On the data protection in distributed systems founded on Cryptographic Message Syntax

A new approach to building secure network channels (tunnels) over the Internet for servicing web services in distributed systems based on the use of the Cryptographic Message Syntax (CMS) standard for secure data representation on the network is considered. Unlike VPN technology, the described approach is strictly focused on supporting only HTTP/SOAP interactions in distributed systems — the basis of network.NET architecture. This approach is based on creating a secure "tunnel" through the Internet that uses the structure of a secure CMS message as a secure "container" for transporting HTTP/SOAP documents over the network: information requests to web services and "responses" to them. The approach implies the use of special gateways that provide encapsulation of HTTP/SOAP-documents into the safe CMS-message structures on the sender side and deencaptulating on the receiver side to make up a "transparent" communication channel for system components. It is assumed that both client programs and web servers are located in the same secure private network (or even on the same network node) with the gateways serving them, and only the interaction between the gateways is carried out through the public network. The implementation of the approach in the Linux environment and the results of an experimental study are described. As this study has shown, the use of OpenSSL crypto-libraries can significantly speed up the work of CMS-based data protection tools, which is of great importance in the development of distributed systems based on the.NET network architecture.