Access Control For Web Services Research Articles

A Literature Review on Trust Management in Web Services Access Control

A Literature Review on Trust Management in Web Services Access Control

Web Service Access Control Based on Browser Fingerprint Detection

Web services have covered all areas of social life, and various browsers have become necessary software on computers and mobile phones, and they are also the entrances to Web services. All kinds of threats to web data security continue to appear, so web services and browsers have become the focus of security. In response to the requirements of Web service for access entity identification and data access control, this paper proposes a multi-dimensional browser fingerprint detection method based on adversarial learning, and designs a Web service access control framework combined with browser fingerprint detection. Through the joint use of multi-dimensional browser features, adversarial learning is used to improve the accuracy and robustness of browser fingerprint detection; a cross-server and browser-side Web service access control framework is established by creating tags for Web data resources and access entities. Based on the mapping relationship between browser fingerprint detection entities and data resources, fine-grained hierarchical data access control is realized. Through experiments and analysis, the browser fingerprint detection method proposed in this paper is superior to existing machine learning detection methods in terms of accuracy and robustness. Based on the adversarial learning method, good detection results can be obtained in the case of a small number of user samples. At the same time, the open source data set is further used to verify the advantages of the method in this paper. The Web service access control framework can satisfy the requirements of Web data security control, is an effective supplement to user identification technology, and is implementable.

Users’ Reaction Time for Improvement of Security and Access Control in Web Services

This paper concerns the case of the development of a technology for increasing the efficiency of access control based on the user behavior monitoring built into a software system’s user interface. It is proposed to use the time of user reactions as individual indicators of psychological and psychophysical state. This paper presents the results and interpretation of user reactions collected during a mass web survey of students of the Russian Federation. The total number of users was equal to 22,357. To reveal the patterns in user reactions, both quantitative and qualitative approaches were applied. The analysis of the data demonstrated that the user could be characterized by their psychomotor reactions, collected during the answering of a set of questions. Those reactions reflected the personal skills of the interface interaction, the speed of reading, and the speed of answering. Thus, those observations can be used as a supplement to personal verification in information systems. The collection of the reaction times did not load the data volumes significantly nor transmit confidential information.

Purpose-Based Privacy Preserving Access Control for Secure Service Provision and Composition

Two main security issues in software as a service (SaaS) delivery model of cloud environments are access control and privacy preserving in basic web services as well as composite services where we require to infer policies through the automatic composition of the policies specified for their constituting basic services. In this paper, we present a privacy preserving access control model and framework for secure service provision and composition. The model is a combination of an attribute based access control model and a proposed purpose-based privacy model. Following this model, an access request for a service is permitted if the requester's attribute certificates and contextual conditions are in compliance with the access control policies specified by the service provider and simultaneously the privacy preferences of the requester is compatible with the privacy policies of the service provider. In the framework proposed in this paper, for secure service composition, possible chains of composite services are ranked according to the users' preferences and sensitivity level of their data. The security policies of the composite service, established by the chosen chain of services, are inferred by automatic composition of policies specified for the basic services in the chain.

A Literature Review on Trust Management in Web Services Access Control

A Literature Review on Trust Management in Web Services Access Control

A Literature Review on Trust Management in Web Services Access Control

Web Service is a reusable component which has set of related functionalities that service requesters can programmatically access from the service provider and manipulate through the Web. One of the main security issue is to secure web services from the malicious requesters. Since trust plays an important role in many kinds of human communication, it allows people to work under insecurity and with the risk of negative cost, many researchers have proposed different trust based web services access control model to prevent malicious requesters. In this literature review, various existing trust based web services access control model have been studied also investigated how the concept of a trust level is used in the access control policy of a service provider to allow service requester to access the web services.

