为Web服务访问控制构建沙盒模型

本文提出了一种Web 服务访问控制沙盒模型。该模型不仅可以利用传统的身份验证还可以通过扩展SOAP 消息，加入角色信息，利用角色验证来保证Web 服务的访问安全。此外，该模型还提出了一种安全管理器的机制，该机制使得Web 服务创建者和维护者可以更底层更灵活地保障Web 服务访问安全。
关键词：Web 服务；访问控制；信息安全

Access Control Sandbox Model for Web Services Sun Ruijia, Ye Xiaoling, zhang Yingchao，Gao Lianjun (Nanjing University of Information Science& Technology, Nanjing 210044)
【Abstract】This paper proposed an access control sandbox model for Web Services. Rather than basing access on the traditional validation of a client’s identity, the model also takes the roles validation into account via extending the SOAP message by adding roles information to it .Further more, the model also proposed a kind of mechanism of Security Manager. This kind of mechanism makes the Web Services designer and maintainer can maintain the security of the Web Services access through a more low level and more flexible way.
【Key Words】 Web Services; access control; information security