一种实现RESTful Web服务消息级安全的新方法
A Novel Approach to Implement Message Level Security in RESTful Web Services
摘要：
世界正在迅速采用RESTful Web服务来完成大多数任务。曾经流行的基于SOAP的Web服务正因此而迅速失去市场。RESTful Web服务是轻量级服务，没有严格的消息格式。与SOAP不同，REST风格的Web服务能够以任何格式传输消息，无论是XML、JSON还是纯文本。然而，尽管有这些积极因素，确保REST中的消息级安全性仍然是一个挑战。RESTful Web服务中的安全性在很大程度上仍然依赖于传输层安全性。最近已经有一些工作在这样的环境中的消息级安全性，其中消息级安全元数据的传输是通过利用新的HTTP报头来完成的。然而，我们认为应该避免任何损害HTTP协议通用性的方法。因此，在本文中，我们提出了两种新的加密方法，可以确保RESTful Web服务中的消息级安全性，而无需特殊的HTTP头。这种方法可以无缝地工作在大多数著名的RESTful Web服务的内容类型上：XML，JSON，HTML，纯文本和各种ASCII可打印的内容类型。此外，所提出的方法在内容包括XML、JSON、HTML、纯文本和ASCII可打印内容类型的情况下消除了对内容协商的需要，并且还消除了对XML或JSON规范化的需要。
英文摘要：
The world is rapidly adopting RESTful web services for most of its tasks. The once popular SOAP-based web services are fast losing ground owing to this. RESTful web services are light weight services without strict message formats. RESTful web services, unlike SOAP, are capable of message transfer in any format be it XML, JSON, plain text. However, in spite of these positives, ensuring message level security in REST is a challenge. Security in RESTful web services is still largely dependent upon transport layer security. There has been some work recently towards message level security in such environments wherein the transfer of message level security metadata is done through utilising new HTTP headers. We feel, however, that any method that compromises the generality of the HTTP protocol should be avoided. In this paper, therefore, we propose two new ways of encryption that promise to ensure message level security in RESTful web services without the need for special HTTP headers. This approach works seamlessly on most famous content-types of RESTful web services: XML, JSON, HTML, plain-text and various ASCII printable content types. Further, the proposed approach removes the need for content negotiation in cases where the content comprises XML, JSON, HTML, plain-text, and ASCII printable content types and also removes the need for XML or JSON canonicalization.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
