Verifying policy-based web services security

We present material on how to use the architectures and technologies and how to understand the specifications that are available to build a secure Web Services system. Since this technology is rapidly changing, we present the theory behind the models and explain the thinking behind many of the security specifications that are at the forefront of the technology today. Our emphasis is on showing you how to build and understand the complexities of a secure end-to-end Web Services system. This book gives you both a detailed technical understanding of the major components of an end-to-end enterprise security architecture and a broad description of how to deploy and use Web Services security technologies to protect your corporation and its interaction with the outside world.

Web service architectures have gained popularity in recent years within the scientific grid research community. One reason for this is that web services allow software and services from various organizations to be combined easily to provide integrated and distributed applications. However, most applications developed and used by scientific communities are not web-service-oriented, and there is a growing need to integrate them into grid applications based on service-oriented architectures. In this paper, we describe a framework that allows scientists to provide a web service interface to their existing applications as web services without having to write extra code or modify their applications in any way. In addition, application providers do not need to be experts in web services standards, such as Web Services Description Language, Web Services Addressing, Web Services Security, or secure authorization, because the framework automatically generates these details. The framework also enables users to discover these application services, interact with them, and compose scientific workflows from the convenience of a grid portal.

Web servers and the Web services associated with them have become increasingly important in the last few years. Online banking, e-mail, and money, business- to-business (B2B), and business-to-client (B2C) transactions are growing rapidly. It is difficult to imagine modern business without these forms of networking. However, there are also significant negative aspects. In many cases, due to competitive pressures, companies and government agencies had to implement these services very fast, often too fast and without any appreciation of the concepts of security and protection. As a consequence, it turns out that a hacker can misuse with little effort these Web services or compromise the underlying database (e.g., to obtain access to credit cards numbers or social insurance information). A very significant percentage of the population in developed and developing countries is using wired and wireless connections for reading e-mails, accessing newsgroups, or using Internet banking. All these services are running on a Web server. Most Web servers are running the Apache or the Microsoft Internet Information Server (IIS) (all versions of both servers [Apache 1.3.x/2.x, IIS 3-6]) (Netcraft, 2006). Of these, older versions of the Internet Information Server are especially vulnerable to numerous attacks. Therefore, an attacker is in a position to break, with little effort, into many Web servers running IIS 4 or 5. However, the Apache Web server (running on Windows systems) is also vulnerable to similar attacks. Moreover, using a Web server based on UNIX or Linux is not a guarantee for a secure system. UNIX and Linux systems are also affected by inherent weaknesses and vulnerabilities such as buffer overflows and the handling of format strings (ZDNet, 2006). Readers who like to have more general insight are referred to works by Leiss (1990) and Garfinkel and Spafford (2002). These books give broader perspectives on Internet security.

A Web Service Architecture for Enforcing Access Control Policies

The popularity of web services has largely influenced the way in which enterprise business is conducted. Since web services enable easy accessibility of data, dynamic connections, and relatively less human interventions, ensuring confidentiality and integrity of data that is transmitted via web services protocols becomes more significant. If a single service does not fulfill the service consumer requirements, it is necessary to compose several web services, which together satisfy the user requirements. Security attacks occur on SOAP messages that are communicated among web services while accessing a service or during service composition. Most of the existing works on web services security have provided solutions only for ensuring client authentication, confidentiality, and integrity of information in network layer and not in application layer. WS-Security and XML based web service security also provides message layer security in network layer and not in application layer. Hence, a novel approach that prevents the message alteration attack on SOAP messages and a security solution that detects and overcomes XML injection attack have been proposed in this paper. Our approach uses pluggable APIs in the service provider side and security services in the middleware side. The attacks were simulated and non-vulnerability of the proposed solutions to these attacks have been verified.

As the Internet has been growing, WWW(World Wide Web) based services were popularized and users using the service were increased excessively. Web service is a software system designed to support interoperable machine-to-machine interaction over a network. Currently, it has been emphasized quality and security of web services. Therefore, in this paper, we described standard trends such as SOAP, WSDL, UDDI for web services and the security policies to protect user information. Eventually, we described a mechanism to use bio information for protection of user information.

Simple object access protocol (SOAP) is the communication protocol used by web services to communicate between systems. Since SOAP messages have the ability to bypass firewalls and directly get processed by web servers, their security is critical to the security of the web servers. Secure transit of SOAP messages plays a critical role for the applicability of web services. At present, internet users authenticate themselves using credential are vulnerable to security threats in presence of active attackers. This imposes a burden on users to manage their credentials in different ways. Along with the thorough development and application for web services, the security of it has taken people's attention more and more. While web services security (WSS) can exchange safe SOAP message and enhance the security of web services, it will also have certain influence to the performance of web services. This paper explore the security vulnerability of SOAP message transaction and taking advantage of the existing technologies and solutions related to SOAP and web services, we developing a highly developed security model. This model is useful for solving the problem between security and performance contradiction.

Web services technologies change the software industry drastically by developing and integrating enterprise web services and applications in order to enable the users to access them. There are several research initiatives in the field of Web services for enterprise applications. However, none of the initiatives have attempted for web applications pertaining to academic institution using Web services technology. Web service composition is the combination of web services from different service providers to create a more sophisticated, value added web service to the web users. Researchers put on efforts to bring out the state-of-the art in web services technologies and security technologies for web services. The composition of web services is another promising area for research and development. A study reveals that there are number of approaches providing secure web services. However, there is no attempt made so far to secure the services at multi-level. This paper proposes a Multi-level Secured Framework (MLSF) for the students, faculty and employees of the academic institutions which provides secured composite web services such as admission service, fees payment service, library service, personalized service and so on. The MLSF enhances the security at various levels such as user level, device level, web services level and institution level.

