Using Patterns to Understand and Compare Web Services Security Products and Standards

Web services are becoming an important way for enterprises to interoperate. Many security standards have been developed for web services, but they are still vulnerable to a variety of attacks; lack of security is one of the main reasons given by people who are reluctant to use web services even knowing of their advantages. A problem with web services security standards is that several organizations are involved in developing them and as a result there are many, and they may overlap. We are developing a catalog of architectural security patterns for web services corresponding to security standards and mechanisms. In this paper we explore another aspect: how to compare standards using patterns. By expressing standards as patterns, we can compare them and understand them better. For example, we can discover potentially overlapping and inconsistent aspects between them.