DMCA
Othmane, “An End-to-End Security Auditing Approach for Service Oriented Architecture (2012)
| Venue: | In 31st IEEE Symposium on Reliable Distributed Systems (SRDS |
| Citations: | 2 - 1 self |
BibTeX
@INPROCEEDINGS{Azarmi12othmane,“an,
author = {Mehdi Azarmi and Bharat Bhargava and Pelin Angin and Rohit Ranchal and Norman Ahmed and Xiangyu Zhang and Asher Sinclair and Mark Linderman and Lotfi Ben Othmane},
title = {Othmane, “An End-to-End Security Auditing Approach for Service Oriented Architecture},
booktitle = {In 31st IEEE Symposium on Reliable Distributed Systems (SRDS},
year = {2012}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract—Service-Oriented Architecture (SOA) is becoming a major paradigm for distributed application development in the recent explosion of Internet services and cloud computing. However, SOA introduces new security challenges not present in the single-hop client-server architectures due to the involvement of multiple service providers in a service request. The interactions of independent service domains in SOA could violate service policies or SLAs. In addition, users in SOA systems have no control on what happens in the chain of service invocations. Although the establishment of trust across all involved partners is required as a prerequisite to ensure secure interactions, still a new end-to-end security auditing mechanism is needed to verify the actual service invocations and its conformance to the expected service orchestration. In this paper, we provide an efficient solution for end-to-end security auditing in SOA. The proposed security architecture introduces two new components called taint analysis and trust broker in addition to taking advantages of WS-Security and WS-Trust standards. The interaction of these components maintains session auditing and dynamic trust among services. This solution is transparent to the services, which allows auditing of legacy services without modification. Moreover, we have implemented a prototype of the proposed approach and verified its effectiveness in a LAN setting and the Amazon EC2 cloud computing infrastructure. Keywords-Service Oriented Architecture; security auditing; taint analysis; trust;
Keyphrases
service oriented architecture end-to-end security auditing approach taint analysis abstract service-oriented architecture keywords-service oriented architecture dynamic trust internet service independent service domain legacy service service policy ws-trust standard major paradigm new component distributed application development actual service invocation efficient solution amazon ec2 cloud involved partner security auditing secure interaction single-hop client-server architecture multiple service provider proposed security architecture soa system trust broker new end-to-end security service orchestration service request cloud computing lan setting new security recent explosion service invocation end-to-end security auditing
