<p>Utvecklingen går mot alltmer distribuerade IT-system, där ett flertal datorer kommunicerar med varandra. Detta gäller även försvarsmaktens ledningssystem. I dessa öppna och distribuerade system är olika säkerhetsfunktioner kritiska. En av dessa är att kunna verifiera identiteten hos den part som kommunikationen sker med. Detta görs oftast med hjälp av asymmetriska kryptooperationer, där identiteter kan verifieras med hjälp av öppet publicerade autentiseringsnycklar. Hanteringen av sådana nycklar kan centraliseras med hjälp av XML Key Management Specification. XKMS är en standard utvecklad av W3C som specificerar en Web Service för hantering av distribution, verifiering och registrering av öppna nycklar. I detta examensarbete har en del av en sådan service implementerats. Fokus har legat på distribution och verifikation av X.509-certifikat som är en ledande standard för att knyta ihop identiteter med nycklar. Slutligen har ett API till Java utvecklats för att på klientsidan underlätta nyttjandet av en XKMS-service.</p>

Utvecklingen går mot alltmer distribuerade IT-system, där ett flertal datorer kommunicerar med varandra. Detta gäller även försvarsmaktens ledningssystem. I dessa öppna och distribuerade system är olika säkerhetsfunktioner kritiska. En av dessa är att kunna verifiera identiteten hos den part som kommunikationen sker med. Detta görs oftast med hjälp av asymmetriska kryptooperationer, där identiteter kan verifieras med hjälp av öppet publicerade autentiseringsnycklar. Hanteringen av sådana nycklar kan centraliseras med hjälp av XML Key Management Specification. XKMS är en standard utvecklad av W3C som specificerar en Web Service för hantering av distribution, verifiering och registrering av öppna nycklar. I detta examensarbete har en del av en sådan service implementerats. Fokus har legat på distribution och verifikation av X.509-certifikat som är en ledande standard för att knyta ihop identiteter med nycklar. Slutligen har ett API till Java utvecklats för att på klientsidan underlätta nyttjandet av en XKMS-service.

International Telemetering Conference Proceedings / October 20-23, 2003 / Riviera Hotel and Convention Center, Las Vegas, Nevada / Today many organizations use the Secure Sockets Layer protocol (SSL, now known as TLS, or Transport Layer Security) to secure post processed telemetry data transmitted over internal or external Internet Protocol (IP) networks. While TLS secures data traveling over a network, it does not protect data after it reaches its end point. In the Open Systems Interconnection (OSI) layer model, TLS falls several layers below the application category. This implies that applications utilizing data delivered by TLS have no way of evaluating whether data has been compromised before TLS encryption (from a source), or after TLS decryption (at the destination). This security “gap” can be addressed by adoption of a security infrastructure that allows security operations to be abstracted at an OSI application level.

<p>In many industries the tracking and tracing of products within the supply chain is required by law. Companies in the metal working industry exchange so-called material test reports, which specify the product’s properties, the customer’s requirements, and serve as an assurance between the supplier and the customer. Internet technologies have changed the way companies exchange information and conduct business. In the metal working industry companies can implement an intermediary platform and make the exchange of material test reports more efficient. Furthermore, a client application that allows the company to export test reports from their information system directly to the intermediary can significantly decrease the processing costs. This inter-organizational collaboration can render an increase in productivity for customers and suppliers. </p><p>The main goal of the thesis is to analyze how companies in a supply chain can exchange documents with an intermediary over the protocol SOAP as well as support companies by showing a structured procedure for how to achieve security in a system using SOAP. SOAP is a platform independent XML-based communication protocol. The Extensible Markup Language (XML) is of major importance in e-business applications, because of its platform, language, and vendor independent way of describing data. As a universal data format, it enables the seamless connection of business systems. </p><p>SOAP does not provide any security and is usually implemented over HTTP, which allows it to pass through firewalls. Companies are only prepared to join an inter-organizational collaboration if IT-security is guaranteed. In the exchange of material test reports, security has two objectives. The first is to replace the handwritten signature in the paper-based document exchange. The second is to guarantee security for the material test reports as well as for the information intermediary. </p><p>SOAP’s extensibility model allows organizations to develop new extensions, which build upon the protocol and provide functions which aren’t specified. Specifications for attachments as well as for security should be implemented in the electronic document exchange. To design a secure system, each security concept, such as confidentiality, authentication and integrity, can be analyzed in its context and the appropriate standard can thereafter be implemented.</p>

In many industries the tracking and tracing of products within the supply chain is required by law. Companies in the metal working industry exchange so-called material test reports, which specify the product’s properties, the customer’s requirements, and serve as an assurance between the supplier and the customer. Internet technologies have changed the way companies exchange information and conduct business. In the metal working industry companies can implement an intermediary platform and make the exchange of material test reports more efficient. Furthermore, a client application that allows the company to export test reports from their information system directly to the intermediary can significantly decrease the processing costs. This inter-organizational collaboration can render an increase in productivity for customers and suppliers. The main goal of the thesis is to analyze how companies in a supply chain can exchange documents with an intermediary over the protocol SOAP as well as support companies by showing a structured procedure for how to achieve security in a system using SOAP. SOAP is a platform independent XML-based communication protocol. The Extensible Markup Language (XML) is of major importance in e-business applications, because of its platform, language, and vendor independent way of describing data. As a universal data format, it enables the seamless connection of business systems. SOAP does not provide any security and is usually implemented over HTTP, which allows it to pass through firewalls. Companies are only prepared to join an inter-organizational collaboration if IT-security is guaranteed. In the exchange of material test reports, security has two objectives. The first is to replace the handwritten signature in the paper-based document exchange. The second is to guarantee security for the material test reports as well as for the information intermediary. SOAP’s extensibility model allows organizations to develop new extensions, which build upon the protocol and provide functions which aren’t specified. Specifications for attachments as well as for security should be implemented in the electronic document exchange. To design a secure system, each security concept, such as confidentiality, authentication and integrity, can be analyzed in its context and the appropriate standard can thereafter be implemented.