A Web Services Security Policy Description Model

Abstract:

With the rapid development of web services technology, the security policies defined in WS-SecurityPolicy are widely used for expressing security properties, capabilities, constraints and requirements of web services. It is well-known that security policies are crucial in the negotiation phase of service discovery and selection. However, such security policies are hard to understand and extremely error-prone, due to the complexity of the WS-SecurityPolicy specification. At the same time, because the WS-SecurityPolicy is described by natural language, there have ambiguity problem. These problem seriously hindered the development of web services policy. Therefore, this paper proposes a web services security policy description model to describe accurately and clearly security policies. The security policy model employs the formal modeling method to convert the policy assertions into the security rules.

• Periodical: Applied Mechanics and Materials (Volumes 644-650)
• Pages: 2943-2946
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.644-650.2943
• Online since: September 2014
• Authors: Hao Zeng*, Yong Wang Zhao, Dian Fu Ma
• Keywords: SOCSPDM, Web Services Security Policy, Ws-Security Policy

References

[1] M. P. Papazoglou, P. Traverso, S. Dustdar, F. Leymann, Service-oriented computing: A research roadmap, International Journal of Cooperative Information Systems, vol. 17, no. 2, pp.223-255, (2008).

DOI: 10.1142/s0218843008001816

[2] Alonso.G. Web Services: Concepts, Architectures and Applications, Springer Verlag, Berlin Heidelberg, (2004).

[3] Papazoglou. M.P. and Heuvel, W-J. v. d. Service oriented architecture: approaches, technologies and research issues, VLDB Journal, Vol. 16, No. 3, pp.389-415.

DOI: 10.1007/s00778-007-0044-3

[4] Hao Zeng, Yongwang Zhao, Dianfu Ma, A PolicyTree-Based Architecture for Web Services Authoriztion, Journal of Computational Information Systems, vol. 9, no. 21, (2013).

DOI: 10.1109/iscc.2013.6754982

[5] W. She, I. -L. Yen, and B Thuraisingham, Enhancing Security Modeling for Web Services using Delegation and Pass-on, in IEEE International Conference on Web Services, 2008, pp.245-252.

DOI: 10.1109/icws.2008.23

[6] M. Papazoglou, Web services: Principles and technology: Addison- Wesley, (2008).

[7] W3C. Web Services Policy Version 1. 5 C Framework. http: /www. w3. org/TR/2007/REC-ws-policy-20070904.

[8] OASIS. WS-SecurityPolicy Version 1. 2. http: /docs. oasis-open. org/ws-sx/ws-securitypolicy/v1. 3/os/ws-securitypolicy-1. 2-spec-os. doc, (2007).

DOI: 10.4018/978-1-4666-0146-8.ch014

[9] Q. Yang, D. F. Ma, Y. W. Zhao, Z. Q. Li, Towards a Formal Verification Approach for Implementation of Web Services Specifications, APSCC 2010, pp.269-276.

DOI: 10.1109/apscc.2010.14

[10] A. Singhal, T. Winograd, and K. Scarfone, Guide to secure web services (NIST SP 800-95), National Institute of Standards and Technology (NIST), Tech. Rep., (2007).

DOI: 10.6028/nist.sp.800-95

[11] Technical Committee ISO/TC 97, Information processing systems - Open Systems Interconnection – Basic Reference Model - Part 2: Security Architecture (ISO 74982-1989).

[12] Thomas Erl, SOA: Principles of Service Design, published by Pearson Education, Inc, (2008).

[13] Hao Zeng, Dianfu Ma, Zhuqing Li, Yongwang Zhao. A Policy-Based Architecture for Web Services Security Processing. Ninth IEEE International Conference on e-Business Engineering, (2012).

DOI: 10.1109/iscc.2013.6754982