There is growing interest in WS-Security for JBossWS.
First step would be to evaluate available OS projects about their integration potential in the JBossWS stack.

Here is one:

http://ws.apache.org/ws-fx/wss4j/

Apache WSS4J is an implementation of the Web Services Security (WS-Security) being developed at OASIS Web Services Security TC. WSS4J is a primarily a Java library that can be used to sign and verify SOAP Messages with WS-Security information. WSS4J will use Apache Axis and Apache XML-Security projects and will be interoperable with JAX-RPC based server/clients and .NET server/clients.