A Literature Review on Trust Management in Web Services Access Control

A Literature Review on Trust Management in Web Services Access Control

Access control policies composition for composite Web services

For access control policy composition problem of composite services in Web services multi-domain environment,the attribute based Web services access control policy description framework was proposed and the services access control policies were formally expressed with atomic attribute value constraint.After analyzing the control structures in services composition description document,combining the access control policy composition operators with access control policy rule composition operation,the composite Web services access control policies composition method was designed to compose the composite service access control policies.Finally,the Web services access control policy composition process was given and the practicability of composition method was verified through a case.

Dynamic Role-based Access Control for Web Services using Context and Trust

Currently, the security issues of Web services are hot area in information system (IS). This research mainly discusses the key technologies of information access control focusing on following works: After analyzing the dynamic characteristic of application nature for Web services, a Dynamic Role-Based Access Control using Context and Trust model (abbreviated as CT-DRBAC) for Web services is proposed. During Web services, both the subject of invoking request and object of providing service resources are dynamic nature. So, access policies are needed to consider the dynamic nature. The proposed model has been developed and the authorization framework is discussed detail. In order to implement the dynamic trust management mechanism, a dynamic user role authorization algorithm which considers the user lifecycle contexts in the open systems is proposed and designed to meet the dynamic characteristic of subject and object effectively, and achieve intelligent and scientific user role assignments. The proposed access control module can be used in intelligent information systems to grant dynamically roles to users according to the current context.

ACConv -- An Access Control Model for Conversational Web Services

With organizations increasingly depending on Web services to build complex applications, security and privacy concerns including the protection of access control policies are becoming a serious issue. Ideally, service providers would like to make sure that clients have knowledge of only portions of the access control policy relevant to their interactions to the extent to which they are entrusted by the Web service and without restricting the client’s choices in terms of which operations to execute. We propose ACConv , a novel model for access control in Web services that is suitable when interactions between the client and the Web service are conversational and long-running. The conversation-based access control model proposed in this article allows service providers to limit how much knowledge clients have about the credentials specified in their access policies. This is achieved while reducing the number of times credentials are asked from clients and minimizing the risk that clients drop out of a conversation with the Web service before reaching a final state due to the lack of necessary credentials. Clients are requested to provide credentials, and hence are entrusted with part of the Web service access control policies, only for some specific granted conversations which are decided based on: (1) a level of trust that the Web service provider has vis-à-vis the client, (2) the operation that the client is about to invoke, and (3) meaningful conversations which represent conversations that lead to a final state from the current one. We have implemented the proposed approach in a software prototype and conducted extensive experiments to show its effectiveness.

A Policy-based Adaptive Web Services Security Framework

Web services security has become a hot topic in the research of service oriented computing. This paper aims to study many pivotal technologies in the web services security. Firstly, a policy-based framework for adaptive web services security is proposed, with the policy concept, management mechanism and execution mechanism can be separated effectively, moreover, by management of user context and web services context, web services access control can adapt to the changed environment. Secondly, a policy description language called ReiT is given, ReiT is a declarative language based on the rules and ontology and can express the structural and non-structural knowledge. A mixed reasoning mechanism is proposed, the web service access control policy including the user context and web services context can be evaluated by the reasoner. Finally, a policy aware BDI agent to authorize the access control of the web services is presented, and a prototype system based on Java EE and Jade Agent platform is implemented, Simulation experimental results and an example demonstrate the security framework is feasible and effective.

An Access Control Model for Workflow in Service Oriented Environment

Workflow access control is an important issue in workflow security. Although there exist some standards for security of Web services and access control for services in distributed systems are well studied, there is a lack of comprehensive approach in access control for web services, especially in workflow. This paper proposes a service oriented workflow model and its access control model. The basic authorization unit is task service which is an abstraction of task in the access control model. In this context, we present the dynamic separation of duty based on task services and their conflict relations. Furthermore, we show this model satisfies access control requirements in workflow.

