Web Services Security Architectures using RoleBased Access Control
Journal Title: International Journal of Computer Science and Information Technologies - Year 2010, Vol 1, Issue 5
Abstract
The Web Services Access controls are categorized according to access control granularity and have two approaches: The first approach supports a negotiation-based attribute-based access control to Web Services with fine access granularity. The second approach is tailored to access control for conversation-based Web services and composite services; where in a Web Service is not considered as a set of independent operations and therefore access control must take such dependencies into account. During a Web Services invocation, a client interacts with the service, performing a sequence of operations in a particular order called conversation. In this paper, we want to propose strategies for analyzing and managing Role Based Access Control policies for designing Security Architectures for web services. We validate role-based access control with a case study, where in access decisions are based on the roles that individual users have as part of an organization. Users take on assigned roles. The process of defining roles should be based on a thorough analysis of how an organization operates and should include input from a wide spectrum of users in an organization. Access rights are grouped by role name, and the use of resources is restricted to individuals authorized to assume the associated role. For example, within a hospital system the role of doctor can include operations to perform diagnosis, prescribe medication, and order laboratory tests; and the role of researcher can be limited to gathering anonymous clinical information for studies. The use of roles to control access can be an effective means for developing and enforcing enterprisespecific security policies, and for streamlining the security management process. Under the RBAC framework, users are granted membership into roles based on their competencies and responsibilities in the organization. The operations that a user is permitted to perform are based on the user's role.
Authors and Affiliations
K. Venkateswar Rao , Dr. M. Srinivasa Rao , K. Mrunalini Devi , Dr. D. Sravan Kumar , M. Upendra Kumar
Keywords
Related Articles
- EP ID EP144907
- DOI -
- Views 74
- Downloads 0
DEVELOPMENT AND VALIDATION OF MEANINGFUL HYBRID E-TRAINING MODEL FOR COMPUTER EDUCATION
Meaningful hybrid e-training experience provides a coherent purpose for strategic educational change through lifelong education and the creation of a knowledge society. A close examination of new hybrid e-training progr...
A Model of MULTI-VERIFIER channel e-mailing system using Steganographic scheme
In this paper, we presented a model of privileged channel e-mailing system for Internet communication. It is the model of a real-life secure mailing system for any organization. In this model a sender can send a secret m...
Security Enhancement of First Mile Wireless Access with Optimal QoS through Anonymity in Convergence Network
The first mile wireless access of convergence networks is prone to various attacks due to the broadcasting feature of transmission. Most of the existing security measures focus on protection of message contents, leaving...
Jacobi computation using mobile agent
Physical phenomena occur in a wide range of mathematical applications: from fluid to solid mechanics, electromagnetic and electrical engineering. Engineers working toward an optimized modelling must...
An Efficient Routing scheme for reliable path establishment among Mobile Devices in Heterogeneous Networks
In heterogeneous networks, devices available with varying connectivity help to provide many new opportunities for efficiently utilizing new resources. In mobile ad hoc networks with varying layered a...