An Access Control Model for Web-Services That Supports Delegation and Creation of Authority
An Access Control Model for Web-Services That Supports Delegation and Creation of Authority
复制标题
DOI：
10.1109/icn.2008.72
复制
发表时间：
2008-04
期刊：
影响因子：
--
通讯作者：
Mitsuhiro Mabuchi;Yasushi Shinjo;Akira Sato;Kazuhiko Kato
中科院分区：
文献类型：
--
作者：
Mitsuhiro Mabuchi;Yasushi Shinjo;Akira Sato;Kazuhiko Kato
我们提出了一个新的访问控制模型，为XML Web服务，提供用户两种权限：授权委托给其他用户的权力和权力，以创建新的权威机构的基础上自己的权力。我们通过在Web服务中引入基于能力的访问控制来开发这个模型.能力由对象标识符和该对象允许的操作列表组成。我们将Web服务对象的权限映射到对象的能力，并将能力表示为Web服务描述语言（WSDL）中的描述。授权的委托对应于功能的分发，这是通过传递WSDL描述来完成的。新权限的创建对应于基于原始能力生成受限能力，这通过在原始对象上堆叠对象来完成。堆叠对象还可以在不修改现有对象的情况下向现有Web服务对象添加新功能。我们证明了所提出的模型的有效性，使用日程管理应用程序，它使项目负责人将他或她的任务委托给下属通过比较它与谷歌日历。我们还通过将可堆叠对象的执行时间与典型的互联网延迟进行比较，表明它们的执行时间是可以接受的。
We present a new access control model for XML Web-Services that provides users with two kinds of authorities: the authority to delegate their authorities to other users and the authority to create new authorities based on their own authorities. We developed this model by introducing capability- based access control to Web services. A capability consists of an object identifier and the list of permitted operations for that object. We map an authority of a Web-Services object to a capability of the object and express the capability as a description in Web Services Description Language (WSDL). Delegation of an authority corresponds to distribution of a capability, which is done by passing a WSDL description. Creation of a new authority corresponds to generating a restricted capability based on an original capability, which is done by stacking an object on an original object. Stacking objects also makes it possible to add new functions to existing Web-Services objects without modifying the existing objects. We demonstrate the effectiveness of the proposed model using a schedule management application, which enables a project leader to delegate his or her tasks to subordinates by comparing it with Google Calendar. We also show that the execution times of stackable objects are acceptable by comparing them with typical Internet delay.