Security for Web Services

This article discusses the main security requirements for Web services and it describes how such security requirements are addressed by standards for Web services security recently developed or under development by various standardizations bodies. Standards are reviewed according to a conceptual framework that groups them by the main functionalities they provide. Covered standards include most of the standards encompassed by the original Web Service Security roadmap proposed by Microsoft and IBM in 2002 (Microsoft and IBM 2002). They range from the ones geared toward message and conversation security and reliability to those developed for providing interoperable Single Sign On and Identity Management functions in federated organizations. The latter include Security Assertion Markup Language (SAML), WS-Policy, XACML, that is related to access control and has been recently extended with a profile for Web services access control; XKMS and WS-Trust; WS-Federation, Liberty Alliance and Shibboleth, that address the important problem of identity management in federated organizations. The article also discusses the issues related to the use of the standards and open research issues in the area of access control for Web services and innovative digital identity management techniques are outlined.

An extended XACML model to ensure secure information access for web services

More and more software systems based on web services have been developed. Web service development techniques are thus becoming crucial. To ensure secure information access, access control should be taken into consideration when developing web services. This paper proposes an extended XACML model named EXACML to ensure secure information access for web services. It is based on the technique of information flow control. Primary features offered by the model are: (1) both the information of requesters and that of web services are protected, (2) the access control of web services is more precise than just “allow or reject” policy in existing models, and (3) the model will deny non-secure information access during the execution of a web service even when a requester is allowed to invoke the web service.

EDSPLab: remote laboratory for experiments on DSP applications

PurposeThe purpose of this paper is to present a remote lab and a web‐based teaching environment which provides access for remote control of Digital Signal Processors (DSP device) and real instrumentation. The framework, named eDSPLab, has been designed using LabVIEW for debugging and testing Digital Signal Processing (DSP) experiments in a real lab without physical and temporal restrictions, and it has been integrated as a service in a modern e‐learning application domain and a Learning Management System (LMS) to reinforce its utility.Design/methodology/approachA literature review is presented to provide background to the progressive role that DSP and DSP devices play in Information and Communications Technology (ICT)‐demanded job profiles, and the role that a computer‐mediated environment plays in modern teaching methodologies. The web service access control architecture is defined.FindingsThe paper provides new insights into the use of the Internet for laboratory teaching.Research limitations/implicationsThis research was limited to one particular remote lab. Results could be extended if students' perceptions and their acceptance of the new e‐learning technology are examined using an information system theory, such as the Technology Acceptance Model (TAM).Originality/valueThis paper fulfils a need for adapting the teaching methodology applied in an undergraduate Advanced Microprocessor course of the Telecommunication Engineering degree at the University of Seville, Spain, allowing the development of laboratory experiments anywhere and anytime, avoiding one of the problems in lab training: the low number of laboratory working places in relation to the high number of enrolled students. The system developed has been successfully used during the last academic years in a course involving more than 200 students.

Web services access control architecture incorporating trust

PurposeThis paper seeks to investigate how the concept of a trust level is used in the access control policy of a web services provider in conjunction with the attributes of users.Design/methodology/approachA literature review is presented to provide background to the progressive role that trust plays in access control architectures. The web services access control architecture is defined.FindingsThe architecture of an access control service of a web service provider consists of three components, namely an authorisation interface, an authorisation manager, and a trust manager. Access control and trust policies are selectively published according to the trust levels of web services requestors. A prototype highlights the incorporation of a trust level in the access control policy as a viable solution to the problem of web services access control, where decisions of an autonomous nature need to be made, based on information and evidence.Research limitations/implicationsThe WSACT architecture addresses the selective publication of policies. The implementation of sophisticated policy‐processing points at each web service endpoint, to automatically negotiate about policies, is an important element needed to complement the architecture.Practical implicationsThe WSACT access control architecture illustrates how access control decisions can be made autonomously by including a trust level of web services requestors in an access control policy.Originality/valueThe WSACT architecture incorporates the trust levels of web services requestors and the attributes of users into one model. This allows web services providers to grant advanced access to the users of trusted web services requestors, in contrast with the limited access that is given to users who make requests through web services requestors with whom a minimal level of trust has been established.

