Final Year Project

Rampart2 (A High performance security module for Apache Axis2)

These are the last few days of my degree on Computer Scence and Engineering at University of Moratuwa, Sri Lanka. Yesterday I finished the final presentations, demonstrations and viva held on my Final Year Project.

My project was to implement a newly architected high performance security module for Apache Axis2 (which is one of the leading open source Web Services engines). What is expected from a security module is to implement what is defined in the WS-Security specification. Apache Rampart is the currently existing security module for Axis2 and it contains lot of drawbacks.

  • Wastage of Processing time
  • Wastage of Memory
  • Less protection from attacks like DOS attacks

So our goal was to implemet a new security module which overcomes the above mentioned drawbacks. It was extremely successful and we got very good feedbacks from our supervisors and staff members.

Rampart2 development team included four of us namely Sameera Jayasoma, Saliya Ekanayake, Kalani Ruwanpathirana and my self. Rampart2 consists of two major layers. The top layer provides SOAP security and it implemets the WS-Security and WS-SecurityPolicy specifications. The bottom layer provieds XML security and it implements the XML-Encryption, XML-Signature and XML-Canonicolization specifications.

I was working on the top layer with Sameera and my responsibility was to implement the Message Processing Model. I was really successful and it makes sure that the system resources are efficiently used and the attacks are identified as soon as possible.

As our future work we have to implement the specifications like WS-Trust and SAML Token Profile on top of Rampart2. After that we will be able to replace the currently existing module (Rampart) with Rampart2. I really enjoyed the challenges I had face during the project and looking forward to contribute in Rampart2 development in the future as well.

Advertisements

About isurues
Age : 24 Date of Birth : 05.11.1984 Country : Sri Lanka

8 Responses to Final Year Project

  1. Jason says:

    Is the Rampart2 code currently available anywhere? I don’t see it advertised anywhere on the WSO2 or rampart sites, and I can’t find it in their svn repos, either.

    Rampart is much too slow for our current needs, which are pretty simple, feature-wise. I would much prefer to have access to an incomplete implementation that fixed the performance issues than wait until it was a drop-in replacement for the current Rampart release.

    • isurues says:

      Hi Jason,

      Yes you are correct. The source code is not available anywhere. But I can arrange an svn location for it in the near future. I know that some people are concerned about the performance issues with Rampart. Even though the other specifications are not yet implemented on Rampart2, it can be helpful for people like you.
      If you are interested in techniques used in Rampart2 in this article http://wso2.org/library/articles/ws-security-processing-models-along-ws-securitypolicy-1 I explain the processing model followed in Rampart2 and how it increases performance.

      Isuru

  2. Saliya says:

    Hi Jason,

    Please find the performance comparison of Rampart Vs Rampart2 at http://wssecforaxis2.blogspot.com/.

    We, the development team, would be glad to provide a public svn location very soon.

    –Saliya

  3. mark says:

    Rampart2 source code available?

  4. isurues says:

    Hi Mark,

    As we have done this project in the University, rights are with the University of Moratuwa. Therefore we are still working on granting license from UoM to Apache. Hopefully this can be completed within this month. After getting that sorted out, we will be donating the code to Apache and it will be available there.

    Thanks,
    ~Isuru

  5. mark says:

    I am excited to hear about the possible release this month, and please inform me if you have time when it gets released.

  6. mark says:

    How is the licensing coming? I checked Apache and have not seen any references.

    Mark

  7. mark says:

    Curious if Rampart 2 is being discontinued, or it will be released?

    Should we look for another alternative to your development?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: