Web Services Security Research Articles

Survey on Signatured Xml Encryption for Multi-Tier Web Services Security

Web service is the technology tied up with SOAP, UDDI and WSDL of XML format, so web services searching based on XML keyword become essential. By systematic monitoring it has been observed that internet communication is less protected than intranet communication. The transaction exchange held through internet in web which is one among the distributed application is embodied to different vulnerability. In distributed environment, messages and data are exchanged as Extensible Markup Language (XML) format for its vast compatibility in transit. For facing the competitive environment, any business teams have to find their suitable web services among the bulk services prevails in market. In apt to this, survey has been made with different searching techniques and way to boost the security container filled with access permitted service alone. Our research work on XML based Web security is concentrated on providing the privacy, certification and integrity. We investigate the way to regulate and insist the security by applying XML Encryption and Signature for data or messages in transaction and in storage form. It also proves the performance improvement in searching data from vast resources, if so security constraint is provided. Search Engines Optimization (SEO) is enhanced with parsing the descriptive tags rather than chaos data. Traders need not have prior knowledge of web farms lifecycle and its protection.

Drilling Information System (DIS) and Core Scanner

The Drilling Information System is a modular structure of databases, tailored user applications as well as web services and instruments including appropriate interfaces to DIS. This tool set has been developed for geoscientific drilling projects but is applicable to other distributed scientific operations. The main focuses are the data acquisition on drill sites (ExpeditionDIS), and the curation of sample material e.g., in core repositories (CurationDIS). Due to the heterogeneity of scientific drilling projects, a project-specific DIS is arranged and adjusted from a collection of existing templates and modules according to the user requirements during a one week training course. The collected data are provided to the Science Team of the drilling project by secured Web services, and stored in long-term archives hosted at GFZ. At the end the data sets and sample material are documented in an Operational Report (e.g., Lorenz et al., 2015) and published with assigned DOI (Digital Object Identifier) and IGSN (International Geo Sample Number; for physical samples) by GFZ Data Services.

Security Issues in Web Services: A Evaluation and Advancement Perspective Concerning Research Agenda

Web Service is comparatively emerging and also a significant area. The security challenges concerning Web Services in a dispersed environment are really a significant concern of research. Web service security measures are amongst the steady thrusts aspects of research both in industry as well as in academia. The existing efforts are primarily concentrating on specialized security issues of Web Services. The research is carried out according to the general framework of security issues. It is worthwhile for web service security to completely focus upon subject areas including access control, authentication, consistency in information, and also level of privacy. Security is so essential simply because web services communicate on a program to program factor. Main objective with these recommended efforts would be to explain the approach as well as applications of Multi–Part MultiSignature Document in the work flow environment as well as compares anywhere between XML signature security difficulties with the MPMSD. Furthermore, this work highlights the long term issues with regard to research as well as experimentation underneath the perspective of MPMSD

The SemSPM approach: fine integration of WS-SecurityPolicy semantics to enhance matching security policies in SOA

The lack of semantics in WS-SecurityPolicy standard hampers the effectiveness of matching security policies. To resolve this problem, we present a semantic approach for matching Web service security policies. The approach consists in the transformation of WS-SP into an OWL-DL ontology and the definition of a set of rules which automatically generate semantic relations that can exist between the provider and requestor security requirements. We show how these relations lead to more correct and refined matching of security policies. We also describe the implementation details of our approach and its validation through a real-world use case.

Secure model for SOAP message communication in web services

Simple object access protocol (SOAP) is the communication protocol used by web services to communicate between systems. Since SOAP messages have the ability to bypass firewalls and directly get processed by web servers, their security is critical to the security of the web servers. Secure transit of SOAP messages plays a critical role for the applicability of web services. At present, internet users authenticate themselves using credential are vulnerable to security threats in presence of active attackers. This imposes a burden on users to manage their credentials in different ways. Along with the thorough development and application for web services, the security of it has taken people's attention more and more. While web services security (WSS) can exchange safe SOAP message and enhance the security of web services, it will also have certain influence to the performance of web services. This paper explore the security vulnerability of SOAP message transaction and taking advantage of the existing technologies and solutions related to SOAP and web services, we developing a highly developed security model. This model is useful for solving the problem between security and performance contradiction.

Secure model for soap message communication in web services

Simple object access protocol (SOAP) is the communication protocol used by web services to communicate between systems. Since SOAP messages have the ability to bypass firewalls and directly get processed by web servers, their security is critical to the security of the web servers. Secure transit of SOAP messages plays a critical role for the applicability of web services. At present, internet users authenticate themselves using credential are vulnerable to security threats in presence of active attackers. This imposes a burden on users to manage their credentials in different ways. Along with the thorough development and application for web services, the security of it has taken people's attention more and more. While web services security (WSS) can exchange safe SOAP message and enhance the security of web services, it will also have certain influence to the performance of web services. This paper explore the security vulnerability of SOAP message transaction and taking advantage of the existing technologies and solutions related to SOAP and web services, we developing a highly developed security model. This model is useful for solving the problem between security and performance contradiction.

Web Services Attacks and Security- A Systematic Literature Review

Web Services allow applications to communicate with each other independent of platform and/or language. They are prone to attacks in the form of Denial-Of-Service, XML, XPath, SQL injection and spoofing, making implementation of web service security vital. Though many solutions are proposed for minimizing attacks, there is no single solution for mitigating all the attacks on web services. The objective of this paper is to present a systematic review on the studies of web service security. It is identified that there is lot of research going on in web services, dealing mostly with attack detection as well as identification of vulnerabilities in the services. Denial-of-service attack is found to be the most addressed of all attacks. Solutions were mainly proposed using dynamic analysis, closely followed by static analysis.

Design, Specification and Implementation of a Distributed Home Automation System

This work presents the design and model implementation of a novel home automation system applying the Internet of Things (IoT) technology. It seeks simplified design protocols for developing a robust home automation system to deal with the problems of complexity, multiple incompatible standards and the resulting expenses in the existing systems. The embedded system features the ubiquitous low-cost 32-bit ESP8266 System-on-chip (SoC) module interfaced to some sensors and actuators for interaction in the home. Flexibility in the remote access, operation and management is achieved through HTML5 based intuitive mobile and web GUI applications. Web Application Messaging Protocol (WAMP) is deployed to ensure that individual applications and systems seamlessly communicate with a relatively high level of security using robust web service security protocol. This system offers a cost-effective and efficient solution, because the costs of a dedicated public IP address and a high-end computer are excluded, which are present mostly in other solutions.

Access Control and Information Flow Control for Web Services Security

With the advancement of web services technology, security has become an increasingly important issue. Various security standards have been developed to secure web services at the transport and message level, but application level has received less attention. The security solutions at the application level focus on access control which cannot alone ensure the confidentiality and integrity of information. The solution proposed in this paper consists on a hybrid model that combines access control (AC) and information flow control (IFC). The AC mechanism uses the concept of roles and attributes to control user access to web services' methods. The IFC mechanism uses labels to control how the roles access to the system's objects and verify the information flows between them to ensure the information confidentiality and integrity. This manuscript describes the model, gives the demonstration of the IFC model safety, presents the modeling and implementation of the model and a case study.

From high waters forecasts to flooded areas forecasts

Flooded areas are key information to crisis managers, both at local and national level. They help sizing human and material resources to be deployed before and during a flood. These data already exist on several French rivers as they are been produced in a legislative framework but mainly addressing the hundred-year flood. The purpose of the Flood Forecasting Services is to complete water levels forecasting published on www.vigicrues.gouv.fr with forecasting information on spatial flooded areas. State services are developing new flooded areas ranging from first overflows to the hundred-year floods. A national database called VIGInond provides secure web services to access these new data. It was developed in 2015. A key step in the standardization of these new data is the collaboration between various state services. The access to VIGInond is initially opened to the Ministry of Interior services. This first step allows the operators to test and to understand the impacts of forthcoming flooding. Once tested, it will be made available to other crisis managers through the forthcoming Vigicrues® portal version 2. The new data will be gradually included in Vigicrues® watercourses, while coastal areas and new watercourses will be subsequently added. These new information will increase awareness of flooding risks among stakeholders and citizens in the near future.

Implementation of a Novel System for Cross Platform Communication of Diversified Applications over Network

Enterprises of all ends are trying to integrate and manage the data within a single sign on system. With the drastic increase in the usage of internet in the last decade, it has been observed that more and more use of web services throughout the industry. Data today is stored in various forms and structure in different OS, mainframes etc, the optimum way of managing this data and the most efficient way to access and retrieve this data is the need of the hour. This is where the versatility of web services comes into picture which enables enterprises and consumers to integrate numerous diversified platforms together to satisfy the essential requirements. This explores a dire need of a cost effective and efficient system that can integrate various cross platform applications to work together in a systematic environment. The aim of this research paper is to design and implement an organized system to demonstrate the data flow, architecture and the techniques used to integrate an ERP system with web applications. This is done by using a SOAP web service which integrates ASP.NET, Java and Database applications. Microsoft .NET as a platform for developing enterprise software is emerging for integration with SAP Enterprise. Interest in Web services is rapidly increased from their inception. To exchange information among various applications in a standard way is the main goal of web services. This communication between the applications is based on SOAP and REST principle. Web service is a software system designed to support interoperable machineto-machine interaction over a network. Currently, it has been emphasized quality and security of web services. Therefore, in this paper, the authors highlighted some standard trends such as SOAP, WSDL, UDDI for web services and the security policies to protect user information. This system is in Visual Studio 2010 development environment, using c# programming language, ASP.NET, ADO.NET and SQL Server database to jointly develop a B/S structure of ERP system.

USING ECONSULTS TO INFORM CARDIOLOGY CONTINUING MEDICAL EDUCATION NEEDS OF PRIMARY CARE PROVIDERS

Cardiology knowledge transfer for primary care providers (PCPs) has traditionally been delivered through continuing medical education (CME) events. Ideally, CME for PCPs should align with clinical questions and fill knowledge gaps required for patient care. Established in 2010, the Champlain BASE (Building Access to Specialist Advice) eConsultation service permits PCPs to submit patient-specific clinical questions to specialists via secure web service. To gain insight into PCP cardiology CME needs, we compared eConsult cardiology questions with topics offered at the largest provincial cardiology PCP CME events. 120 cardiology eConsult questions were categorized for type of question ie. diagnosis/treatment using a validated taxonomy, and the specific cardiology content modified from the International Classification for Primary Care (ICPC-2) by consensus of the investigators (CJ,NG,EK). The same taxonomy was used to classify cardiology content at the last 5 years of the Heart and Stroke Foundation of Ontario Annual Clinical Update, a CME course attended by 600 PCP’s per year. The content of the cardiology eConsult questions were compared with PCP cardiology CME topics. Cardiology-content specific categorization of 120 eConsults revealed questions related to arrhythmia (17%), drug/disease interactions (15%), CAD (13%), ECG (12%), AFib (11%), Echo (7%), thoracic aneurysm (5%), HTN (5%), lipids (4%), long QT syndrome (4%), other (7%). Cardiology-content specific categorization of 11480 minutes of cardiology topics at the Annual Clinical Update revealed content related to HTN (24%), CAD (20%), AFib (18%), CHF (11%), heart valve/murmur (6%), lipids (5%), risk Factors (4%), ECG (3%), other (9%). Review of the drug/disease interactions questions reveals that PCPs are asking about interactions between non-cardiac drugs (eg. psychiatric drugs) and a cardiac condition. Drug/disease interactions, thoracic aneurysm, and long QT syndrome account for 24% of eConsult questions, but are not covered at the Heart and Stroke Foundation of Ontario Annual Clinical Update. PCPs are asking about specific content areas that are not covered in the largest PCP cardiology CME event in our province. In particular, interaction between non-cardiac conditions / treatments and cardiac disease is an important area not being addressed. By evaluating questions generated from every-day patient problems faced by PCPs, our analysis can serve as a needs assessment to guide cardiology CME for PCPs. The value of eConsult content in directing specialist knowledge transfer to primary care physicians warrants further study.

