Mastering Web Services Security

Users of Web and grid services often must temporarily delegate some or all of their rights to a software entity to perform actions on their behalf. The problem with the typical grid services approach (X. 509 proxy certificates) is that commercial Web services tooling fails to recognize these certificates or process them properly. The security assertion markup language (SAML) is a standardized XML-based framework for exchanging authentication, authorization and attribute information. SAML has broadening commercial support but lacks delegation capabilities. To address this shortcoming, we exploit SAML's inherent extensibility to create a delegation framework for Web and grid services that supports both direct and indirect delegation. We develop a set of verification rules for delegation tokens that rely on WS-Security X.509 signatures, but do not force any trust relationship between the delegatee and the target service. We have implemented the framework on two common Web service hosting environments: Java/Tomcat and .NET. By leveraging existing Web services standards, we make it easier for Grid practitioners to build and consume Web and grid services without resorting to grid-specific protocols.

This article discusses the main security requirements for Web services and it describes how such security requirements are addressed by standards for Web services security recently developed or under development by various standardizations bodies. Standards are reviewed according to a conceptual framework that groups them by the main functionalities they provide. Covered standards include most of the standards encompassed by the original Web Service Security roadmap proposed by Microsoft and IBM in 2002 (Microsoft and IBM 2002). They range from the ones geared toward message and conversation security and reliability to those developed for providing interoperable Single Sign On and Identity Management functions in federated organizations. The latter include Security Assertion Markup Language (SAML), WS-Policy, XACML, that is related to access control and has been recently extended with a profile for Web services access control; XKMS and WS-Trust; WS-Federation, LibertyAlliance and Shibboleth, that address the important problem of identity management in federated organizations. The article also discusses the issues related to the use of the standards and open research issues in the area of access control for Web services and innovative digital identity management techniques are outlined.

Web service architectures have gained popularity in recent years within the scientific grid research community. One reason for this is that web services allow software and services from various organizations to be combined easily to provide integrated and distributed applications. However, most applications developed and used by scientific communities are not web-service-oriented, and there is a growing need to integrate them into grid applications based on service-oriented architectures. In this paper, we describe a framework that allows scientists to provide a web service interface to their existing applications as web services without having to write extra code or modify their applications in any way. In addition, application providers do not need to be experts in web services standards, such as Web Services Description Language, Web Services Addressing, Web Services Security, or secure authorization, because the framework automatically generates these details. The framework also enables users to discover these application services, interact with them, and compose scientific workflows from the convenience of a grid portal.

A Web Service Architecture for Enforcing Access Control Policies

Web servers and the Web services associated with them have become increasingly important in the last few years. Online banking, e-mail, and money, business- to-business (B2B), and business-to-client (B2C) transactions are growing rapidly. It is difficult to imagine modern business without these forms of networking. However, there are also significant negative aspects. In many cases, due to competitive pressures, companies and government agencies had to implement these services very fast, often too fast and without any appreciation of the concepts of security and protection. As a consequence, it turns out that a hacker can misuse with little effort these Web services or compromise the underlying database (e.g., to obtain access to credit cards numbers or social insurance information). A very significant percentage of the population in developed and developing countries is using wired and wireless connections for reading e-mails, accessing newsgroups, or using Internet banking. All these services are running on a Web server. Most Web servers are running the Apache or the Microsoft Internet Information Server (IIS) (all versions of both servers [Apache 1.3.x/2.x, IIS 3-6]) (Netcraft, 2006). Of these, older versions of the Internet Information Server are especially vulnerable to numerous attacks. Therefore, an attacker is in a position to break, with little effort, into many Web servers running IIS 4 or 5. However, the Apache Web server (running on Windows systems) is also vulnerable to similar attacks. Moreover, using a Web server based on UNIX or Linux is not a guarantee for a secure system. UNIX and Linux systems are also affected by inherent weaknesses and vulnerabilities such as buffer overflows and the handling of format strings (ZDNet, 2006). Readers who like to have more general insight are referred to works by Leiss (1990) and Garfinkel and Spafford (2002). These books give broader perspectives on Internet security.

The popularity of web services has largely influenced the way in which enterprise business is conducted. Since web services enable easy accessibility of data, dynamic connections, and relatively less human interventions, ensuring confidentiality and integrity of data that is transmitted via web services protocols becomes more significant. If a single service does not fulfill the service consumer requirements, it is necessary to compose several web services, which together satisfy the user requirements. Security attacks occur on SOAP messages that are communicated among web services while accessing a service or during service composition. Most of the existing works on web services security have provided solutions only for ensuring client authentication, confidentiality, and integrity of information in network layer and not in application layer. WS-Security and XML based web service security also provides message layer security in network layer and not in application layer. Hence, a novel approach that prevents the message alteration attack on SOAP messages and a security solution that detects and overcomes XML injection attack have been proposed in this paper. Our approach uses pluggable APIs in the service provider side and security services in the middleware side. The attacks were simulated and non-vulnerability of the proposed solutions to these attacks have been verified.

As the Internet has been growing, WWW(World Wide Web) based services were popularized and users using the service were increased excessively. Web service is a software system designed to support interoperable machine-to-machine interaction over a network. Currently, it has been emphasized quality and security of web services. Therefore, in this paper, we described standard trends such as SOAP, WSDL, UDDI for web services and the security policies to protect user information. Eventually, we described a mechanism to use bio information for protection of user information.

