Article

An access control language for web services

Authors:

Emin Gün Sirer,

Ke WangAuthors Info & Claims

SACMAT '02: Proceedings of the seventh ACM symposium on Access control models and technologies

Pages 23 - 30

https://doi.org/10.1145/507711.507715

Published: 03 June 2002 Publication History

Abstract

This paper presents an approach for formally specifying and enforcing security policies on web service implementations. Networked services in general, and web services in particular, require extensive amounts of code to ensure that clients respect site-integrity constraints. We provide a language by which these constraints can be expressed and enforced automatically, portably and efficiently. Security policies in our system are specified in a language based on temporal logic, and are processed by an enforcement engine to yield site and platform-specific access control code. This code is integrated with a web server and platform-specific libraries to enforce the specified policy on a given web service. Our approach decouples the security policy specification from service implementations, provides a mandatory access control model for web services, and achieves good performance. We show that up to 22% of the code in a traditional web service module is dedicated to security checking functionality, including checks for client sequencing and parameter validation. We show that our prototype language implementation, WebGuard, enables web programmers to significantly reduce the amount of security checking code they need to develop manually. The quality of the code generated by WebGuard from formal policy specifications is competitive with the latency of handcrafted code to within a few percent.

References

[1]

L. Badger and D. F. Sterne and D. L. Sherman and K. M. Walker. Practical Domain and Type Enforcement for UNIX. In IEEE Symposium on Security and Privacy, Oakland, California, May 1995, 66--77.]]

Digital Library

[2]

J. Barkley, A. Cincotta, D. Ferraiolo, S. Gavrila, and D.R. Kuhn. Role Based Access Control for the World Wide Web. In Proceedings of the 20th National Information System Security Conference, NIST/NSA, 1997.]]

[3]

D. Bell and L. LaPadula. Secure Computer System: Unified Exposition and Multics Interpretation. Technical Report MTR-1997, MITRE, Bedford, MA, 1975.]]

[4]

E. Bertino, P. A. Bonatti, E. Ferrari. TRBAC: A Temporal Role-based Access Control Model. In Proceedings of the Fifth ACM Workshop on Role-based Access Control. July 2000.]]

Digital Library

[5]

K. J. Biba. Integrity Constraints for Secure Computer Systems. Technical Report ESD-TR76-372, USAF Electronic System Division, Bedford, Massachusetts, April 1977.]]

[6]

M. Bishop. How to Write a Setuid Program. ;login: The USENIX Association Newsletter, 12(1):5--11, Jan./Feb. 1987.]]

[7]

W.E. Boebert and R.Y. Kain, A Practical Alternative to Hierarchical Integrity Policies. In Proceedings of the 8th National Computer Security Conf., Gaithersburg, MD, 1985.]]

[8]

S. Bunch. The Setuid Feature in UNIX and Security. In Proceedings of Tenth National Computer Security Conference, September 1987, 245--253.]]

[9]

CNet. Microsoft plugs Hotmail security hole. http://news.cnet.com/news/0-1003-200-6941020.html, August 2001.]]

[10]

E. Damiani, S. De Capitani di Vimercati, S. Paraboschi, P. Samarati. Securing XML Documents. In Proceedings. of the 2000 International Conference on Extending Database Technology, Konstanz, Germany, March 27--31, 2000.]]

Digital Library

[11]

E. Damiani, S. De Capitani di Vimercati, S. Paraboschi, P. Samarati. XML Access Control Systems: A Component-Based Approach. In Proceedings of IFIP WG11.3 Working Conf. on Database Security, Schoorl, The Netherlands, August 21--23, 2000.]]

Digital Library

[12]

E.W. Dijkstra. Guarded Commands, Nondeterminacy and Formal Derivation of Programs. Communication of the ACM, vol. 18, num. 8, 453--457, Aug 1975.]]

Digital Library

[13]

U. Erlingsson and F. B. Schneider. SASI Enforcement of Security Policies: A Retrospective. In Proceedings of the 1999 New Security Paradigms Workshop, Caledon Hills, Sept.1999.]]

Digital Library

[14]

D. Ferraiolo and R. Kuhn. Role-Based Access Control. In Proceedings of the 15th National Computer Security Conference, Baltimore, Maryland, 1992, 554--563.]]

