A new approach to building secure network channels (tunnels) over the Internet for servicing web services in distributed systems based on the use of the Cryptographic Message Syntax (CMS) standard for secure data representation on the network is considered. Unlike VPN technology, the described approach is strictly focused on supporting only HTTP/SOAP interactions in distributed systems.

It is shown that the described approach makes it possible to include additional functionality in a secure channel. This functionality relates to the demarcation of client access rights to web services and individual service functions, with the routing of information requests in the channel, as well as with the organization of parallel client access to several identical web services at once with the formation of a "total" processing result. The approach implies the use of special gateways that provide encapsulation of HTTP/SOAP-documents into the safe CMS-message structures on the sender side and deencaptulating on the receiver side to make up a "transparent" communication channel for system components. It is assumed that both client programs and web servers are located in the same secure private network (or even on the same network node) with the gateways serving them, and only the interaction between the gateways is carried out through the public network. The implementation of the approach in the Linux and Windows environment and the results of an experimental study are described. In particular, the study showed that when calling service functions with a runtime of 1.0 seconds or higher, the secure channel increases the total query execution time by only a few percent.