Simple object access protocol (SOAP) is the communication protocol used by web services to communicate between systems. Since SOAP messages have the ability to bypass firewalls and directly get processed by web servers, their security is critical to the security of the web servers. Secure transit of SOAP messages plays a critical role for the applicability of web services. At present, internet users authenticate themselves using credential are vulnerable to security threats in presence of active attackers. This imposes a burden on users to manage their credentials in different ways. Along with the thorough development and application for web services, the security of it has taken people's attention more and more. While web services security (WSS) can exchange safe SOAP message and enhance the security of web services, it will also have certain influence to the performance of web services. This paper explore the security vulnerability of SOAP message transaction and taking advantage of the existing technologies and solutions related to SOAP and web services, we developing a highly developed security model. This model is useful for solving the problem between security and performance contradiction.

Web services technologies change the software industry drastically by developing and integrating enterprise web services and applications in order to enable the users to access them. There are several research initiatives in the field of Web services for enterprise applications. However, none of the initiatives have attempted for web applications pertaining to academic institution using Web services technology. Web service composition is the combination of web services from different service providers to create a more sophisticated, value added web service to the web users. Researchers put on efforts to bring out the state-of-the art in web services technologies and security technologies for web services. The composition of web services is another promising area for research and development. A study reveals that there are number of approaches providing secure web services. However, there is no attempt made so far to secure the services at multi-level. This paper proposes a Multi-level Secured Framework (MLSF) for the students, faculty and employees of the academic institutions which provides secured composite web services such as admission service, fees payment service, library service, personalized service and so on. The MLSF enhances the security at various levels such as user level, device level, web services level and institution level.

Key Derivation is an important part of numerous security standards, the importance of using it was discussed throughout the literature and industry standards. On the other hand, web service security is an area that has not seen substantial research and application for Key Derivation techniques. After studying the Key Derivation techniques which are applied in Web Service Security, we find the applied algorithms and current implementations to be very limited in regard to performance and their work-flow. These limitations introduce performance bottlenecks that can limit their applicability to low power machines and mobile systems or lead to designers compromising on security to meet the quality of service desired. Moreover, this issue becomes more relevant when applied to a high performance and demanding systems such as real-time business process monitoring and messaging systems. This paper explores how Key Derivation is implemented in web services and WS-Security engines, their limitations, the performance overhead it produces and proposes an enhanced Key Derivation work-flow that takes into consideration both security and performance and allows for fine tuning them. The performance of the proposal is tested using a series of benchmarks and the security properties are verified using a well-known validation tool.

To address the challenges in Web services security, the author firstly analyzed threats facing Web services and related security standards, presented integrated security framework based on use of authentication, authorization, confidentiality, and integrity mechanisms for Web services, and proposed how to integrate and implement these security mechanisms in order to make Web services robust against the attacks.

A key challenge in Web services security is the design of effective access control schemes that can adequately meet the unique security challenges posed by the Web services paradigm. Despite the recent advances in Web based access control approaches applicable to Web services, there remain issues that impede the development of effective access control models for Web services environment. Amongst them are the lack of context-aware models for access control, and reliance on identity or capability-based access control schemes. Additionally, the unique service access control features required in Web services technology are not captured in existing schemes. In this paper, we motivate the design of an access control scheme that addresses these issues, and propose an extended, trust-enhanced version of our XML-based Role Based Access Control (X-RBAC) framework that incorporates trust and context into access control. We outline the configuration mechanism needed to apply our model to the Web services environment, and provide a service access control specification. The paper presents an example service access policy composed using our framework, and also describes the implementation architecture for the system.

Background/Objectives: Service oriented Architecture (SOA) infrastructures using web services are deployed by many firms worldwide. Web Services provide a standard means of inter-operation between heterogeneous software applications that run on a variety of platforms. Most of the web services are offered with HTTP over Simple Object Access Protocol (SOAP) as the underlying infrastructure. The greatest web security threat is accepting the request from the client without proper validation. The objective is to separate the application logic and the security or validation procedures which offers more advantage for software reuse since it is not necessary to recompile, when the validation or security requirements change. Methods: An Interceptor is created for validation which has the token based authentication procedures along with the steps for validating the data. The system is devised in such a way that the business logic will be triggered if and only if the data is validated and passed by the interceptor procedures. Findings: The proposed system provides a way to keep the validation and security mechanism out of application logic and hence this does not modify the existing functionality. Thus, combining all custom security as one unit of validation before hitting the business logic is the basic idea of the proposed system.

SAML is an XML based single sign-on (SSO) standard which enables the exchange of authentication, authorization, and profile information between different entities. This provides interoperability between different security services in the distributed environments. In this paper, we designed and implemented a Java-Based SSO library made up of SAML APIs, and then constructed a prototype of distributed Web applications to validate these SAML APIs.

Web services (WS) are considered amongst the most successful and convenient way which can take the advantages of the Internet in a flexible and reusable manner. WS constitute now the corner stone of any exchanged transaction over the Internet between any given organizations or more specifically between a client and a provider. Unfortunately, despite the considerable efforts made by researchers of this field in the recent years, security and flexibility of WS still constitute a big challenge. So far WS and the corresponding providers’ URLs are, indeed, advertised on specific UDDIs (Universal Description, Discovery and Integration) where the only role to be achieved is limited to the advertisement. As such, after finding the requested service any given client contacts the right provider to negotiate the service access procedure. These first contacts between clients and providers are usually unprotected (not Encrypted) yielding enough room for Hackers to intrude into these unprotected messages. To solve this problem, we proposed in our previous study [12] a new idea based on the utilization of PKI and the improvement of the UDDI which must play in addition to its initial missions the role of a trust centre lading, thus, to secure WS. In this paper, we pursue our study by attempting to solve also the flexibility problem of WS by using agent technology. More specifically, we are concerned by the flexibility that allows to any given provided WS to be used in different ways (several possibilities of composition with other WS to achieve several missions) by a given client within a fixed delay with a single contract.