XML Security — A Comparative Literature Review <s> Observation 1: Bad performance and memory inefficiency of XML Security <s> W3C has been working on the standardization of XML Encryption and released its specification as a W3C Proposed Recommendation in 2002. There are several implementations of the specification, all of which are implemented using DOM. However, it is commonly accepted that DOM has higher costs in time and space than other APIs. Also, even if SAX is used, with this kind of API, it is impossible to parse decrypted data both efficiently and correctly. Therefore, we thought of using the Xerces Native Interface (XNI) of Xerces2. Using this API, we prototyped a stream-based implementation of the specification. We also evaluated its performance. As compared with a DOM-based implementation, it achieves a 0.27%--26% reduction in processing time (i.e., 1.0x-1.3x performance) for encryption of XML documents with sizes larger than 2 KB, and 34%-88% (i.e., 1.5x-8.5x) for decryption of XML documents with any sizes. <s> BIB001 </s> XML Security — A Comparative Literature Review <s> Observation 1: Bad performance and memory inefficiency of XML Security <s> Abstract In recent years, the concept of e-Diagnostics and e-Maintenance is proposed in the semiconductor industry. By using Internet and information technologies, e-Diagnostics and e-Maintenance intend to provide equipment specialists with the remote capabilities of connectivity, manipulation, configuration, performance monitoring, and data collection and analysis on equipment to achieve the goal of promptly diagnosing, repairing, and maintaining equipment. In this paper, new-generation information software technologies and object-oriented technologies, such as Web Services, XML signature, XML encryption, UML, etc. are used to develop an e-Diagnostics/Maintenance framework with security considerations. The proposed framework can achieve the automaton of diagnostic processes and the integration of diagnostics and maintenance information under a secure communication infrastructure. <s> BIB002 </s> XML Security — A Comparative Literature Review <s> Observation 1: Bad performance and memory inefficiency of XML Security <s> Security is one of the most important features for grid services. There are several specifications used to add security to grid services, and some of them have been implemented and are in use. However, since most of the security mechanisms involve slow XML manipulations, adding security to grid services introduces a big performance penalty. In this paper, we introduce various security mechanisms and compare their features and performance. Our evaluation shows that transport level security (SSL) is faster than message level security, and should be used if there is no special requirement to use message level security. For message level security, WS-SecureConversation is generally fast, but has a scalability problem. <s> BIB003 </s> XML Security — A Comparative Literature Review <s> Observation 1: Bad performance and memory inefficiency of XML Security <s> Signatures of SOAP/XML messages were necessary to enforce the security. This paper proposes an approach to accelerate the process of validating signatures of Web service calls. We developed a quick XML parser (QXP). The QXP is motivated by Xerces, but QXP outperforms Xerces ranging from 7 to 21 times speedup in the two benchmark programs. <s> BIB004 </s> XML Security — A Comparative Literature Review <s> Observation 1: Bad performance and memory inefficiency of XML Security <s> The XML signature specification provides a rich and flexible message signature model for XML documents, and it has been adopted by SOAP applications to provide message-level security. However, the XML signature design introduces a number of complex processing steps, such as canonicalization and XPath filtering, that often lead to performance and scalability problems when encountering extremes of size and rate in the processing of XML. In this paper, we focus on the performance of validating large signed XML messages, as might be sent by a scientific application using grid Web services. We present the design and implementation of the GHPX/SSSV system for the streaming validation of SOAP digital signature. Our model consists of a streaming canonicalization and optimized SOAP signature validation. We present an empirical study of the performance characteristics of these streaming validation features. Based on our evaluations we conclude that the streaming validation model can not only provide high performance, but is also memory efficient. <s> BIB005 </s> XML Security — A Comparative Literature Review <s> Observation 1: Bad performance and memory inefficiency of XML Security <s> Location-based services refers to value-added service by processing information utilizing mobile user location. With the rapidly increasing wireless Internet subscribers and world LBS market, the various location based applications are introduced such as buddy finder, proximity and security services. As the killer application of the wireless Internet, the LBS has reconsidered technology about location determination technology, LBS middleware server for various application, and diverse contents processing technology. However, there are fears that this new wealth of personal