Using JASON to secure SOA

ABSTRACT

Nowadays business applications closely collaborate with other business applications by sharing one or more services. Unfortunately, opening your business application to the outside world also sacrifices security. There is quite a number of standards that aims at protecting these services. However, most of these standards require special knowledge about security and are cumbersome to use. Our JASON framework aims at simplifying the task of securing services. A programmer simply annotates his code with appropriate keywords and our tools will generate the security related code. The programmer can simply concentrate on the business application, while the JASON framework does the necessary cryptography.

REFERENCES

• 1: B. Bos, Ł. Chmielewski, J.-H. Hoepman, and T. S. Nguyen. Remote management and secure application development for pervasive home systems using Jason. In In 3rd International Workshop on Security, Privacy and Trust in Pervasive and Ubiquitous Computing, pages 7--12, Istanbul, Turkey, July 2007.
• 2: Richard Brinkman , Jaap-Henk Hoepman, Secure method invocation in Jason, Proceedings of the 5th conference on Smart Card Research and Advanced Application Conference, p.4-4, November 21-22, 2002, San Jose, CA
• 3: E. Christensen, F. Curbera, G. Meredith, and S. Weerawarana. Web services description language (WSDL) 1.1. Technical report, W3C, 2001.
• 4: Paul Barham , Boris Dragovic , Keir Fraser , Steven Hand , Tim Harris , Alex Ho , Rolf Neugebauer , Ian Pratt , Andrew Warfield, Xen and the art of virtualization, Proceedings of the nineteenth ACM symposium on Operating systems principles, October 19-22, 2003, Bolton Landing, NY, USA
• 5: Thomas Erl, Service-Oriented Architecture: Concepts, Technology, and Design, Prentice Hall PTR, Upper Saddle River, NJ, 2005
• 6: Maarten van Steen , Philip Homburg , Andrew S. Tanenbaum, Globe: A Wide-Area Distributed System, IEEE Concurrency, v.7 n.1, p.70-78, January 1999 [doi>10.1109/4434.749137]
• 7: S. Karnouskos, O. Baecker, L. M. S. de Souza, and P. Spiess. Integration of soa-ready networked embedded devices in enterprise systems via a cross-layered web service infrastructure. In Proceedings of 12th International Conference on Emerging Technologies and Factory Automation. IEEE Computer Society, 2007.
• 8: Dirk Krafzig , Karl Banke , Dirk Slama, Enterprise SOA: Service-Oriented Architecture Best Practices (The Coad Series), Prentice Hall PTR, Upper Saddle River, NJ, 2004
• 9: Peter Loscocco , Stephen Smalley, Integrating Flexible Support for Security Policies into the Linux Operating System, Proceedings of the FREENIX Track: 2001 USENIX Annual Technical Conference, p.29-42, June 25-30, 2001
• 10: OASIS. Web Service Security: SOAP message security 1.1 (WS-Security 2004), February 2006. http://www.oasis-open.org/committees/download.php/16790/wss-v1.1-spec-os-SOAPMessageSecurity.pdf.
• 11: OASIS. Web Service Reliable Messaging (WS-ReliableMessaging 1.1), June 2007. http://docs.oasis-open.org/ws-rx/wsrm/200702/wsrm-1.1-spec-os-01.pdf.
• 12: OASIS. WS-SecureConversation 1.3, March 2007. http://docs.oasis-open.org/ws-sx/ws-secureconversation/v1.3/ws-secureconversation.pdf.
• 13: OASIS. WS-Trust 1.3, March 2007. http://docs.oasis-open.org/ws-sx/ws-trust/v1.3/ws-trust.pdf.
• 14: Bogdan C. Popescu , Maarten van Steen , Andrew S. Tanenbaum, A Security Architecture for Object-Based Distributed Systems, Proceedings of the 18th Annual Computer Security Applications Conference, p.161, December 09-13, 2002
• 15: Jothy Rosenberg , David Remy, Securing Web Services with WS-Security: Demystifying WS-Security, WS-Policy, SAML, XML Signature, and XML Encryption, Pearson Higher Education, 2004
• 16: W. T. Tsai , Xinxin Liu , Yinong Chen, Distributed Policy Specification and Enforcement in Service-Oriented Business Systems, Proceedings of the IEEE International Conference on e-Business Engineering, p.10-17, October 12-18, 2005 [doi>10.1109/ICEBE.2005.52]

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.4 Distributed Systems
          Subjects: Distributed applications

General Terms:
Security

Keywords:
SOA security, middleware, secure remote management