Message Level Security for Web Services

Message Level encryption creates end-to-end confidentiality instead of point-to-point confidentiality.

Message Level Security lies above transport level security. Message level security allows specific parts of a SOAP message to be encrypted or digitally signed before it is put "on the wire".

Message Level Security addresses the same security requirements as traditional Web Security, that is, authentication, authorization, integrity, confidentiality and non-repudiation.

Message Level Security makes security possible by embedding the security information in a message's SOAP header. The SOAP message itself either contains the information needed to secure the message (by digitally signing or encryption) or it contains information about where to get that information to handle security needs.