Infrastructure to secure federated web services

A method for accessing a web service provider (WSP) at a web service consumer (WSC), the method comprising:

• using a WSC business logic to generate an original query message to a fictitious WSP, wherein the WSP and WSC are participants in a federation according to a federation protocol;
• receiving the original query message in a security provider;
• identifying a real WSP that is an intended recipient of the original query message;
• processing the original query message to generate a modified query message that conforms to the federation protocol, the modified query message including a header with a security mechanism selected by the security provider from a list of permitted security mechanism types;
• and
• transmitting the modified query message to the real WSP over a network from the security provider, the WSC business logic and the security provider each being a distinct software module executing within a container on a computer.

A method for providing a web service at a web service provider (WSP) to a web service consumer (WSC), the method comprising:

• receiving a query message from a real WSC over a network in a security provider, wherein the WSP and WSC are participants in a federation according to a federation protocol and wherein a header for the query message conforms to the federation protocol;
• identifying a security mechanism incorporated into the header for the query message;
• verifying that the security mechanism corresponds to an acceptable type of security mechanism selected by the real WSC from a list of permitted security mechanism types;
• validating the security mechanism, the validating including determining that the real WSC is authenticated and that the message integrity is not compromised;
• extracting a message body from the query message;
• and
• sending the message body to WSP business logic from the security provider, the security provider and the business logic each comprising a distinct software module executing within a container on a computer;
• and
• using a WSP business logic to generate an original response message addressed to a fictitious WSC.