ACConv -- An Access Control Model for Conversational Web Services
Abstract
With organizations increasingly depending on Web services to build complex applications, security and privacy concerns including the protection of access control policies are becoming a serious issue. Ideally, service providers would like to make sure that clients have knowledge of only portions of the access control policy relevant to their interactions to the extent to which they are entrusted by the Web service and without restricting the client’s choices in terms of which operations to execute. We propose ACConv , a novel model for access control in Web services that is suitable when interactions between the client and the Web service are conversational and long-running. The conversation-based access control model proposed in this article allows service providers to limit how much knowledge clients have about the credentials specified in their access policies. This is achieved while reducing the number of times credentials are asked from clients and minimizing the risk that clients drop out of a conversation with the Web service before reaching a final state due to the lack of necessary credentials. Clients are requested to provide credentials, and hence are entrusted with part of the Web service access control policies, only for some specific granted conversations which are decided based on: (1) a level of trust that the Web service provider has vis-à-vis the client, (2) the operation that the client is about to invoke, and (3) meaningful conversations which represent conversations that lead to a final state from the current one. We have implemented the proposed approach in a software prototype and conducted extensive experiments to show its effectiveness.
Document Details
- Document Type
- Pub Defense Publication
- Publication Date
- Jul 01, 2011
- Source ID
- 10.1145/1993053.1993055
Entities
People
- Elisa Bertino
- Federica Paci
- Massimo Mecella
- Mourad Ouzzani
Organizations
- Air Force Office of Scientific Research
- Division of Information and Intelligent Systems
- Purdue University
- Qatar Computing Research Institute
- Sapienza University of Rome
- Seventh Framework Programme
- University of Trento