Document Details (Active Version)
Document Name: Secure Communication Profile 1.0 Document ID: doc14937 Description: This document an interoperability profile for the secure SOAP communication with Web service resources. The requirements stated in this profile are concerned with security mechanisms that can be used to ensure authentication, integrity and confidentiality properties for interaction with such resources. This document serves three primary purposes: • To provide a point of further refinement for commonly-used security mechanisms profiled within the WS-I Basic Security Profile 1.0 [WS-I BSP] • To profile the WS-Security Policy 1.2 [WS-SecurityPolicy] language to accommodate the inclusion of actual security tokens within policy documents • To define normative, referenceable, composable policy documents identifying commonly-used security mechanisms. Version Comment: Fixed typo, accepted all changes (made clean). Version Created By: Duane Merrill - 05/01/2008 10:58 AM EDT	Status: Final Current Version: 10 Size: 509 KB Lock:  Unlocked

	Versions		Associations		Review

	Active	Version	Version Comment	Review	Created By	Status
		Version 10	Fixed typo, accepted all changes (made clean).		Duane Merrill - 05/01/2008	Final
		Version 9	Fixed typo, accepted all changes (made clean).		Duane Merrill - 05/01/2008	Draft
		Version 8	Updated to reflect the comments from Public Comment. Changes include: - Minor edits to introduction - Minor edits to conformance targets and well-known polcy documents to reflect their applicability to WS-SecurityPolicy's notion of endpoint and operation policy subjects - Remove FIPS conformance-related requirement - Added large security discussion regarding the security concerns related to binding key information within policy documents, specifically matters of trustworthiness, integrity, and validity - Added confidentiality requirement for using username-token - Added security discussion for password-digest regarding replay to other services - Added profiling of adding a <wsu:Timestamp> element to policy documents to facilitate policy versioning - Added timestamp requirements for X.509 binding - Fixed incorrect policy regarding the type of X.509 tokens specified as the recipient token. (Now enclosed recipient tokens are X.509 PKIPath chains of one or more certificates) -Other minor non-normative edits		Duane Merrill - 04/21/2008	Draft
		Version 7	Minor linguistic edits as per Blair's tracker comments. Also added clarificiations as to SSL/TLS protocol versions (and support for SSL) and the requirement that username-token headers be encrypted.		Duane Merrill - 12/27/2007	Draft
		Version 6	Replace ref table in appendix C.		Hiro Kishimoto - 12/17/2007	Draft
		Version 5	Minor edits for Hiro's suggestions		Duane Merrill - 11/27/2007	Draft
		Version 4	My comments in-line.		Hiro Kishimoto - 11/25/2007	Draft
		Version 3	003: Updates for filename and registered trademark fixes		Duane Merrill - 11/19/2007	Draft
		Version 2	Fixed Typos		Duane Merrill - 11/19/2007	Draft
		Version 1			Duane Merrill - 11/19/2007	Draft

Return     Open Document     < Previous     Next >