FSM4WSR: A Formal Model for Verifiable Web Service Runtime

With the rapid development of Internet, Web Service technology is gradually applied to many areas of life. The security problems occurred in practical applications of Web Service has received more and more attention from the public. Aiming at the security problems existing in the application process of Web Service, a secure real-time internal and external network data exchange method based on Web Service protocol is proposed in this paper, it is agreed that the external network only allows data exchange with the internal network through the Web Service interface, that is, the internal network starts the Web Service service, the external network accesses the service, and then obtains the internal network data or informs the internal network for business processing. Web attack detection is put to the front end to ensure maximum security of Web Service system, which can meet the requirements of more secure and robust web applications while guaranteeing the business security of visitors.

The popularity of web services has largely influenced the way in which enterprise business is conducted. Since web services enable easy accessibility of data, dynamic connections, and relatively less human interventions, ensuring confidentiality and integrity of data that is transmitted via web services protocols becomes more significant. If a single service does not fulfill the service consumer requirements, it is necessary to compose several web services, which together satisfy the user requirements. Security attacks occur on SOAP messages that are communicated among web services while accessing a service or during service composition. Most of the existing works on web services security have provided solutions only for ensuring client authentication, confidentiality, and integrity of information in network layer and not in application layer. WS-Security and XML based web service security also provides message layer security in network layer and not in application layer. Hence, a novel approach that prevents the message alteration attack on SOAP messages and a security solution that detects and overcomes XML injection attack have been proposed in this paper. Our approach uses pluggable APIs in the service provider side and security services in the middleware side. The attacks were simulated and non-vulnerability of the proposed solutions to these attacks have been verified.

Data mining and scoring tool providers require users to use provider-specific ways to invoke their services. The provider-specific approach could be a major factor affecting why data mining tools and applications are not currently as widespread as one might hope. However, SOA can implements the loose coupling between the services provider and services consumer. Using Web service protocol (such as SOAP, WSDL and UDDI), the data mining task can be encapsulated into a standard Web services. Services consumer can dynamically bound different services provider based on Web services, which implements the integration of data mining applications with data mining and scoring tool. The Java Data Mining API (JDM) is the first attempt to create a standard Java API to access data-mining tools from Java applications. A new service discovery model where quality of service is taken as constraints when searching for Web services would give some confidence to the Web service consumers about the quality of the service they are about to invoke.

Service-Oriented Communication (SOC) is a new development in the industry to enable communication through web services and SOA. SOC is to make communication as service and provide a service-oriented architecture to integrate communication in business applications. Recent advances of web service and SOA have made it possible for a full web service and SOA based communication paradigm over IP. This paper is an overview of the recent development in this area with a focus on key technologies that can be applied to web service enablement of communication. In particular, we discuss the generic web service based application session management based on WS-Session, the two-way full duplex web service interaction framework, and the development of Web Service Initiation Protocol (WIP). WIP is a full web service and SOA based communication protocol for multimedia and voice communication over IP. The generic web service approach of WIP overcomes many limitations which would be otherwise difficult to achieve in non-web service based communication methods used today. In addition, we discuss the service composition and orchestration framework based on WS-BPEL, and illustrate the application of this approach through some real use cases.

Most of the work on automated web service composition has focused so far on composition of stateful web services. This level of composition so-called "Process Level" considers web services with their internal and complex behaviors. At process level formal models such as State Transition Systems (STS from now) or Interface Automata are the most appropriate models to represent the internal behavior of stateful web services. However such models focus only on semantics of their behaviors and unfortunately not on semantics of actions and their parameters. In this paper, we suggest to extend the STS model, by following the WSMO based annotation for Abstract State Machine. This semantic enhancement of STS so called S2 TS will enable to model semantics of internal behaviors and semantics of their actions together with their input and output parameters. Secondly, we will focus on automated generation of data flow (or the process to perform automated assignments between parameter of services involved in a composition). Thus we do not restrict to assignments of exact parameters (which is practically never used in industrial scenario) but extend assignments to semantically close parameters (e.g., through a subsumption matching) in the same ontology. Our system is implemented and interacting with web services dedicated to Telecommunication scenarios. The preliminary evaluation results showed high efficiency and effectiveness of the proposed approach.

Web services and service-oriented architecture are emerging technologies that are changing the way we develop and use computer software. Due to the standardization of Web services related description languages and protocols, as well as the open platforms, for the same Web service specification, many different implementations can be offered from different service providers. This paper presents an adaptive group testing technique that can test large number Web services simultaneously and effectively. Based on a case study, experiments are performed to validate the correctness and effectiveness of the technique.

Web Service Choreography Description Language (WS-CDL) describes and orchestrates the services interactions among multiple participants. WS-CDL verification is essential since the interactions would lead to mismatches. Existing works verify the messages ordering, the flow of messages, and the expected results from collaborations. In this paper, we present a Z specification of WS-CDL. Besides verifying the mentioned concerns, we find out whether the choreographies are realizable by web services protocols at orchestration level. In this regard we detect the interactions between each two distinct participants which lead to deadlock or unspecified reception. An ‘itinerary purchase’ case study for prototyping the transformation rules is presented and the Z/EVES tool is used to demonstrate the protocol compatibility. Also, we define multiple attributes to compare the choreography description languages/models from the verification and adaptation viewpoints.

