|
|
|
VPxM - Security
 For the impatient, here's a diagram of VPxM's multi-layer security.
|
Emerging Web Services Security Standards
|
|
A handful of industry standards bodies including W3C and OASIS have been working diligently to come up with security measures for Web services such as XKMS (XML Key Management Specification) and SAML (Security Assertion Markup Language). Implementation of these emerging security standards however requires significant programmatic and code maintenance effort. While the industry welcomes such initiatives, they are being selectively adopted in a reserved fashion.
|
VPxM's Security Design Principles
|
|
VPxM's security is designed with the following principles in mind:
- Uses of cryptography and authentication technologies that are:
- industry standards compliant
- already proven effective
- No programmatic effort is required so that:
- necessary setup and maintenance work is minimized
- greatest flexibility of message structure is allowed
- any custom security measures within messages can be kept intact
|
Complementary Multi-layer Security Measures
|
|
The followings highlight VPxM's multi-layer security measure:
- At the transport layer, VPxM messaging agents communicate among themselves securely via SSL/TLS (Secure Sockets Layer/Transport Layer Security), with individual VPxM connectors being the trusted servers.
- On the other hand, upon message transmission request from a VPxM sender or VPxM receiver, the connector authenticates the inquiring messaging agent by verifying the digital signature submitted along with the request.
- At the messaging data level, all messages transmitted among the messaging agents are encrypted using PKCS (Public-Key Cryptography Standards) and digitally signed by their owners for authentication. Encryption is applied to each message as a whole, hence requiring no programmatic work while accommodating custom security schemes, if any, within the message body.
- The above security measures operate independently and complement each other:
- Authentication in between a connector and its associated receiver as well as authorized senders is bi-directional via SSL/TLS and on-the-fly digital signature verifications
- While a sender and a receiver hold security information about an encrypted message transmitted between them, the associated connector has no knowledge of how to decrypt it. On the other hand the sender and receiver do not communicate directly with each other.
|
|
