b/b7b59bf4-f585-4f74-b342-251e9b075115/msgina.doc
28. Microsoft Knowledge Base — PSS ID Number: 289246; MS02-001: Forged SID Could Result in Elevated Privileges in Windows NT 4.0: http://support.microsoft.com/default.aspx?scid=kb;EN-US;q289246
29. Microsoft Knowledge Base — PSS ID Number: 289243; MS02-001: Forged SID Could Result in Elevated Privileges in Windows 2000: http://support.microsoft.com/default.aspx?scid=kb;EN-US;q289243
30. Platform SDK: Active Directory Schema — User Class: http://msdn.microsoft.com/library/en-us/adschema/adschema/c_user.asp?frame=true
31. Definition of the inetOrgPerson LDAP Object Class, M. Smith, April 2000: http://www.ietf.org/rfc/rfc2798.txt?number=2798
32. Microsoft Knowledge Base — PSS ID Number: 269190: How to Change a Windows 2000 User's Password through LDAP: http://support.microsoft.com/default.aspx?scid=kb;EN-US;q269190
33. Microsoft Knowledge Base — PSS ID Number: 321051: How to Enable LDAP over SSL with a Third-Party Certification Authority: http://support.microsoft.com/default.aspx?scid=kb;en-us;321051
34. Microsoft Knowledge Base — PSS ID Number: 843587: How to Stop Automatic Conversion of Universal Distribution Groups to Universal Security Groups in Exchange 2000 and in Exchange 2003: http://support.microsoft.com/default.aspx?scid=kb;en-us;843587
35. Platform SDK: Active Directory Schema — Group Class: http://msdn.microsoft.com/library/en-us/adschema/adschema/c_group.asp?frame=true
36. Platform SDK: Active Directory Schema — Computer Class: http://msdn.microsoft.com/library/en-us/adschema/adschema/c_computer.asp?frame=true
37. Microsoft Knowledge Base — PSS ID Number: 238793: Enhanced Security Joining or Resetting Machine Account in Windows 2000 Domain: http://support.microsoft.com/default.aspx?scid=kb;en-us;238793
38. Microsoft Knowledge Base — PSS ID Number: 154501: How to Disable Automatic Machine Account Password Changes: http://support.microsoft.com/default.aspx?scid=kb;en-us;154501
39. Microsoft Knowledge Base — PSS ID Number: 299656: How to prevent Windows from storing a LAN manager hash of your password in Active Directory and local SAM databases: http://support.microsoft.com/default.aspx?scid=KB;EN-US;q299656
40. CacheDump homepage: http://www.off-by-one.net/misc/cachedump.html
41. Microsoft MSDN: Platform SDK: Active Directory Schema: DS-Heuristics: http://msdn.microsoft.com/library/en-us/adschema/adschema/a_dsheuristics.asp?frame=true
42. Kerberos Protocol Transition and Constrained Delegation: http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/constdel.mspx
43. Microsoft Knowledge Base — PSS ID Number: 184017: Administrators can display contents of service account passwords in Windows NT: http://support.microsoft.com/default.aspx?scid=KB;en-us;q184017
44. MSDN Library > Win32 and COM Development > Security > Authentication > Authentication Reference > Authentication Structures > CREDENTIAL: http://msdn.microsoft.com/library/en-us/secauthn/security/credential.asp?frame=true
45. Windows Server 2003 Technical Reference > How Service Publication and Service Principal Names Work: http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/96725ab2-02a8-4c7e-8e0e-d298ec304e3b.mspx
46. Platform SDK: Active Directory Schema — trustedDomain Class: http://msdn.microsoft.com/library/en-us/adschema/adschema/c_trusteddomain.asp?frame=true
