A pattern for the WS-SecureConversation standard for web services
Ola Ajaj, Eduardo B. Fernández · 2012
When using web services, the involved parties need to address two main concerns: first, each party needs to determine if it can trust the credentials of the other party; and second, how to protect their data and how to provide a secure session between the parties. WS-Trust takes care of the first challenge by defining how to establish trust between interacting parties, while WS-Security is in charge of the second part by providing message integrity, confidentiality, and authentication. However, web services exchange multiple messages that increase the overhead of key establishment and decrease performance, which eventually affects business interactions. By defining a shared context among the communicating parties for the lifetime of a communications session that combines secure communications and trusted relationship, we facilitate the process of communication and increase overall performance. This shared context is implemented by the WS- SecureConversation standard, and we present here a pattern for it.