园长大人，那我应该可以这样理解：点对点关注点在传输层，端对端关注点在应用层。我还有个疑问：https方式访问服务器理论上只要证书和ca机构不出问题就是安全的，为什么又发展出了ws-security规范，前者哪些缺陷是必须用后者才能弥补的呢？谢谢，祝晚安

我应该是有些概念和知识不牢固。抽时间自己先学学吧，希望一年后我可以来回答自己提出的问题

昨天花高价买的电子书上是这样说的：

Now, that's not to say that Web services can't be secured without WS-Security. A number of companies have deployed secure Web service using SSL. But the capabilites and extensibility of these Web services are very limited when relying on the transport level to enforce security. SSL provided point-to-point security rather than end-to-end-to-en security. As Web service deployments get more sophisticated, IT organizations will start to deploy intermediary nodes between consumer and service to perform functions, such as monitoring, auditing, content-based routing, version mismatch resolution, reliability, and orchestration. SSL-based protection can't provide a seamless security infrastructure for these multi-hop requirements. Beside, SSL imposes a heavy burden on IT developers to implement a security management framework that maps transport-level authentication mechanisms to the back-end applications' authentication and authorization systems.

不能复制，纯手打。他说的那些multi-hop的例子感受并不很深，还是经历的东西太少，太浅。