47. MSDN Home > MSDN Magazine > August 2000 > Explore the Security Support Provider Interface Using the SSPI Workbench Utility: http://msdn.microsoft.com/msdnmag/issues/0800/security/
48. Kerberos working group — Internet Draft: The Microsoft Windows 2000 RC4-HMAC Kerberos encryption type, M. Swift, J. Brezak: http://ietfreport.isoc.org/idref/draft-brezak-win2k-krb-rc4-hmac/
49. “Read First” Release Notes, Microsoft Windows 2000: High Encryption Pack: http://www.microsoft.com/windows2000/docs/encread-RTM.txt
50. Microsoft Knowledge Base — PSS ID Number: 823659: Client, service, and program incompatibilities that may occur when you modify security settings and user rights assignments: http://support.microsoft.com/kb/823659
51. Request for Comments 2831: Using Digest Authentication as a SASL Mechanism: http://www.ietf.org/rfc/rfc2831.txt
52. The ActiveX Core Technology Reference — Chapter 11: NTLM: http://www.opengroup.org/onlinepubs/009899899/NCH1222X. HTM#ntlm.2.8
53. Microsoft Knowledge Base — PSS ID Number: 828861: Cluster service account password must be set to 15 or more characters if the NoLMHash policy is enabled: http://support.microsoft.com/default.aspx?scid=kb;en-us;828861
54. Microsoft Windows NT Security Support Provider Interface (Downloadable Document): http://www.microsoft.com/ntserver/techresources/security/SecSupp Interface.asp
55. Request for Comments 2478: The Simple and Protected GSS-API Negotiation Mechanism: http://www.ietf.org/rfc/rfc2478.txt?number=2478
56. MSDN Home > MSDN Library > Win32 and COM Development > Security > Authentication > About Authentication > SSPI: http://msdn.microsoft.com/library/en-us/secauthn/security/sspi.asp?frame=true
57. MSDN Home > MSDN Library > Win32 and COM Development > Security > Exploring S4U Kerberos Extensions in Windows Server 2003: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnkerb/html/MSDN_PAC.asp
58. Microsoft Windows SDK > Authentication > Authentication Reference > Authentication Functions > LsaLogonUser: http://windowssdk.msdn.microsoft.com/library/en-us/secauthn/security/lsalogonuser.asp?frame=true
59. Microsoft Knowledge Base — PSS ID Number 102716: User Authentication with Windows NT: http://support.microsoft.com/kb/102716/en-us
60. Eric Glass, The NTLM Authentication Protocol: http://davenport.sourceforge.net/ntlm.html
61. Microsoft Knowledge Base — PSS ID Number: 239869: How to enable NTLM 2 authentication: http://support.microsoft.com/default.aspx?scid=KB;en-us;239869
62. Request for Comments: 2743: Generic Security Service Application Program Interface, Version 2, Update 1: http://www.ietf.org/rfc/rfc2743.txt?number=2743
63. Request for Comments: 1964: The Kerberos Version 5 GSS-API Mechanism: http://www.ietf.org/rfc/rfc1964.txt?number=1964
64. Request for Comments: 1998: The Simple and Protected GSS-API Negotiation Mechanism: http://www.ietf.org/rfc/rfc1998.txt?number=1998
65. Microsoft MSDN: Platform SDK: Authentication: SSPI/Kerberos Interoperability with GSSAPI: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthn/security/sspi_kerberos_interoperability_with_gssapi.asp
66. RFC 2554: SMTP Service Extension for Authentication: http://www.ietf.org/rfc/rfc2554.txt?number=2554
67. RFC 2222: Simple Authentication and Security Layer (SASL): http://www.ietf.org/rfc/rfc2222.txt?number=2222
68. RFC 1731: IMAP4 Authentication Mechanisms: http://www.ietf.org/rfc/rfc1731.txt?number=1731
