Secure SOAP Requests in Enterprise SOA

Web service specifications (WS*) have been designed with the aim of being composable to provide a rich set of tools for secure, reliable, and/or transacted web services. Due to the flexibility of SOAP-level security [1] mechanisms, web services may be vulnerable to a distinct class of attacks based on the malicious interception, manipulation, and transmission of SOAP messages, which are referred to as XML rewriting attacks [2]. Although WS-Security, WS-Policy and other related standards theoretically can prevent XML rewriting attacks, in practice, incorrect use of these standards may make web services vulnerable to XML rewriting attacks. All WS* security related specifications, however, introduce new headers in SOAP messages. So concerns about the operational performance of Web services security are legitimate because added XML security elements not only make use of more network bandwidth but also demand additional CPU cycles at both the sender side and at the receiver side. Therefore it is desirable to examine the performance issue of Web services security. The main achievements of this work are that we explore XML rewriting attacks [2] against web services. We propose measures detecting these attacks built on the idea of adding additional SOAP structure information. We further evaluate the performance of the proposed solution against the existing state of the art. We discuss how this work is related to Enterprise SOA, SAP’s implementation of Service Oriented Architectures.