title: What are good methods for transferring XML with encryption and integrity validation?
body: <p>We've been asked to start developing a standardised approach to transferring XML data in a project, which will eventually be used throughout this particular industry. Some of the requirements include:</p>
  
  <ul>
  <li>XML must allow partial/complete encryption of data</li>
  <li>Must be able to verify the source of the XML (server and client will be known to each other)</li>
  <li>Must support both online and offline processing (batches)</li>
  <li>Any online processing must be over a secure channel</li>
  </ul>
  
  <p>The 'server' and 'client' will 'register' with each other, and will both initiate the sending of messages.</p>
  
  <p>Some thoughts that have been raised by the consortium:</p>
  
  <ul>
  <li>SOAP isn't liked by most members - it often causes more problems and overhead than it solves</li>
  <li>The XML integrity and encryption is more important than the transport</li>
  <li>Most members prefer the concept of encryption/decryption at the application level, rather than solely at transport</li>
  <li>SSL connections would be online, realtime only and could not be enforced at the web-application level.</li>
  </ul>
  
  <p>We already have a basic XML schema that has been used at the proof-of-concept stage, and basically consists of:</p>
  
  <ul>
  <li>A command / response type</li>
  <li>Variables / response messages</li>
  </ul>
  
  <p>We're at a high-level stage at the moment, and I'd be interested to know what standards currently exist and what approaches would suggest.</p>