Mitigating Security Risks in Web Service Invocations

Abstract

The pervasiveness of Web services increases the necessity for consumers to access and use them in a secure way. Besides secure communications, consumer security also involves providing strong guarantees that a requested security policy is satisfied. Needless to say, remote services are adverse to most techniques of analysis and control that usually require direct access to either the implementation or the execution. In this chapter, the authors classify service execution paradigms and provide a characterization of the security threats that may affect a Web service infrastructure depending on the elements composing it. In particular, the authors provide a discussion of the threat models for several different Web service paradigms involving service consumers, providers, and platforms, and illustrate how and when contract-based security approaches and its variants can be applied for mitigating risks in service integrations in the identified paradigms.