location information will lead to new security risks, and invasion of the privacy of people and organizations. In this paper, we suggest security acceleration methods for fast open LBS using XML signcryption mechanism. And proposed secure LBS security protocols allows a client to offload mobile certificate handling to the server and to enable the central administration of privacy policies. The idea is to create a signcryption technique for software based XML signature acceleration. <s> BIB006 </s> XML Security — A Comparative Literature Review <s> Observation 1: Bad performance and memory inefficiency of XML Security <s> This paper describes the open security architecture for LBS (Location- based Services) platform ensuring interoperability among the wireless networks and various location-based application services and the functional security requirements for the LBS platform. The goal of this paper is to investigate how well the most limited wireless devices can make use of LBS security services. In this paper, we suggest security acceleration methods for high speed open LBS using XML signcryption mechanism. And proposed secure LBS security protocols allows a client to offload mobile certificate handling to the server and to enable the central administration of privacy polices. The idea is to create a signcryption technique for software based XML signature acceleration. <s> BIB007 </s> XML Security — A Comparative Literature Review <s> Observation 1: Bad performance and memory inefficiency of XML Security <s> In this article we evaluate different certificate validation mechanisms to be possibly used within the Wireless Public Key Infrastructure (W-PKI). An implementation of a standard compliant signed content application offering full PKI functionality served as means for evaluating different mechanisms. We compared short-lived certificates, Certificate Revocation Lists (CRLs), the Online Certificate Status Protocol (OCSP) and the XML Key Management Specification (XKMS) with regard to security, interoperability, complexity and performance in terms of size and scalability. The evaluation has lead to propose OCSP for delegated certificate validation. It has to be pointed out though, that OCSP should be enhanced with full delegation capabilities, such as the ones offered by XKMS. <s> BIB008
One of the prior design objectives of XML Security was the flexibility and the expressiveness of this new technology. Thereby the performance was disregarded and apparently left to further development. Thus it is not remarkable that frequently mentioned criticism points are the bad performance and memory inefficiency of the standards. Many implementations use DOMtrees since they can be manipulated more easily. But generally, this is at the expense of time and storage. Canonicalization may require a transformation sequence which involves multiple conversions back and forth between DOM and an octet stream which is a serious problem. BIB003 ) tested this in a performance comparison between XML Signature, SSL and Web Service Security. At the used XSUL (Web Service/XML Service Utility Library) implementation with a fast XML Pull Parser it was found, that Canonicalization required 1391 of 1542 msec for signature generation and 1395 of 1445 msec for verification. All other stages such as the calculation of the digest, the en-or deciphering of it and the path validation are minor matters. A similar test for the evaluation of bottlenecks at XML Signature shows slightly better results BIB004 . For this purpose a SOAP message was signed and verified 500 times at full CPU speed in a DOM-based implementation with XPath. Then the operating time was assigned to four different components (Canonicalization, XPath, Parser, Other). For the generation of the signature, Canonicalization required 37,6% and XPath 21,2% of the time; for verification Canonicalization 47,7% and XPath 31,5%. Even if these values are smaller than computed before -due to the modified test environment -Canonicalization offers enough scope for faster processing. But not only the signature is affected by this problem, also XML Encryption suffers in the same way from the use of Canonicalization BIB001  . BIB007 on the other hand refers the performance problem to the self descriptive structure of XML itself. Due to the inefficient representation of the data, XML based messages are larger and need more operating time than existing protocols as RMI, RMI/IIOP or CORBA/IIOP. BIB008 ) confirms this through an evaluation of certificate validation mechanisms, in which short-lived certificates, CRLs, OCSP and XKMS are compared. The sizes of OCSP's requests and responses are much smaller compared to those of XKMS. Also at the criteria scalability XKMS loses against OCSP. On the opposite side, the interoperability with all XML protocols was mentioned positively. Since the client has to interact with the XKMS service continuously, the management overhead was criticized. On the other side the possibility of the users to decide the degree of trust assertion by themselves is one of the major advantages of XKMS. An example of an e-Diagnostic/Maintenance Framework from the semiconductor industry, which plans to implement XML Security in a Web Service environment, shows how problematic these issues can be BIB002 . By using