A fine-grained access control system for XML documents
ACM Transactions on Information and System Security (TISSEC)
Towards securing XML Web services
Proceedings of the 2002 ACM workshop on XML security
Architectural styles and the design of network-based software architectures
Architectural styles and the design of network-based software architectures
Secure XML querying with security views
SIGMOD '04 Proceedings of the 2004 ACM SIGMOD international conference on Management of data
A Trust-Based Context-Aware Access Control Model for Web-Services
Distributed and Parallel Databases
An authorization model for XML databases
SWS '04 Proceedings of the 2004 workshop on Secure web service
Simplified authentication and authorization for RESTful services in trusted environments
ESOCC'12 Proceedings of the First European conference on Service-Oriented and Cloud Computing
Hi-index | 0.00 |
The potentials of REST offers new ways for communications between louse coupled entities featured through the Web of Things [12]. The binding of the disjunct components of this architecture creates security issues, such as the centralized authorization techniques respecting the independence of the underlying entities. This results in the question how authorization is performed respecting the flexibility of REST without any knowledge about the underlying resources. Nevertheless, possible knowledge about these resources should enable the authorization workflow to offer finer-granular permissions on substructures of the resources. With our new approach - we named Hecate- we offer a framework to assure simplified handling while keeping the potentials and flexibility of REST. We have designed an architecture based on XML with a flexible authorization mechanism on the one hand and optional resource-awareness on the other hand. The flexibility within the authorization work-flow bases on permission sets respecting the HTTP-verbs. Additional in-depth knowledge of the entity optionally extends these permissions with resource-aware filters. Hecate offers not only great benefits because of its flexibility, but also because of the optional extensibility proved within the two reference implementations. With Hecate, we show that a centralized authorization mechanism combining independence and optional resource-based filtering extends the flexibility of REST rather than restricting it.