Artificially Augmented Training for Anomaly-based Network Intrusion Detection Systems

Attacks on web servers are becoming increasingly prevalent; the resulting social and economic impact of successful attacks is also exacerbated by our dependency on web-based applications. There are many existing attack detection and prevention schemes, which must be carefully configured to ensure their efficacy. In this paper, we present a study challenges that arise in training network payload anomaly detection schemes that utilize collected network traffic for tuning and configuration. The advantage of anomaly-based intrusion detection is in its potential for detecting zero day attacks. These types of schemes, however, require extensive training to properly model the normal characteristics of the system being protected. Usually, training is done through the use of real data collected by monitoring the activity of the system. In practice, network operators or administrators may run into cases where they have limited availability of such data. This issue can arise due to the system being newly deployed (or heavily modified) or due to the content or behavior that leads to normal characterization having been changed. We show that artificially generated packet payloads can be used to effectively augment the training and tuning. We evaluate the method using real network traffic collected at a server site; We illustrate the problem at first (use of highly variable and unsuitable training data resulting in high false positives of 3.6∼10%), then show improvements using the augmented training method (false positives as low as 0.2%). We also measure the impact on network performance, and present a lookup based optimization that can be used to improve latency and throughput. Index Terms—Network security, Anomaly detection, Intrusion detection, Web server security, Training.

Security of Web Services: Methods and Contrivance

The increasing use of web services, the proved advantages of service-oriented architectures and continuously appliedattacks to them require utilization of given secure mechanisms that ensure the security at different levels. The aim of thepaper is to summarize the existing threats and attacks to web applications and web services. Contemporary securitystandards and good practices describing methods and contrivance for deciding security problems are explored too toreveal the present state in the field.

On the Detection of Fake Certificates via Attribute Correlation

Transport Layer Security (TLS) and its predecessor, SSL, are important cryptographic protocol suites on the Internet. They both implement public key certificates and rely on a group of trusted certificate authorities (i.e., CAs) for peer authentication. Unfortunately, the most recent research reveals that, if any one of the pre-trusted CAs is compromised, fake certificates can be issued to intercept the corresponding SSL/TLS connections. This security vulnerability leads to catastrophic impacts on SSL/TLS-based HTTPS, which is the underlying protocol to provide secure web services for e-commerce, e-mails, etc. To address this problem, we design an attribute dependency-based detection mechanism, called SSLight. SSLight can expose fake certificates by checking whether the certificates contain some attribute dependencies rarely occurring in legitimate samples. We conduct extensive experiments to evaluate SSLight and successfully confirm that SSLight can detect the vast majority of fake certificates issued from any trusted CAs if they are compromised. As a real-world example, we also implement SSLight as a Firefox add-on and examine its capability of exposing existent fake certificates from DigiNotar and Comodo, both of which have made a giant impact around the world.

Web Services Security: Threats and Challenges

One of the leading developments nowadays within distributed computing is Web Services. Essentially, a Web Service can easily be characterized as an XML structured interface that can easily be utilized by a client program to conjure a computing solution dispersed within a network by means of standard Internet protocols. In order for Web Services to turned out to be a widely used approach for the program to program communication, although, there necessity to be a reliable framework in place for exactly how Web Services that makes use of the general public Internet for transport can be appropriately safeguarded as well as secured. As the circumstances seems nowadays, the majority of services are not really openly revealed however they are frequently implemented within a corporate and business, exclusive network. This hinders the visualization of Web Services that can be openly published in directories which prospective consumers can browse to discover an appropriate service to gratify their particular requirement. This paper explains exactly what the standard threats and obstacles can be found in implementing secured Web Services over openly available and vulnerable networks, as they are described within the literature. It then proceeds to present an introduction to a few of the additional acknowledged security guidelines which happen to be starting to come through around.

