XML Security — A Comparative Literature Review <s> Discussion <s> W3C has been working on the standardization of XML Encryption and released its specification as a W3C Proposed Recommendation in 2002. There are several implementations of the specification, all of which are implemented using DOM. However, it is commonly accepted that DOM has higher costs in time and space than other APIs. Also, even if SAX is used, with this kind of API, it is impossible to parse decrypted data both efficiently and correctly. Therefore, we thought of using the Xerces Native Interface (XNI) of Xerces2. Using this API, we prototyped a stream-based implementation of the specification. We also evaluated its performance. As compared with a DOM-based implementation, it achieves a 0.27%--26% reduction in processing time (i.e., 1.0x-1.3x performance) for encryption of XML documents with sizes larger than 2 KB, and 34%-88% (i.e., 1.5x-8.5x) for decryption of XML documents with any sizes. <s> BIB001 </s> XML Security — A Comparative Literature Review <s> Discussion <s> Mobile Grid, or Wireless Grid Services refers to value-added Grid Service by processing in Mobile environment. Besides Mobile Internet the traditional Internet computing is experiencing a conceptual shift from Client-Server model to Grid and Peer-to-Peer computing models. As these trends, Mobile Internet and the Grid, are likely to find each other the resource constraints that Wireless devices pose today affect the level of interoperability between them. The goal of this paper is to investigate how well the most limited Wireless devices can make use of Grid Security Services. This paper describes a novel security approach on Mobile Grid Services to validate certificate based on current Mobile XML Web Services Platform environment using XKMS (XML Key Management Specification) and SAML (Security Assertion Markup Language), XACML (extensible Access Control Markup Language) in XML Security mechanism. <s> BIB002 </s> XML Security — A Comparative Literature Review <s> Discussion <s> Signatures of SOAP/XML messages were necessary to enforce the security. This paper proposes an approach to accelerate the process of validating signatures of Web service calls. We developed a quick XML parser (QXP). The QXP is motivated by Xerces, but QXP outperforms Xerces ranging from 7 to 21 times speedup in the two benchmark programs. <s> BIB003 </s> XML Security — A Comparative Literature Review <s> Discussion <s> The XML signature specification provides a rich and flexible message signature model for XML documents, and it has been adopted by SOAP applications to provide message-level security. However, the XML signature design introduces a number of complex processing steps, such as canonicalization and XPath filtering, that often lead to performance and scalability problems when encountering extremes of size and rate in the processing of XML. In this paper, we focus on the performance of validating large signed XML messages, as might be sent by a scientific application using grid Web services. We present the design and implementation of the GHPX/SSSV system for the streaming validation of SOAP digital signature. Our model consists of a streaming canonicalization and optimized SOAP signature validation. We present an empirical study of the performance characteristics of these streaming validation features. Based on our evaluations we conclude that the streaming validation model can not only provide high performance, but is also memory efficient. <s> BIB004 </s> XML Security — A Comparative Literature Review <s> Discussion <s> In the past, multi-agent systems were used in proprietary environments. Nowadays, these systems have been used broadly in open distributed networks, such as e-commerce applications for Internet. An environment such as the Internet cannot be considered a safe place. Thus, multi-agent systems should have security mechanisms, e.g. confidentiality and integrity. The XML security specifications are standards that are based on XML and provide security mechanisms. They include: XML digital signature for digital signature; XML encryption for cryptography; XML key management specification for public key infrastructure. Agents may use a FIPA (foundation for intelligent physical agents) standard called RDF(resource description framework), which is a message content standard in XML language. Using this standard, agents can communicate exchanging XML messages, but these messages are not secure. In this article, we propose a secure communication model for agents based on RDF and the XML security specifications <s> BIB005
The present analysis provided some interesting results, but also several new questions were raised. Why is performance still felt as the biggest disadvantage of XML Security even though since 2002 ideas and implementations for faster processing of Canonicalization are existing BIB001 ? In fact, stream-based parsers deliver better results than DOM-based and implementations are available for both XML Signature and Encryption. The current state of the art are parsers, published in 2005 by BIB003 and BIB004 , who can perform Canonicalization while parsing. Hereby the best results at simulations could be achieved. In the literature no disadvantage of this alternative implementation could be found. At least in performance-critical applications there is no reason for using DOM. It seems that not everyone knows that XML Security represents only a basic framework whose adaptation into different fields is expected. Several articles show that this adaptation is possible in different ways throughout the whole XML field. It is a fact that XML is very redundant and has large overhead due to its structure. Nevertheless XML evolves into the most important format for data exchange in distributed networks. It would contradict the basic idea of XML to change its design and abandon flexibility by integrating a technology like XML Security. Security has its own price, especially if other requirements also have to be met. The mentioned flexibility can turn out to be very important since no security algorithm offers security forever. With the provided structure it is possible to react to changing conditions. There is little criticism on the security itself. Only the missing proof of the XKMS Public Key's integrity is an essential issue of XML Security. Published in 2005, the actuality of the standard causes this critique and the XTASS Working Group is already bothered with the solution of this problem. Another big challenge is the presentation problem for which  and  ) offer promising methods of resolution. For this issue the integration of XForms and XML Signature, announced in  , has already been realised. The XForms recommendation , published by the W3C in March 2006, supports all features of XML Security including transformations. This solves not only the presentation problem, but also an improvement on displaying was achieved. The more it is astonishing that in scientific literature no reference on this work appears since 2003. Nonetheless it remains to be seen if further security problems will arise due to the emerging appliances in big industry systems. In the application field a trend toward Mobile and Grid solutions is evident. As proved in the hypotheses, the correlation between XML Security and Web Services is recognizably high. While this has been predictable, systems without central management can especially benefit from XML Security. Using the example of Grid Systems you can see that selforganisation is not a trivial requirement in the security area. Nevertheless this can be achieved satisfactorily by using the present standards. Taking these approaches, Multi-agent systems (working autonomously over distributed channels) can also benefit from the addressed advantages of XML Security BIB005 . However the work on this subject is still just beginning due to the fact that articles exist since the end of 2006. The usage of XML Security can cause further increase to both emerging technologies, Grid and Multi-agents Systems. For Grid Systems, this was already anticipated in BIB002 , in case of Multi-agent Systems this prediction is even more evident since they are built upon XML-based RDF-model.