Using XML Security Mechanisms

XML is now seen as the format for a range of new security protocols, making use of XML signature and encryption standards. This may be used to provide security for Web services. In addition, a number of traditional components of a public key infrastructure could be recast in XML form for better interoperability and flexibility. This paper explores Web services, public key infrastructures and the use to which XML is being put in creating new security standards and services.     

Orchestration in Web Services and Real-Time Communications

Web services orchestration is now being adopted for the coordination of real-time communications services, including telephony, video and multimedia communications. But do these communications services integrate into workflows in the same way as Web services in the data environment, and are orchestration mechanisms for Web services sufficient for the needs of workflows that involve real-time communications? In this article we explore these questions by taking a look at three approaches to orchestrating workflows: Business Process Execution Language (BPEL), Call Control extensible Markup Language (CCXML), and State Chart extensible Markup Language (SCXML). Through an analysis of these languages, we find that although there are similarities between BPEL as a Web services orchestration language and CCXML/SCXML as orchestration languages for telecom applications, certain key differences, namely procedural vs. event-based representation and coarse vs. fine task granularity, make it more suitable to use these two types of languages together rather than having one replace the other in converged voice-data applications.     

浅析数据库与XML的结合

XML逐渐成为互联网上数据描述和交换的标准，它将成为Web上存放数据的主要格式。本文分析了XML与数据库的关系，并阐述了XML在SQL Server中的支持现状。     

A New Model for Secure Dissemination of XML Content

The paper proposes an approach to content dissemination that exploits the structural properties of an Extensible Markup Language (XML) document object model in order to provide an efficient dissemination and at the same time assuring content integrity and confidentiality. Our approach is based on the notion of encrypted postorder numbers that support the integrity and confidentiality requirements of XML content as well as facilitate efficient identification, extraction, and distribution of selected content portions. By using such notion, we develop a structure-based routing scheme that prevents information leaks in the XML data dissemination, and assures that content is delivered to users according to the access control policies, that is, policies specifying which users can receive which portions of the contents. Our proposed dissemination approach further enhances such structure-based, policy-based routing by combining it with multicast in order to achieve high efficiency in terms of bandwidth usage and speed of data delivery, thereby enhancing scalability. Our dissemination approach thus represents an efficient and secure mechanism for use in applications such as publish-subscribe systems for XML Documents. The publish-subscribe model restricts the consumer and document source information to the routers to which they register with. Our framework facilitates dissemination of contents with varying degrees of confidentiality and integrity requirements in a mix of trusted and untrusted networks, which is prevalent in current settings across enterprise networks and the Web. Also, it does not require the routers to be aware of any security policy in the sense that the routers do not need to implement any policy related to access control.     

VoiceXML and the W3C speech interface framework

VoiceXML is a markup language for creating voice-user interfaces. It uses speech and telephone touchtone recognition for input and prerecorded audio and text-to-speech synthesis (TTS) for output. It's based on the World Wide Web Consortium's (W3C's) Extensible Markup Language (XML) and leverages the Web paradigm for application development and deployment. By having a common language, application developers, platform vendors, and tool providers all can benefit from code portability and reuse. The paper discusses VoiceXML and the W3C speech interface framework.     

一种对Web遗留系统透明的单点登录方案

单点登录（SingleSignOn,SSO）给用户带来极大的方便,但Web遗留系统（Legacy）往往由于无法进行修改而不能提供SSO支持。提出的面向web遗留系统的透明单点登录解决方案,利用web过滤器技术,结合安全断言标记语言（SAML）协议和安全的口令代填,可以在不需要修改原有系统的情况下,实现单点登录,而且能实现自动账户绑定。这里提出的方案是一种解决Web遗留系统单点登录问题的既简单又有效的方案。     

XML在数据交换中的应用

HTML作为一种简单易用地标记语言,极大地推动了Internet的发展。但是随着Internet应用的展开,HTML已经不能满足人们的需要。XML作为下一代Internet语言,具有极大的灵活性。利用XML可以在Internet展开各种复杂的应用。基于XML数据交换系统的原型,用XML作为数据中介,实现了异构数据的集成和交换。     

Query by templates: using the shape of information to search next-generation databases

We present a user-centered database query language called QBT (Query By Templates) for user communication with databases containing complex structured data, such as data stored in the Extensible Markup Language (XML). XML has revolutionized data storage as well as representation and transfer methods in today's internet applications. The growing popularity of XML as a language for the representation of data has enabled its use for several applications involving storage, interchange, and retrieval of data. Several textual query languages have been proposed for XML retrieval, including the World Wide Web Consortium's (W3C) recommendation of XQuery. Native XML database systems have been implemented, all of which provide methods for user communication with the database, although most communication methods use text-based query languages or form-based interfaces. QBT, the language presented here, is one of the first attempts toward a generalized alternative language that is based on human factors of familiarity. It is ideal for documents with a simple yet highly recognizable layout (e.g., poems, dictionaries, journals, etc.). We present the QBT language and report results from an initial usability test that shows promise for this type of an interface as a generalized user-database communication method.     