Examining the role of terminal middleware in convergence applications

This paper examines the role of terminal middleware in supporting future convergence applications. Convergence features are characterised based on locale or device factors and some typical examples are identified. A prototye illustrates a clear opportunity for network operators to add value in the areas of Web Services delivery, access control, request prioritisation and continuity management for mobile applications.

An Adaptive Access Control Model for Web Services

This paper presents an innovative access control model, referred to as Web service Access Control Version 1 (Ws-AC1), specifically tailored to Web services. The most distinguishing features of this model are the flexible granularity in protection objects and negotiation capabilities. Under Ws-AC1, an authorization can be associated with a single service and can specify for which parameter values the service can be authorized for use, thus providing a fine access control granularity. Ws-AC1 also supports coarse granularities in protection objects in that it provides the notion of service class under which several services can be grouped. Authorizations can then be associated with a service class and automatically propagated to each element in the class. The negotiation capabilities of Ws-AC1 are related to the negotiation of identity attributes and the service parameters. Identity attributes refer to information that a party requesting a service may need to submit in order to obtain the service. The access control policy model of Ws-AC1 supports the specification of policies in which conditions are stated, specifying the identity attributes to be provided and constraints on their values. In addition, conditions may also be specified against context parameters, such as time. To enhance privacy and security, the actual submission of these identity attributes is executed through a negotiation process. Parameters may also be negotiated when a subject requires use of a service with certain parameters values that, however, are not authorized under the policies in place. In this paper, we provide the formal definitions underlying our model and the relevant algorithms, such as the access control algorithm. We also present an encoding of our model in the Web Services Description Language (WSDL) standard for which we develop an extension, required to support Ws-AC1.

An access control framework for web services

PurposeTo define a framework for access control for virtual applications, enabled through web services technologies. The framework supports the loosely coupled manner in which web services are shared between partners.Design/methodology/approachA background discussion on relevant literature, with an example is used to illustrate the problem that exists. To enable access control composition, an extension is proposed to authorisation specification language, together with publication of access control requirements of a web service provider.FindingsThe framework shows that loosely coupled access control can be made possible by making use of the standard manner in which messages are communicated in XML, and by composing assertions with the access control policy of the provider in a consistent manner. Access to web service methods is only granted if permission can be derived for it, where the derivation step forms a formal proof.Research limitations/implicationsA basic framework has been defined. An architecture to support it must be defined. Only a very basic level of access control composition has been illustrated.Practical implicationsThe publication of access control requirements in standards such as WS‐Policy can be considered.Originality/valueThis paper offers a practical approach to address access control for web services.

A metadata‐based access control model for web services

PurposeProvide a secure solution for web services (WS). A new interoperable and distributed access control for WS is presented.Design/methodology/approachBased on the separation of the access control (AC) and authorization function.FindingsMechanisms presented allow seamless integration of external authorization entities in the AC system. The Semantic Policy Language (SPL) developed facilitates specification of policies and semantic policy validation. SPL specifications are modular and can be composed without ambiguity. Also addressed was the problem of the association of policies to resources (WS or their operations) in a dynamic, flexible and automated way.Research limitations/implicationsThe ACProxy component is currently under development. Ongoing work is focused on achieving a richer “use control” for some types of WS.Practical implicationsAdministrators of WS can specify AC policies and validate them to find syntactic and semantic errors. Components for automated validation of policies at different levels are included. This ensures that the AC policies produce the desired effects, facilitating the creation and maintenance of policies. It also provides mechanisms for the use of interoperable authorizations.Originality/valueA practical system that provides a secure solution to AC for WS. To the best of one's knowledge, no other system provides mechanisms for semantic validation of policies based on external authorization entities. Likewise, the mechanisms for interoperability of external authorization entities are also novel. The system provides content‐based access control and a secure, decentralized and dynamic solution for authorization that facilitates the management of complex systems and enhances the overall security of the AC.