Servicios y Seguridad, un enfoque basado en estrategias de ataque y defensa

This article describes the methodological approach of the subject Services and Security of the Bachelor's Degree in Information Technology and Services (Universitat Autonoma de Barcelona), which is taught at the Tomas Cerda Computer Science School. We propose an approach based on attack and defense strategies which are used in computer systems. Strategy models are the thread that relates how the rest of the topics as cryptography, security standards, threat modeling and risk assessment methodologies contribute in setting up a secure web service based system. The practical part includes laboratory sessions and development of a work of hacking. In the laboratory students learn to set up a web server application, to generate server and client's certificates, and to include security options into applications and web services. By doing the practical work students learn how to defend the system in a better way through the knowledge of the techniques and tools used by hackers to discover and exploit vulnerabilities of infrastructure and applications.

Single Sign-on Mechanism for Secure Web Service Access through ISSO

Single sign-on (SSO) is an emerging and more secure authentication mechanism that enables an authorized user with a single username/password to be authenticated by many service providers in a distributed network system. The existing technique used SSO scheme and it has achieved security by applying well-organized security parameters and its improved scheme introduced Verifiable Encryption of Signatures (RSA-VES). But the improvement of both the techniques with respect to security is not fully accomplished. We identified two attacks in existing SSO techniques. The first attack permits a malicious service provider to successfully communicate with a legal user more than one time and to recover the authenticated username/password and then to impersonate the service consumer to grant access to web resources and web services provided by other SP (Service Provider). Another attack is that a third party without any security credential may be able to access network services easily by impersonating some legal user or a fictional user. In our proposed work we introduced Improved Single sign-on (ISSO) scheme, which prevents Credential recovery attack, Impersonation attack and Data injection attack. We used the modified version of JMeter open source tool for generating the test report of the particular web apps. We implemented three web applications which provide financial solutions to customers. These three web applications used SOAP based request and response mapping for efficient handling of communication protocols. The testing result stated that the ISSO scheme fights against the attacks that were present in current SSO scheme.

Virtualization of open-source secure web services to support data exchange in a pediatric critical care research network.

To examine the feasibility of deploying a virtual web service for sharing data within a research network, and to evaluate the impact on data consistency and quality. Virtual machines (VMs) encapsulated an open-source, semantically and syntactically interoperable secure web service infrastructure along with a shadow database. The VMs were deployed to 8 Collaborative Pediatric Critical Care Research Network Clinical Centers. Virtual web services could be deployed in hours. The interoperability of the web services reduced format misalignment from 56% to 1% and demonstrated that 99% of the data consistently transferred using the data dictionary and 1% needed human curation. Use of virtualized open-source secure web service technology could enable direct electronic abstraction of data from hospital databases for research purposes.

XSD DDoS Trace Handler in Web Service Environment

Web services became a crucial tool for most of the Internet and Intranet applications and distributed systems due to its interoperability. As the usage is increased, performance and the security of Web services are facing a great impact due to DDoS attacks, XML Injection, XSS Injection etc. The hacker's major target is either to track the data down the line or to break the network bandwidth and feed in vulnerable data to collapse the system. Existing trends follow a stream based approach with encryption techniques to increase robustness, or a Double Guard Intrusion Detection System with light weight virtualization is adapted to prevent the attacks over multitier web services. Various prevalent techniques focus towards securing data, increasing robustness and improve the network bandwidth. But there is no focus towards the validation of the service request. The proposed XSD DDOS Trace Handler approach is an innovative framework that uses the concepts of Validate Handler for the input request based on input data standards and request timestamps from the specific host. It also implements the Totient Encryption Algorithm in the case of XML Injection Attacks wherein a clean monitoring of the source attributes is performed. This is achieved with a dynamic charting technique that overcomes the predominant injection and DDOS attacks in the service oriented architecture.