[15]

J. Goguen and J.Meseguer. Security Policies and Security Models. In Proceedings of the 1982 IEEE Symp. on Research in Security and Privacy, IEEE Computer Society Press, 1982.]]

[16]

G.Graham and P.Denning. Protection: Principles and Practice. In Proceeding of Spring Joint Computer Conf., AFIPS Press, 1972.]]

[17]

M. Gray. Web Growth Summary. http://www.mit.edu/people/mkgray/net/, December 1997.]]

[18]

S. Jajodia, P. Samarati, and V.S. Subrahmanian. A Logical Language for Expressing Authorizations. In Proceedings of the 1997 IEEE Symposium on Security and Privacy. Oakland, CA, USA: IEEE Press, 1997. 31--42.]]

Digital Library

[19]

D. Kristol, L. Montulli. HTTP State Management Mechanism. Request for Comments RFC-2965, Internet Engineering Task Force, October 2000.]]

Digital Library

[20]

B. Lampson. Protection. In Proceedings of 5th Princeton Symposium on Information Sciences and Systems, March 1971. Reprinted in ACM Operating Systems Review, 8(1) 1974.]]

Digital Library

[21]

L. Lamport. The Temporal Logic of Actions. ACM Transactions on Programming Languages and Systems, 16(3), 872--923, 1994.]]

Digital Library

[22]

Z. Manna and A. Pnueli. The Temporal Logic of Reactive and Concurrent Systems. Springer-Verlag: Heidelberg, Germany, 1992.]]

Digital Library

[23]

OpenACS Documentation. http://www.openacs.org/, December 2001.]]

[24]

R. Sandhu, E.J. Coyne, H.L. Feinstein, and C.E. Youman. Role Based Access Control Models. IEEE Computer, 29(2), Feb.1996.]]

Digital Library

[25]

R. S. Sandhu. Lattice-based Access Control Models. IEEE Computer, 26(11): 9--19, November 1993.]]

Digital Library

[26]

F. B. Schneider. Enforceable Security Policies. TR 98-1664, Dept. of Computer Science, Cornell Univ., Ithaca, NY, 1998.]]

Digital Library

[27]

D. J. Thomsen and J. T. Haigh. A Comparison of Type Enforcement and Unix Setuid Implementation of Well-formed Transactions. In Proceedings of Sixth Annual Computer Security Applications Conf., Tucson, Arizona, December 1990, 304-312. Whitehat, Inc. Secure Web Programming, http://www.whitehatsec.com/, December 2001.]]

Cited By

Paci FMecella MOuzzani MBertino E(2011)ACConv -- An Access Control Model for Conversational Web ServicesACM Transactions on the Web10.1145/1993053.19930555:3(1-33)Online publication date: 1-Jul-2011
https://dl.acm.org/doi/10.1145/1993053.1993055
Ting Zhang WenAn Tan (2010)Role-based dynamic access control for Web services2010 International Conference on Computer Application and System Modeling (ICCASM 2010)10.1109/ICCASM.2010.5620621(V4-507-V4-510)Online publication date: Oct-2010
https://doi.org/10.1109/ICCASM.2010.5620621
Chou SHuang C(2010)An extended XACML model to ensure secure information access for web servicesJournal of Systems and Software10.1016/j.jss.2009.06.04583:1(77-84)Online publication date: 1-Jan-2010
https://dl.acm.org/doi/10.1016/j.jss.2009.06.045
Show More Cited By

Index Terms

An access control language for web services
1. Security and privacy
  1. Security services
    1. Access control
  2. Systems security
    1. Operating systems security

Recommendations

Web Services Policies

In addition to the basic Web services architecture, various specifications already exist for adding security, reliable messaging, and transaction mechanisms to Web services messages. All of these include numerous options to let them meet various ...
ACConv -- An Access Control Model for Conversational Web Services

With organizations increasingly depending on Web services to build complex applications, security and privacy concerns including the protection of access control policies are becoming a serious issue. Ideally, service providers would like to make sure ...
Composing Web Services: A QoS View

