Web Services Security (WS-Security) is a mechanism for incorporating security information into SOAP (Simple Object Access Protocol) messages. While SOAP provides a flexible technique for structuring messages, it does not directly address how to secure these messages. WS-Security builds from the the SOAP specification structuring the use of essential security capabilities.In particular, WS-Security uses binary tokens for authentication, digital signatures for integrity and content-level encryption for confidentiality.
The WS-Security specification is an activity of the Web Service Interoperability Organisation (WS-I Organisation) that is an industry-wide effort that standardise how Web services are requested and delivered. WS-Security makes it easy to include security elements into SOAP through tools and enterprise applications by structuring SOAP security. In general, WS-Security is intended to be extensible so that new security mechanisms can be used in the future.