Key Derivation is an important part of numerous security standards, the importance of using it was discussed throughout the literature and industry standards. On the other hand, web service security is an area that has not seen substantial research and application for Key Derivation techniques. After studying the Key Derivation techniques which are applied in Web Service Security, we find the applied algorithms and current implementations to be very limited in regard to performance and their work-flow. These limitations introduce performance bottlenecks that can limit their applicability to low power machines and mobile systems or lead to designers compromising on security to meet the quality of service desired. Moreover, this issue becomes more relevant when applied to a high performance and demanding systems such as real-time business process monitoring and messaging systems. This paper explores how Key Derivation is implemented in web services and WS-Security engines, their limitations, the performance overhead it produces and proposes an enhanced Key Derivation work-flow that takes into consideration both security and performance and allows for fine tuning them. The performance of the proposal is tested using a series of benchmarks and the security properties are verified using a well-known validation tool.

Background/Objectives: Service oriented Architecture (SOA) infrastructures using web services are deployed by many firms worldwide. Web Services provide a standard means of inter-operation between heterogeneous software applications that run on a variety of platforms. Most of the web services are offered with HTTP over Simple Object Access Protocol (SOAP) as the underlying infrastructure. The greatest web security threat is accepting the request from the client without proper validation. The objective is to separate the application logic and the security or validation procedures which offers more advantage for software reuse since it is not necessary to recompile, when the validation or security requirements change. Methods: An Interceptor is created for validation which has the token based authentication procedures along with the steps for validating the data. The system is devised in such a way that the business logic will be triggered if and only if the data is validated and passed by the interceptor procedures. Findings: The proposed system provides a way to keep the validation and security mechanism out of application logic and hence this does not modify the existing functionality. Thus, combining all custom security as one unit of validation before hitting the business logic is the basic idea of the proposed system.

To address the challenges in Web services security, the author firstly analyzed threats facing Web services and related security standards, presented integrated security framework based on use of authentication, authorization, confidentiality, and integrity mechanisms for Web services, and proposed how to integrate and implement these security mechanisms in order to make Web services robust against the attacks.

A key challenge in Web services security is the design of effective access control schemes that can adequately meet the unique security challenges posed by the Web services paradigm. Despite the recent advances in Web based access control approaches applicable to Web services, there remain issues that impede the development of effective access control models for Web services environment. Amongst them are the lack of context-aware models for access control, and reliance on identity or capability-based access control schemes. Additionally, the unique service access control features required in Web services technology are not captured in existing schemes. In this paper, we motivate the design of an access control scheme that addresses these issues, and propose an extended, trust-enhanced version of our XML-based Role Based Access Control (X-RBAC) framework that incorporates trust and context into access control. We outline the configuration mechanism needed to apply our model to the Web services environment, and provide a service access control specification. The paper presents an example service access policy composed using our framework, and also describes the implementation architecture for the system.

Web services (WS) are considered amongst the most successful and convenient way which can take the advantages of the Internet in a flexible and reusable manner. WS constitute now the corner stone of any exchanged transaction over the Internet between any given organizations or more specifically between a client and a provider. Unfortunately, despite the considerable efforts made by researchers of this field in the recent years, security and flexibility of WS still constitute a big challenge. So far WS and the corresponding providers’ URLs are, indeed, advertised on specific UDDIs (Universal Description, Discovery and Integration) where the only role to be achieved is limited to the advertisement. As such, after finding the requested service any given client contacts the right provider to negotiate the service access procedure. These first contacts between clients and providers are usually unprotected (not Encrypted) yielding enough room for Hackers to intrude into these unprotected messages. To solve this problem, we proposed in our previous study [12] a new idea based on the utilization of PKI and the improvement of the UDDI which must play in addition to its initial missions the role of a trust centre lading, thus, to secure WS. In this paper, we pursue our study by attempting to solve also the flexibility problem of WS by using agent technology. More specifically, we are concerned by the flexibility that allows to any given provided WS to be used in different ways (several possibilities of composition with other WS to achieve several missions) by a given client within a fixed delay with a single contract.

The Internet is changing the way businesses operate today. Firms are using the Web for procurement, to find trading partners, and to link existing applications to other applications. Web services are rapidly becoming the enabling technology of today’s e‐business, and e‐commerce systems. We are having a massive impact on the way businesses think about designing, developing, and deploying Web‐based applications. Web services may be an evolutionary step in designing distributed applications, however, they are not without problems. There are issues relating to security, transactions and scalability that need to be addressed. This paper addresses security concerns in Web services and the role of technology trust.

The number of web services available on the Internet has grown rapidly. Service consumers face a hard decision over which service to choose among the available ones. Security holds a key after various vulnerabilities have been exploited by attackers on number of notable web services. This paper carries out a survey on how security has been expressed and promised for web services, through both the Web Service Description Language and Service Level Agreements. It reviews existing technologies used for comparing individual web services, as well as for service compositions. Taking security into account further complicates the already difficult process of choosing the right service. The paper reveals that despite existing efforts, a quantitative solution needs to be established urgently in order to help service consumers to choose the most secure service for them to use.