Published: Jan 30, 2014
- Title: Access Control Modeling and Enforcement in Distributed Web Applications
- Speaker: Worachet Uttha
- Event date: Thursday, 30 January 2014 - 12:00 PM
- Location: Sala Acquario
- Abstract: Nowadays organisations increasingly employ distributed systems. Web services, which are a form of distributed system architecture, become the preferred implementation technology for realising the integration and interaction between various systems in Internet and Intranet environments. Since each web service manages its own security policies, they must interoperate while maintaining secure access to their information. In this context, access control becomes one of the challenging issues that must be well-defined in order to ensure a secure cooperation. A particularly difficult case involves a service that invokes another service to satisfy an initial request. We call it the ”Transitive access problem”. To overcome this limitation, we propose to use the eXtensible Access Control Markup Language (XACML) for defining Attribute based Access Control (ABAC) policies for web services. We focus on the authorisation issue of access control and solve the transitive access problem by integrating in the XACML architecture a module for supporting multiple attribute domains.