Gopalan Suresh Raj
Web Cornucopia
Gopalan's Profile
Archives
« October 2008
SunMonTueWedThuFriSat
   
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
 
       
Today
Click me to subscribe Download Open ESB
Syndication
Search

Table of Contents
Tags
bpel choreography ejb esb http integration javacaps javaee javaone jax-ws jbi management openesb orchestration process-oriented rest sca service-oriented soa soap wsdl xml xsd
Links
 


 
Referrers

Today's Page Hits: 209

Map of Visitors
Locations of visitors to this page
Caveat Emptor
This is my personal weblog. The contents of this Weblog represent my personal opinion which may differ from the official views of my employer, Sun Microsystems, Inc. or any past employers. I do not speak for my employer or any past employers.
View Gopalan Suresh Raj's profile on LinkedIn
« JBI/SOA Tips: Statel... | Main | JBI/SOA Tips: Cache... »
Wednesday May 02, 2007
May
2
JBI/SOA Tips: Security/Performance Tradeoffs

If multiple short messages are being exchanged between the client and the service, TLS (i.e., HTTPS) which uses X.509 digital certificates to provide message confidentiality, may not be the optimal protocol because of the handshake overhead involved in setting it up. The same goes for WS-Security which utilizes XML Digital Signatures for authentication and message integrity, and XML encryption using X.509 digital certificates for message confidentiality.

While TLS (i.e., HTTPS) can be used for network node level message confidentiality, WS-Security is typically used for end-to-end security up through your application stack, and is independent of the networking protocol. WS-Security is twice as expensive as TLS (i.e., HTTPS).

This is one of the many reasons why you have to expose Coarse-Grained Service Interfaces to external Clients and exchange reasonable sized messages. Consider setting up a secure conversation with partners who communicate with you frequently. You just have to be aware of the trade-offs when designing your service.


Like this write-up? Subscribe to receive  more  like it.


 

Posted at 12:36AM May 02, 2007 by Gopalan Raj in A Tip a Day  |  Listen to this article Listen to this entry  |  Comments added Comments[1]
Tags:
Share This Post: del.icio.us | furl | simpy | slashdot | technorati | digg

Comments:

Shouldn't multiple POSTs over HTTPS share the same encrypted TCP connection? Assuming that, if you replace a chatty protocol with something more sensible, it's not at the HTTPS level that you will see the improvements.

Posted by Tom Hawtin on May 02, 2007 at 03:59 PM PDT #

Post a Comment:
  • HTML Syntax: NOT allowed

Disclaimer: The contents of this Weblog represent my personal opinion which may differ from the official views of my employer, Sun Microsystems, Inc. or any past employers.

View blog top tags

Enter your email address:

Delivered by FeedBurner

[Valid RSS]