理工大学学士学位论文PAGEXXIPAGEXXI学士学位论文基于SOAP信息通信加密传输机制研究摘要论文在研究基于SOAP信息通信加密传输机制的基础上，充分研究了XML加密组件、XML签名组件和访问控制组件。论文主要通过把XML加密组件在Python中集成实现，提高了Web服务通信的安全性。本文首先对Web服务及其关键技术SOAP、WSDL、UDDI、XML和WS-Security规范等进行了研究。然后，结合二进制安全令牌对XML签名组件进行了研究，该组件为消息提供了完整性，由于安全令牌传输的数字证书代表了用户的身份，签名组件同时还能提供身份验证和不可否认性。结合WS-Security规范设计实现了XML加密组件，该组件满足了SOAP消息的机密性。此外，为了适应Web服务动态性和开放性的要求，论文结合更加灵活的基于角色的访问控制模型，对基于角色授权的访问控制组件进行了研究，该组件能够为服务提供授权，它通过以角色为中介，实现了用户权限与资源访问的映射，降低了授权管理的复杂度。最后，通过Python软件，结合RSA算法对XML加密传输进行了设计、实现以及测试，最后通过对经过安全处理后的消息进行分析，验证了论文所设计的安全组件的安全性和可行性。关键词：Web服务；XML签名；XML加密；基于角色的访问控制AbstractWiththeresearchofamechanismforSOAP-basedcommunicationencryptedtransport,XMLEncryptioncomponent,XMLSignaturecomponentandaccesscontrolcomponentaredesignedandimplementedinthisthesis.ThesecurityforWebServicescommunicationsisimprovedbyintegratingandimplementingtheseseparatesecuritycomponentsbyPython.Firstly,Thesetheoriesarestudied,includingWebServices,SOAP,WSDL,UDDI,XMLandWS-securitystandardinthisthesis.Secondly,XMLSignaturecomponentisdesignedandimplementedcombinedwithbinarysecuritytoken.Thecomponentprovideintegrity,andalsoauthentication,non-repudiation,becausetheuser’sidentityisincludedindigitalcertificationsofsecuritytoken;CombinedwithWS-Securitystandard,XMLEncryptioncomponentisdesignedwhichensurestheconfidentialityoftheSOAPmessages;TomeetthedynamicandopennatureofWebServices,arole-basedaccesscontrolcomponentisdesignedandimplementedcombinedwiththemoreflexiblerole-basedaccesscontrolmodel.Thecomponentprovidesauthorizationforservicesandrealizedsthemappingofuser’spermissionandresources,sothecomplexityofauthorizedmanagementisreduced,bymakingroleasintermediaries.Thirdly,ThroughthePythonsoftware,combinedwithRSAalgorithmontheXMLencryptiontransmissionwasdesigned,implementedandtested,andfinallythroughtheanalysisofthesecurityafterprocessingthemessage,verifythesafetyandfeasibilityofthedesignofthesecuritycomponent.Keywords:WebServices,XMLSignature,XMLEncryption,Role-BasedAccessCont