Developing message-based trust model for Web applications

The Web application security challenge is to understand and assess the risk involved in securing a Web service today, based on existing security technology, and at the same time track emerging standards and understand how they will be used to offset the risk in new Web services. Any trust model must illustrate how data can flow through an application and network topology to meet the requirements defined by the business without exposing the data to undue risk. In this paper we propose a mechanism for each entity in Web application to provide authentication data, based on the service definition, and for the service provider to retrieve those data. We also show how XML digital signatures and encryption can be exploited to achieve a level of trust. Because of the importance of Web services in modern Web applications and the important role of message in it, our focus is message level security in Web services.