69. RFC 1734: POP3 AUTHentication command: http://www.ietf.org/rfc/rfc1734.txt?number=1734
70. RFC 2195: IMAP/POP AUTHorize Extension for Simple Challenge/Response: http://www.ietf.org/rfc/rfc2195.txt?number=2195
71. RFC 2829: Authentication Methods for LDAP: http://www.ietf.org/rfc/rfc2829.txt
72. RFC 2831: Using Digest Authentication as a SASL Mechanism: http://www.ietf.org/rfc/rfc2831.txt
73. INTERNET-DRAFT: Anonymous SASL Mechanism: http://www.ietf.org/internet-drafts/draft-ietf-sasl-anon-05.txt
74. RFC 1460: Post Office Protocol — Version 3: http://www.ietf.org/rfc/rfc1460.txt?number=1460
75. RFC 2617: HTTP Authentication: Basic and Digest Access Authentication: http://www.ietf.org/rfc/rfc2617.txt
76. RFC 2595: Using TLS with IMAP, POP3 and ACAP: http://www.ietf.org/rfc/rfc2595.txt?number=2595
77. RFC 2060: INTERNET MESSAGE ACCESS PROTOCOL-VERSION 4rev1: http://www.ietf.org/rfc/rfc2060.txt?number=2060
78. INTERNET-DRAFT: The LOGIN SASL Mechanism: http://ietfreport.isoc.org/idref/draft-murchison-sasl-login/
79. Carnegie Mellon University — Computing Services: Cyrus SASL: http://asg.web.cmu.edu/sasl/
80. RFC 1945: Hypertext Transfer Protocol — HTTP/1.0
81. http://www.ietf.org/rfc/rfc1945.txt?number=1945
82. RFC 2616: Hypertext Transfer Protocol — HTTP/1.1: http://www.ietf.org/rfc/rfc2616.txt?number=2616
83. MSDN Library: NET Framework Developer's Guide: Passport Authentication Provider: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconThePassportAuthenticationProvider.asp
84. RFC 2228: FTP Security Extensions: http://www.ietf.org/rfc/rfc2228.txt?number=2228
85. RFC 2941: Telnet Authentication Option: http://www.ietf.org/rfc/rfc2941.txt?number=2941
86. RFC 2942: Telnet Authentication: Kerberos Version 5: http://www.ietf.org/rfc/rfc2942.txt?number=2942
87. RFC 959: File Transfer Protocol (FTP): http://www.ietf.org/rfc/rfc959.txt?number=959
88. RFC 4217: Securing FTP with TLS: http://www.ietf.org/rfc/rfc4217.txt?number=4217
89. RFC 4251: The Secure Shell (SSH) Protocol Architecture: http://www.ietf.org/rfc/rfc4251.txt
90. RFC 4252: The Secure Shell (SSH) Authentication Protocol: http://www.ietf.org/rfc/rfc4252.txt
91. RFC 4256: Generic Message Exchange Authentication for the Secure Shell Protocol (SSH): http://www.ietf.org/rfc/rfc4256.txt
92. RFC 3447: Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1: http://www.ietf.org/rfc/rfc3447.txt
93. U.S. DEPARTMENT OF COMMERCE/National Institute of Standards and Technology: DIGITAL SIGNATURE STANDARD (DSS): http://csrc.nist.gov/publications/fips/fips186-2/fips186-2-change1.pdf
94. Internet-DRAFT: GSSAPI Authentication and Key Exchange for the Secure Shell Protocol draft-ietf-secsh-gsskeyex-10: http://www.ietf.org/internet-drafts/draft-ietf-secsh-gsskeyex-10.txt
95. RFC 1790: An Agreement between the Internet Society and Sun Microsystems, Inc. in the Matter of ONC RPC and XDR Protocols: http://www.ietf.org/rfc/rfc1790.txt?number=1790
96. RFC 1831: RPC: Remote Procedure Call Protocol Specification Version 2: http://www.ietf.org/rfc/rfc1831.txt
97. RFC 2695: Authentication Mechanisms for ONC RPC: http://www.ietf.org/rfc/rfc2695.txt
98. RFC 2203: RPCSEC_GSS Protocol Specification: http://www.ietf.org/rfc/rfc2203.txt
99. RFC 2246: The TLS Protocol Version 1.0: http://www.ietf.org/rfc/rfc2246.txt
100. RFC 1510: The Kerberos Network Authentication Service (V5): http://www.ietf.org/rfc/rfc1510.txt