Today' s broad coverage of mobile networks allows for large-scale environmental monitoring systems capable of warning citizens prior to an incident. In this paper, we present an embedded prototype system which collects environmental data and distributes them either using Web service protocols or using the JXTA Peer-to-Peer protocol stack. The complete system was implemented based on both protocol stacks in order to prove their applicability for a middleware solution in the field of sensor networks. The performance of both stacks is analyzed, utilizing an embedded sensor gateway node with a wireless GPRS connection. In case of the Web service approach standard XML-based SOAP messages as well as WAP binary XML (WBXML) based SOAP messages are examined and compared against the JXTA peer-to-peer protocol. Both the processing power of the embedded sensor gateway node and the throughput of the GPRS-based wireless communication channel are the major bottlenecks focused in this performance evaluation. In our scenario WBXML is the favorable approach for small sets of data being transmitted over the wireless link whereas JXTA is the favorable approach for large sets of data.

At the core of this work is the idea of integrating tools from third-party providers into e-learning systems exposed as Web Services. Although some progress is being done in this field by the research community, current solutions achieve at best a very “soft” integration, namelly, the e-learning system can link an external tool but cannot monitor or alter its workflow. The proposed solution tries to alleviate this problem by introducing an architecture that allows an e-learning system to track the use that teachers and students make of the tool. The system is based on Web Services and specific APIs and protocols, resulting on a simple and scalable architecture.

Traditional formal methods for analyzing security protocols have gained great success to find attacks or prove their absence in the standard Dolev-Yao model. However, they cannot be applied directly to verify Web services protocols because of their inherent different message syntax. In this paper, we apply our justification-oriented and automatic formal approach again to verify directly security properties for a more complex Web services protocol, based on a fault-preserving mapping tool called SuD (SOAP under Dolev-Yao) and the well developed epistemic logic (logic of knowledge) as the underlying specification language. The effectiveness of the approach can be further confirmed by the experimental results.

The internet is based on a universally accepted set of protocols, HTTP, DNS, and TCP/IP, that provide the foundation for web-based cloud computing offerings. In this chapter we examine three critical web-based technologies at the next level of granularity that have been instrumental in improving the usability of web-based applications: Web services are used to request for and access infrastructure services in the cloud; AJAX-based user interfaces allow web-based applications to be user friendly; finally mashups bring a new dimension to software as a service by enabling users to compose multiple SaaS applications into a single user interface. WEB SERVICES: SOAP AND REST We have discussed the genesis and evolution of web services briefly in Chapter 2. Here we give a brief technical overview of both SOAP/WSDL and REST-based web services, and also compare these in the context of their utility in building cloud-based offerings. For a more detailed description of web services protocols, see [30]. SOAP/WSDL Web services SOAP/WSDL web services evolved from the need to programmatically interconnect web-based applications. As a result SOAP/WSDL web services are essentially a form of remote procedure calls over HTTP, while also including support for nested structures (objects) in a manner similar to earlier extensions of RPC, such as CORBA; we shall return to this point later. The elements of a SOAP/WSDL web service are illustrated in Figure 7.1, using as an example the service provided by Google for searching the web.

This paper presents a Byzantine fault tolerant protocol for composite Web Services. We extend Castro and Liskov's well-known practical Byzantine fault tolerance method for the server client model and Tadashi Araragi's method for the agent system to a method for the composite Web Services. Different from other Byzantine tolerant methods for single web service, in composite Web Services we have to create replicas on both sides, while in the server-client model of Castro and Liskov's method, replicas are created only on the server side. We present a modular implementation, and experimental results demonstrate only a moderate overhead due to replication.

Service-oriented programming model provides an effective way to integrate different applications across distributed, heterogeneous, dynamic environment which is common in e-business. Web service, with WSDL, SOAP and related protocols, is such an industrial effort to address the interoperation of different systems. Service composition is to combine such services, which distributed among different organizations, to new complex and value-added service while preserving the autonomy of the old ones. In this paper, we identify some common patterns and scenarios of service composition and then propose a general framework for dynamic service publish, discovery and life management which is the basis of service composition. By extending and enhancing web service definition, a route-based composition language xSCL is proposed to solve problems that impede service reuse.

Enterprises willing to develop Service-Oriented Software (SOS) need to manage their Web Services (WSs) for flexible, agile, quality composition. This paper presents architecture and a specification of a CASE tool for: (1) WSs development and deployment, (2) software composition, and (3) management of WSs, compositions, and the platform on which they run. It specifies the components of the CASE tool architecture that are: (1) a meta-model representing WSs from different perspectives, namely WSs description, legacy systems they wrap, software composed out of them, and their running platform, and (2) a set of management artifacts built on top of the meta-model.

Web service is an Internet-based software component that can shield all sorts of resources on basis of standard protocol stack. It helps to raise the level of abstraction and simplify conventional COTS middleware for resource sharing and cooperation across organization. In this paper, a Web service container framework (WSCF) is presented to offer an effective systematic solution for Web service-based application supporting environment, referencing from CORBA and J2EE system managing architecture and using SOAP interoperation protocol. The proposed framework focuses on addressing problems in two aspects: 1) Web service runtime supporting technologies: unified resource mapping strategy, flexible service adaptation mechanism, and SOAP engine scheduling algorithm; 2) several application supporting services: publication and discovery service, Web service composition service, and security service, etc. In particular, it describes ongoing project StarWebService that has followed WSCF. Finally, some open issues about WSCF are introduced and the future direction of WSCF is pointed out.