see if this helps :
It is in Metro guide:
http://metro.java.net/2.1/guide/Advanced_Usages_of_STS_in_Security.html
On May 21, 2012, at 8:39 PM, <notoadw_at_gmail.com> <notoadw_at_gmail.com>
wrote:
> I have secured a Metro Service using an STS Issued token. By default
> the web service Signs each part of the Soap Envelope and additionally
> Encrypts the Body. Our response has a pretty big payload (10 MB
> byte[]). Our key is 1024bits. We are noticing that it will take 5+
> seconds to process the message between the service and client. The
> same message with no security transfers in <1second.
>
> We are using Glassfish 3.1.1 (Open Source). Also, we have tweaked the
> default JVM settings (increased default and max Heap Size and set to
> server mode). I am wondering what else we can do to help speed up
> some
> of the cryptography processing of the message itself. Because we are
> using the Open Source version, I guess we don't have access to the
> Performance Tuner.
>
> I know that WS-Security will be slower, but 5 seconds + to process the
> message doesn't "feel" right. Any guidance would be appreciated.
>
> Thanks.