101. RFC 4120: The Kerberos Network Authentication Service (V5): http://www.ietf.org/rfc/rfc4120.txt
102. Encryption and Checksum Specifications for Kerberos 5: http://www.ietf.org/rfc/rfc3961.txt
103. Advanced Encryption Standard (AES) Encryption for Kerberos 5: http://www.ietf.org/rfc/rfc3962.txt
104. Windows 2000: Kerberos PAC Specification 1.0: http://www.microsoft.com/Downloads/details.aspx?displaylang=en& FamilyID=BF61D972-5086-49FB-A79C-53A5FD27A092
105. Public Key Cryptography for Initial Authentication in Kerberos draft-ietf-cat-kerberos-pk-init-34: http://www.ietf.org/internet-drafts/draft-ietf-cat-kerberos-pk-init-34.txt
106. Microsoft SQL Server Passwords, David Litchfield, NGSSoftware Insight Security Research: http://www.ngssoftware.com/papers/cracking-sql-passwords.pdf
107. Weak Password Encryption Scheme (Modified) in MS SQL Server, K.K. Mookhey, Network Intelligence India Pvt. Ltd.: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0056.html
108. An Assessment of the Oracle Password Hashing Algorithm, Joshua Wright, Carlos Cid: http://www.sans.org/rr/special/index.php?id=oracle_pass
109. Oracle Password Encryption Algorithm?, Newsgroup comp.databases.oracle, Bob Baldwin: http://groups-beta.google.com/group/comp.databases.oracle/msg/83ae557a977fb6ed?hl=en
110. Cisco IOS Password Encryption Facts: http://www.cisco.com/warp/public/701/64.html
111. Enhanced Password Security: http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122t/122t8/ft_md5.htm
112. Cisco password decryption: http://www.insecure.org/sploits/cisco.passwords.html
113. PPP Authentication Protocols: http://www.ietf.org/rfc/rfc1334.txt
114. PPP Challenge Handshake Authentication Protocol (CHAP): http://www.ietf.org/rfc/rfc1994.txt
115. RFC 2433: Microsoft PPP CHAP Extensions: http://www.ietf.org/rfc/rfc2433.txt
116. RFC 2759: Microsoft PPP CHAP Extensions, Version 2: http://www.ietf.org/rfc/rfc2759.txt
117. RFC 2284: PPP Extensible Authentication Protocol (EAP): http://www.ietf.org/rfc/rfc2284.txt
118. RFC 3748: Extensible Authentication Protocol (EAP): http://www.ietf.org/rfc/rfc3748.txt
119. RFC 2716: PPP EAP TLS Authentication Protocol: http://www.ietf.org/rfc/rfc2716.txt
120. Internet Draft: Protected EAP Protocol (PEAP) Version 2: http://ietfreport.isoc.org/all-ids/draft-josefsson-pppext-eap-tls-eap-07.txt
121. Cisco Response to Dictionary Attacks on Cisco LEAP: http://www.cisco.com/en/US/products/hw/wireless/ps430/prod_ bulletin09186a00801cc901.html
122. Internet Draft: EAP Flexible Authentication via Secure Tunnelling (EAP-FAST): http://ftp.isi.edu/internet-drafts/draft-cam-winget-eap-fast-03.txt
123. Internet Draft: Dynamic Provisioning using EAP-FAST draft-cam-winget-eap-fast-provisioning-02.txt: http://ftp.isi.edu/internet-drafts/draft-cam-winget-eap-fast-provisioning-02.txt
124. Overview of 802.11 Security: http://grouper.ieee.org/groups/802/15/pub/2001/Mar01/01154r0P802-15_TG3-Overview-of-802-11-Security.pdf
125. RFC 3610: Counter with CBC-MAC (CCM): http://www.ietf.org/rfc/rfc3610.txt
126. IEEE Std. 802.1x-2004 (Revision of IEEE Std. 802.1x-2001): Port Based Network Access Control: http://standards.ieee.org/getieee802/download/802.1X-2004.pdf
127. RFC 2409: The Internet Key Exchange (IKE): http://www.ietf.org/rfc/rfc2409.txt
128. RFC 4306: Internet Key Exchange (IKEv2) Protocol: http://www.ietf.org/rfc/rfc4306.txt