a system implementation with an integration test the overhead of XML Signature and Encryption was tested. Secured by these two technologies a 100-character string was 600 times slower than unsecured when sending by a Web Service. In this case the bad performance could just still be accepted. Among criticism various works offered different methods of resolution which provide confident results. The most promising approach is probably the use of stream-based parser since they need no time-and memory consuming DOM-trees and explicit node-sets for data representation. BIB001 offers an implementation for XML Encryption and (Lu, K.Chiu, A.Slominski & D.Gannon 2005) describes a stream-based parser for signing SOAP messages. The latter describes the architecture and implementation of the GHPX Parser, a fast generic parser developed for usage in connection with Canonicalization. GHPX was implemented in C++ and offers an interface similiar to SAX, but has the advantage that not the whole parsing context is required. However the most important benefit is that Canonicalization is carried out during parsing. Hence the canonical form is a by-product of this process. The memory consumption of GHPX is almost constant compated to the XML Security Library BIB005 . For generation of the digital signature GHPX calculates the message digest incrementally, i.e the canonical form is written into a buffer. If this is full, the resultant digest is computed and stored as an intermediate result before the rest keeps on being processed. Besides a Streaming SOAP Signature Validator (SSSV), who acts as an intermediary node between GHPX and real application, provides fast verification by recognizing and validating the signatures automatically. The developed test implementation was compared with a Libxml2 implementation, both using SAX2 API for parsing. Due to the recursive parsing of GHPX, Libxml2 has advantages in parsing performance. Canonicalization on the other hand could be accomplished 4 to 5 times faster with GHPX; with larger XML files this performance advantage increases even more. Also signature validation was 6 to 7 times faster with GHPX in combination with SSSV. This can be traced back to the explicit node-sets and the use of DOM-trees of Libxml2. With GHPX memory usage remains constantly while this is increasing arithmetically in case of Libxml2. Without any doubt performance and scalability can be improved by using stream-based parsers. Similiar to GHPX the Quick XML Parser described in BIB004 ) dispenses with the repeated construction of DOM trees. Instead it generates the required byte array directly. Canonicalization is also carried out at parsing by using tables from the Xerces Native Infrastructure (XNI) as temporary data structure. The performance test shows that validation of SOAP messages can be processed 7 to 21 times faster compared to a DOM-based implementation. If the number of validations increases this advantage is even more recognizable. Already 2002 IBM developed together with Apache a stream-based parser for XML Encryption BIB001 . Therefore the flexible architecture of Xerces2 was used and adapted to the given requirements. Xerces2 is built up as a pipeline of different parser components. For XML Encryption the basic configuration XML-> Scanner-> Validator-> Parser-> API was expanded to XML-> Scanner-> Validator-> Encryptor-> Parser-> API in case of encryption and XML-> Scanner-> Decryptor-> Validator-> Parser-> API in case of decryption. The stream-based implementation achieved a 0,27-26% reduction of processing time for encryption of XML documents with sizes larger than 2KB and 34-88% for decryption of XML documents of any size. The best performance for the combination of encryption and decryption is achieved if the size of an XML document is in the range from 100KB to 200KB before encryption. Simulations show that particularly time for decryption can be reduced radically by such developments. Also some articles like BIB003 ) recognized this and defined a stream-based implementation at least as "Future Work". Apart from this general work on improvement of the performance, other application-specific ideas could be found. BIB006 and BIB007 ) outline the mergence of XML Signature and Encryption for Location Based Services (LBS) in mobile environment. Location Based Systems are information services which are accessible over telecommunication networks via mobile devices and have the ability to determine their location. A well-known example of location-oriented services is GPS (General Positioning System). The primary requirement of this emerging technology is the protection of privacy. While this can be guaranteed by using XML Security, the limited bandwith of mobile devices is an existing problem. In order to bring these technologies together in spite of these issues, an XML "Signcryption" method was defined. Syntactically the structure is similiar to the XML Signature whereas encryption is already integrated. An implementation with JCE (Java Crypto Extension) and SAX supplies better performance compared to the traditional method while integrity and confidentiality are still preserved. It is not surprising that signature generation is distinctly faster than verification since the complexity of the verification suffers from this new approach.