B2B Integration : A Practical Guide to Collaborative E-commerce

338 B2B Integration — A Practical Guide to Collaborative E-commerce
11.9.1. Authentication
Authentication is a security requirement that ensures each entity involved
in the usage of a Web service — the requester, the provider, and the
broker (if there is one) — is what it actually claims to be. Authentication
involves accepting credentials from the entity and validating them
against an authority. While Web services for EAI should have one level
of authentication and rarely make use of encryption, Web services for
B2Bi may involve multiple levels of authentication and should always
use encryption. Of course, there will always be a tradeoff between
robust security and performance.
11.9.2. Authorization
Authorization is a security requirement that determines whether the
requestor has been granted access to the Web service by the service
provider. Basically, authorization confirms the service requestor's
credentials — checks that the service requestor is entitled to perform
the operation, which may range from invoking the Web service to
executing a certain part of its functionality.
11.9.3. Data protection
Data protection is a security requirement that ensures that the Web
service request and response have not been tampered with en route.
Data protection requires securing both data integrity and privacy. It is
worth mentioning that data protection does not guarantee the identity
of the message sender. In the case of B2Bi projects, the messages
corresponding to Web service request and response should always be
encrypted, using one or more of the following: cryptography, digital
signatures, secured socket layer (SSL), and so on. The use of SSL
should be avoided, as far as possible, for Web services used within the
corporate network for EAI projects.
11.9.4. Non-repudiation
Non-repudiation guarantees that the sender of a message is the same as
the creator of the message. This is very useful for Web services used in