129. Multiple vulnerabilites in vendor IKE implementations, including Cisco, Dec 12 2003: http://www.securityfocus.com/archive/1/347351
130. DRAFT: The ISAKMP Configuration Method: http://www.vpnc.org/ietf-mode-cfg/draft-dukes-ike-mode-cfg-02.txt
131. DRAFT: Extended Authentication within IKE (XAUTH): http://www.vpnc.org/ietf-xauth/draft-beaulieu-ike-xauth-02.txt
132. RFC 2865: Remote Authentication Dial In User Service (RADIUS): http://www.ietf.org/rfc/rfc2865.txt
133. RFC 2866: RADIUS Accounting: http://www.ietf.org/rfc/rfc2866.txt
134. RFC 1492: An Access Control Protocol, Sometimes Called TACACS: http://www.ietf.org/rfc/rfc1492.txt
135. DRAFT: The TACACS+ Protocol, Version 1.78: ftp://ftp-eng.cisco.com/ftp/pub/tacacs/tac-rfc.1.78.txt
136. RSA Laboratories' Frequently Asked Questions about Today's Cryptography, Version 4.1: http://www.rsasecurity.com/rsalabs/node.asp?id=2152
137. Data Encryption Standard (DES) — U.S. Department of Commerce/National Institute of Standards and Technology: http://csrc.nist.gov/publications/fips/fips46-3/fips46-3.pdf
138. Advanced Encryption Standard (AES) — Questions and Answers: http://csrc.nist.gov/CryptoToolkit/aes/aesfact.html
139. RFC 1319: The MD2 Message-Digest Algorithm: http://www.ietf.org/rfc/rfc1319.txt
140. RFC 1320: The MD4 Message-Digest Algorithm: http://www.ietf.org/rfc/rfc1320.txt
141. US Secure Hash Algorithm 1 (SHA1): http://www.ietf.org/rfc/rfc3174.txt
142. SHA1 Collisions can be Found in 2^63 Operations, Michael Szydlo: http://www.rsasecurity.com/rsalabs/node.asp?id=2927
143. The Keyed-Hash Message Authentication Code (HMAC): http://csrc.nist.gov/publications/fips/fips198/fips-198a.pdf
144. Federal Information Processing Standards Publication 186: Digital Signature Standard (DSS): http://www.itl.nist.gov/fipspubs/fip186.htm
145. A public key cryptosystem and a signature scheme based on discrete logarithms, Elgamal, T.: http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?tp=&arnumber= 1057074&isnumber=22749
146. The S/KEY One-Time Password System, Neil M. Haller: http://citeseer.ist.psu.edu/cache/papers/cs/5967/ftp:zSzzSzftp.mcc.ac. ukzSzpubzSzsecurityzSzPAPERSzSzPASSWORDzSzSKEY.pdf/haller94skey. pdf
147. RFC 3280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile: http://www.ietf.org/rfc/rfc3280.txt
148. RFC 3279: Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile: http://www.ietf.org/rfc/rfc3279.txt?number=3279
149. Setuid Demystified, Hao Chen, David Wagner, Drew Dean: http://www.csl.sri.com/users/ddean/papers/usenix02.pdf
150. Microsoft TechnNet: How Digest Authentication Works: http://technet2.microsoft.com/WindowsServer/en/Library/717b450c-f4a0-4cc9-86f4-cc0633aae5f91033.mspx
151. Security Assertion Markup Language (SAML) V2.0 Technical Overview, Working Draft 09, 20 July 2006: http://www.oasis-open.org/committees/download.php/19258/sstc-saml-tech-overview-2%200-draft-09.pdf
152. W3C Architecture Domain: Extensible Markup Language (XML): http://www.w3.org/XML/
153. W3C Architecture Domain: XML Signature: http://www.w3.org/Signature/
154. W3C Architecture Domain: SOAP Version 1.2 Part 0: Primer: http://www.w3.org/TR/2003/REC-soap12-part0-20030624/
155. Web Services Security: SOAP Message Security 1.1(WS-Security 2004): http://www.oasis-open.org/committees/download.php/16790/wss-v1.1-spec-os-SOAPMessageSecurity.pdf