Enhancing security modeling for web services using delegation and pass-on

International Journal of Web Services Research

Volumn 7, Issue 1, 2010, Pages 1-21

  She, Wei ^a   Yen, I Ling ^a   Thuraisingham, Bhavani ^a  

^a UNIVERSITY OF TEXAS AT DALLAS   (United States)

Author keywords

Delegation; Information flow control; Pass on; Service composition; Web service security

Indexed keywords

CERTIFICATE CHAINS; COMPOSITE SERVICES; HEALTH CARE INFORMATION SYSTEM; INFORMATION FLOW CONTROL; INFORMATION FLOWS; SECURITY ISSUES; SECURITY MODEL; SECURITY MODELING; SECURITY STANDARDS; SERVICE CHAIN; SERVICE COMPOSITIONS; WEB SERVICE SECURITY;

FLOW CONTROL; INFORMATION SYSTEMS; INTERNET PROTOCOLS; WEB SERVICES;

NETWORK SECURITY;

EID: 76449113546     PISSN: 15457362     EISSN: 15465004     Source Type: Journal    
DOI: 10.4018/jwsr.2010010101     Document Type: Article

References (24)

1. Atluri, V., & Warner, J. (2005). Supporting conditional delegation in secure workflow management systems. In Proceedings of the Tenth ACM Symposium on Access Control Models and Technologies (pp. 49-58).
2. Aura, T. (2001). Distributed access-rights management with delegation certificates. In secure internet programming (LNCS 1603, pp. 211-235).
3. Barka, E. S., & Sandhu, R. S. (2000). A role-based delegation model and some extensions. Paper presented at the 23rd National Information Systems Security Conference.
4. Bertino, E., Squicciarini, A. C., Paloscia, I., & Martino, L. (2006). Ws-AC: A fine grained access control system for web services. World Wide Web (Bussum), 9(2), 143-171. doi:10.1007/s11280-005-3045-4
5. Bhatti, R., Bertino, E., & Ghafoor, A. (2005). A trust-based context-aware access control model for web-services. Distributed and Parallel Databases, 18(1), 83-105. doi:10.1007/s10619-005-1075-7 (Pubitemid 40859651)
6. Carminati, B., Ferrari, E., & Hung, P. C. K. (2005). Web service composition: A security perspective. In Proceedings of the 2005 International Workshop on Challenges in Web Information Retrieval and Integration (pp. 248-253).
7. Carminati, B., Ferrari, E., & Hung, P. C. K. (2006). Security conscious web service composition. In Proceedings of the IEEE International Conference on Web Services (pp. 489-496)
8. Fenser, D., & Bussler, C. (2002). The Web Service Modeling Framework WSMF. Electronic Commerce Research and Applications, 1(2), 113-137. doi:10.1016/S1567-4223(02)00015-7
9. Gasser, M., & McDermott, E. (1990). An architecture for practical delegation in a distributed system. In Proceedings of the IEEE Symposium on Security and Privacy (pp. 20).
10. IBM. (2006). Microsoft, RSA, and Verisign. Retrieved from http://specs.xmlsoap.org
11. Kortesniemi, Y., & Hasu, T. (2000). A revocation, validation and authentication protocol for SPKI based delegation systems. Paper presented at the Network and Distributed Systems Security Symposium.
12. Koshutanski, H., & Massacci, F. (2003). An access control framework for business processes for web services. In Proceedings of the 2003 ACM Workshop on XML Security (pp. 15-24).
13. OASIS. (2006). Index. Retrieved from http://docs. oasis-open.org
14. Rao, Y., Feng, B., Han, J., & Li, Z. (2004). SXRSRPM: A security integrated model for Web services. In Proceedings of the 2004 International Conference on Machine Learning and Cybernetics (Vol. 5, pp. 26-29).
15. She, W., Thuraisingham, B. M., & Yen, I. (2007). Delegation-based security model for web services. In Proceedings of the IEEE International Symposium on High Assurance Systems Engineering (pp. 82-91).
16. She, W., Yen, I., & Thuraisingham, B. M. (2008). Enhancing security modeling for web services using delegation and pass-on. In Proceedings of the IEEE International Conference on Web Services (pp. 545-552).
17. Skogsrud, H., Benatallah, B., & Casati, F. (2003). Model-driven trust negotiation for web services. IEEE Internet Computing, 45-51. doi:10.1109/ MIC.2003.1250583
18. Wang, J., Vecchio, D. D., & Humphrey, M. (2005). Extending the security assertion markup language to support delegation for web services and grid services. In Proceedings of the IEEE International Conference on Web Services (pp. 67-74).
19. Welch, V., Foster, I., Kesselman, C., Mulmo, O., Pearlman, L., Tuecke, S., et al. (2004). X.509 proxy certificates for dynamic delegation. Paper presented at the 3rd Annual PKI R&D Workshop.
20. Xu, W., Venkatakrishnan, V. N., Sekar, R., & Ramakrishnan, I. V. (2006). A framework for building privacy-conscious composite web services. In Proceedings of the IEEE International Conference on Web Services (pp. 655-662).
21. Yialelis, N., & Sloman, M. (1996). A security framework supporting domain-based access control in distributed systems. In Proceedings of the Symposium on Network and Distributed System Security (p. 26).
22. Yin, G., Wang, H., Shi, D., Jia, Y., & Teng, M. (2004). A rule-based framework for role-based constrained delegation. In Proceedings of the 3rd International Conference on Information Security (pp. 186-191).
23. Zhang, L., Ahn, G.-J., & Chu, B.-T. (2003). A rule-based framework for role-based delegation and revocation. ACM Transactions on Information and System Security, 6(3), 404-441. doi:10.1145/937527.937530
24. Zhang, X., Oh, S., & Sandhu, R. S. (2003). PBDM: A flexible delegation model in RBAC. In Proceedings of the 8th ACM symposium on Access Control Models and Technologies (pp. 149-157).