Message signing in AMS
In Advanced Message Security (AMS), by using a digital signature on the message, the identity of the sender and the authenticity of the message can be confirmed, and therefore the sender of the message cannot deny (or repudiate) the sending of that message.
When an application places a message on a queue, AMS checks if the target queue has an AMS policy for signing or encryption. If signing is required, AMS creates an envelope containing the message data, a cryptographic signature, and the public certificate data of the user associated with the application.
When an application retrieves the message from the queue, AMS strips the signature from the message data and verifies that the sender is known and signed by a trusted certificate authority. In addition, AMS checks that the user identified by the signature is authorized, by policy, to place messages on the target queue.
The signature also includes a digest of the message data, generated at the time the message was placed on the queue. This digest is verified to ensure that the data in the message has not been altered between being placed on the queue and being retrieved.