EFSOC: A Layered Framework for Developing Secure Interactions between Web-Services

Abstract

Enterprises are rapidly extending their relatively stable and internally-oriented business processes and applications with loosely-coupled enterprise software services in order to support highly dynamic, crossorganizational business processes. These services are no longer solely based on internal enterprise systems, but often implemented, deployed and executed by diverse, external service providers. The ability to dynamically configure cross-organizational business processes with a mixture of internal and external services imposes new security requirements on existing security models.In this paper, we address the problem of defining and enforcing access control rules for securing service invocations in the context of a business process. For this purpose, we amortize existing role-based access control models that allow for dynamic delegation and retraction of authorizations. Authorizations are assigned on an event-driven basis, implementing a push-based interaction protocol between services. This novel security model is entitled the Event-driven Framework for Service Oriented Computing (EFSOC). In addition, this article presents an experimental prototype that is explored using a realistic case study.

Efficiently supporting secure and reliable collaboration in scientific workflows

“…The correlation between two different secure levels depends on the corresponding events, which trigger the interaction between layers. We extend the Role-Based Access Control (RBAC) model [16,21] to securely access Web services. The RBAC model include two basic elements: role and permission.…”

BOF4WSS: A Business-Oriented Framework for Enhancing Web Services Security for e-Business

“…Some of the most pertinent, and noteworthy proposals focusing on these higher layers are: [2], which builds on existing technologies and the theory of Aspect-Oriented Programming, to provide a framework for securing WS compositions (necessary in collaborative e-business) using the WS-Security and WS-Policy standards; [8] aims to provide a methodical development approach for constructing security architectures for WS-based systems; [14] which provides integrated WS design strategies and best practices for end-to-end security; [17] -a method that uses fuzzy logic to measure the risk associated with WS, with full appreciation of the fact that due to WS' volatility, information on threats is usually incomplete or imprecise; and lastly the Eventdriven Framework for Service Oriented Computing in [16] -a standard agnostic, multilayered framework that aims to address the problem of defining and enforcing access control rules for securing services use at the level of business processes. In their work, authors particularly focus on dynamic authorization, independent of specific standards [16].…”

“…This highly isolated perspective is inadequate due to the very nature of WS, and the high degrees of interconnection between businesses-spanning exposure of legacy systems to purpose-built Web applications-that WS readily facilitates. In [16], even though this allows for a layered, and more comprehensive model for WS security during business process execution, its predominant focus is towards access control, and particularly for highly dynamic environments. Both these aspects act to make it too specific a framework for our purposes as mentioned in subsequent sections.…”

Web Services Interactions: Analysis, Modeling, and Management

“…In [21], van den Heuvel et al report on EFSOC, which is a layer-based framework for securing interactions between Web services. Although the framework does not emphasize how Web services interact together, its layer architecture drew our attention in comparison to our 2 -layer framework.…”