本文提出了一種Web 服務(wù)訪問控制沙盒模型。該模型不僅可以利用傳統(tǒng)的身份驗(yàn)證還可以通過擴(kuò)展SOAP 消息，加入角色信息，利用角色驗(yàn)證來保證Web 服務(wù)的訪問安全。此外，該模型還提出了一種安全管理器的機(jī)制，該機(jī)制使得Web 服務(wù)創(chuàng)建者和維護(hù)者可以更底層更靈活地保障Web 服務(wù)訪問安全。
關(guān)鍵詞：Web 服務(wù)；訪問控制；信息安全

Access Control Sandbox Model for Web Services Sun Ruijia, Ye Xiaoling, zhang Yingchao，Gao Lianjun (Nanjing University of Information Science& Technology, Nanjing 210044)
【Abstract】This paper proposed an access control sandbox model for Web Services. Rather than basing access on the traditional validation of a client’s identity, the model also takes the roles validation into account via extending the SOAP message by adding roles information to it .Further more, the model also proposed a kind of mechanism of Security Manager. This kind of mechanism makes the Web Services designer and maintainer can maintain the security of the Web Services access through a more low level and more flexible way.
【Key Words】 Web Services; access control; information security