I think that are thinking about message-level security, where you can protect either an entire message, or simply parts of it (the content of the message). This type of security can be used with web services.
WSIT (Web Services Interoperability Technology) can be used to secure message contents. An overview of WSIT technology can be found at http://blogs.sun.com/ashutosh/entry/overview_of_security_in_wsit or at http://java.sun.com/webservices/interop/. A tutorial discussing how to secure web services using WSIT technology is at https://wsit-docs.dev.java.net/releases/m4/SecurityProfiles.html#wp113333.
Hope this helps