XML电子政务数据交换平台的研究与设计

介绍了可扩展标记语言（XML）的特点以及电子政务数据交换平台的体系结构，提出了基于XML的数据交换体系结构典型设计，应用效果表明，该设计消除了信息孤岛，实现了系统与各部门或园区各企业之间的信息共享和互通。     

Web2.0中的内容源注入攻击与防范

论文主要介绍了针对符合RSS、Atom和XML标准的Web内容源（Feed）的几种攻击形式和防范对策,包括将内容源作为攻击媒介,与区域类型相关的风险,与阅读器类型相关的安全风险,将内容源作为攻击程序（exploits）的配置媒介,与Web内容源标准类型相关的安全风险。     

CNGI环境中跨域AAA系统的构建

国际上的认证与授权方面的标准主要有安全性断言标记语言(SAML)、可扩展访问控制标记语言(XACML)等,中国下一代互联网示范工程(CNGI)跨机构的统一认证和授权中间件技术项目基于国际规范,提出了结合现有成熟产品DT(DigitalTrust)、身份提供者(IdP)和服务提供者(SP)而建立跨域跨机构统一身份认证、授权和审计(AAA)系统的完整方案。该系统提供一种独立于协议和平台的身份验证和资源访问授权交换机制,对于CNGI环境下跨域跨机构统一认证和授权技术的发展和应用具有很好的示范意义。     

Web Services安全机制研究

Web Services作为实现SOA的主流技术标准,得到了广泛应用,其安全性值得高度关注。基于WS-Security标准,对Web Services的安全机制进行了研究,对Web Services安全防护的功能、遵循的标准进行了分析,并结合工程实践,从身份识别、SOAP消息安全防护和访问控制等方面提出了Web Services安全防护的实现方案,可以实现核心的安全防护功能,对基于Web Services技术架构的系统安全防护具有指导意义。     

基于DOM的XML解析技术在构件描述中的应用

在Visual C#中,解析器可将代码中的扩展标记语言(eXtensible Markup Language,XML)注释处理为外部XML文档。文档对象模型(Document Object Model,DOM)定义了一个独立于平台和语言的标准接口,应用程序通过它访问和修改XML文档数据。介绍了DOM的特点和功能,并在ASP.NET平台下通过封装的DOM类库解析和存取XML文档,完成了对XML文档数据提取,将解析出的数据导入数据库作为构件描述信息的应用实例。     

通用即插即用服务自动发现技术

随着数字家电的普及，家庭网络技术呈现出越来越广阔的市场应用前景。为了实现家庭网络互联设备的操作控制和信息共享，需要采用通用即插即用（UPnP）技术。UPnP充分重用包括IP、传输控制协议（TCP）、数据报协议（UDP）、超文本传输协议（HTTP）和可扩展标记语言（XML）在内的互联网技术标准，提供服务的跨平台自动发现和远程控制。采用UPnP可实现灵活而强大的业务发现能力，能将复杂的网络设备驱动变为简单的远程网络控制，同时还能提供互联设备的操作控制和信息共享。     

QMTool: an XML-based management platform for QoS-aware IP networks

Technological and human factors have contributed to the increasing complexity of the network management problem. Heterogeneity and globalization of network resources have, on one hand, increased user expectations for flexible and easy-to-use environments and, on the other, propounded entirely novel ways to face the management problem. Several research efforts recognize the need for integrated solutions to manage both network resources and services in open and global environments. Undoubtedly, these solutions should permit the coexistence of different management models and should interoperate with legacy systems. The presented management system, QoS management tool (QMTool), aspires to address the heterogeneity, complexity, and dynamic behavior of QoS-enabled IP networks by taking advantage of the optimum fit of a number of novel technologies. A layered framework architecture, including element, network management, and visualization service, is provided, and a high level of information abstraction in network configuration and monitoring is introduced mainly based on the capabilities of the Extensible Markup Language (XML). Moreover, the functional components for providing (re-)configuration, fault management monitoring, and network visualization facilities are also presented, followed by notes of implementation issues.     

基于语义网的城市场所安全语义描述的框架

以描述特定场所安全的语义网为主要研究对象,通过对城市安全的相关理论以及语义网研究历史与现状的详细分析.主要负责分析城市特定场所安全时所要描述的数据对象,对其进行整理建模,并最终建立描述城市中特定场所安全的语义网.对于数据框架的描述语言采用UTF-8编码,XML Schema(xsd)格式存储.最终设计并实现了一个简单的描述特定场所安全的语义网.     

Transporting data between wireless applications using a messaging system—MMS

There is a demand for using messaging systems to transport data between wireless applications in mobile communications. As multimedia messaging service (MMS) is a promising messaging system to meet the demand, it is under enhancement in related standardization bodies to make it effective in transporting application data. The enhancement should be compatible with the existing MMS services for its smooth and safe deployment. This paper proposes a solution to make the enhancement backward compatible, so that a new MMS service of transporting application data has no impact on the existing MMS services. The solution also provides forward compatibility, so that an MMS service of transporting application data does not hinder the introduction of any application in the future, allowing instantaneous deployment of a wireless application. The standardization bodies did not define any format for data communication between a wireless application and MMS in a terminal. A common format in this regard would help mass availability of wireless applications for different purposes independent of manufacturing a mobile terminal. Based on an analysis described in this paper, eXtensible Markup Language (XML) is the suitable format for the purpose. This paper also presents examples of XML file to indicate what data should be communicated in this regard. Copyright © 2006 John Wiley & Sons, Ltd.