An Internet application can invoke several services--a stock-trading Web service, for example, could invoke a payment service, which could then invoke an authentication service. Such a scenario is called a composite Web service, and it can be specified ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

SACMAT '02: Proceedings of the seventh ACM symposium on Access control models and technologies

June 2002

170 pages

ISBN:1581134967

DOI:10.1145/507711

General Chair:
Ravi Sandhu
George Mason University and SingleSignOn.Net
,
Program Chair:
Elisa Bertino
University of Milano, Italy

Copyright © 2002 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGSAC: ACM Special Interest Group on Security, Audit, and Control

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 03 June 2002

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Article

Conference

SACMAT02

Sponsor:

SIGSAC

SACMAT02: 7th ACM Symposium on Access Control Models and Technologies

June 3 - 4, 2002

California, Monterey, USA

Acceptance Rates

Overall Acceptance Rate 177 of 597 submissions, 30%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

28
Total Citations
View Citations
1,870
Total Downloads

Downloads (Last 12 months)4
Downloads (Last 6 weeks)0

Reflects downloads up to 30 Aug 2024

Other Metrics

View Author Metrics

Citations

Cited By

Paci FMecella MOuzzani MBertino E(2011)ACConv -- An Access Control Model for Conversational Web ServicesACM Transactions on the Web10.1145/1993053.19930555:3(1-33)Online publication date: 1-Jul-2011
https://dl.acm.org/doi/10.1145/1993053.1993055
Ting Zhang WenAn Tan (2010)Role-based dynamic access control for Web services2010 International Conference on Computer Application and System Modeling (ICCASM 2010)10.1109/ICCASM.2010.5620621(V4-507-V4-510)Online publication date: Oct-2010
https://doi.org/10.1109/ICCASM.2010.5620621
Chou SHuang C(2010)An extended XACML model to ensure secure information access for web servicesJournal of Systems and Software10.1016/j.jss.2009.06.04583:1(77-84)Online publication date: 1-Jan-2010
https://dl.acm.org/doi/10.1016/j.jss.2009.06.045
He DCompton MTaylor KYang J(2009)Access controlProceedings of the Twentieth Australasian Conference on Australasian Database - Volume 9210.5555/1862681.1862696(105-114)Online publication date: 1-Jan-2009
https://dl.acm.org/doi/10.5555/1862681.1862696
He DYang J(2009)Authorization control in collaborative healthcare systemsJournal of Theoretical and Applied Electronic Commerce Research10.5555/1807522.18075304:2(88-109)Online publication date: 1-Aug-2009
https://dl.acm.org/doi/10.5555/1807522.1807530
Oreku GLi JMtenzi F(2009)A framework towards enhancing trust and authorisation for e-commerce serviceInternational Journal of Internet Technology and Secured Transactions10.1504/IJITST.2009.0239031:3/4(173-202)Online publication date: 1-Mar-2009
https://dl.acm.org/doi/10.1504/IJITST.2009.023903
Jia LZhang Z(2009)Research of Interoperability Security between .NET and J2EE2009 International Workshop on Intelligent Systems and Applications10.1109/IWISA.2009.5073047(1-3)Online publication date: May-2009
https://doi.org/10.1109/IWISA.2009.5073047
Jaisankar NKannan A(2009)An intelligent agent based framework for secure Web Services2009 International Conference on Intelligent Agent & Multi-Agent Systems10.1109/IAMA.2009.5228059(1-6)Online publication date: Jul-2009
https://doi.org/10.1109/IAMA.2009.5228059
Wonnemann CAccorsi RMuller G(2009)On Information Flow Forensics in Business Application ScenariosProceedings of the 2009 33rd Annual IEEE International Computer Software and Applications Conference - Volume 0210.1109/COMPSAC.2009.154(324-328)Online publication date: 20-Jul-2009
https://dl.acm.org/doi/10.1109/COMPSAC.2009.154
Ma XCheung SCao CXu FLu J(2009)Towards A Dependable Software Paradigm for Service-Oriented ComputingHigh Assurance Services Computing10.1007/978-0-387-87658-0_9(163-192)Online publication date: 29-May-2009
https://doi.org/10.1007/978-0-387-87658-0_9
Show More Cited By

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents