Security for Web Services and Service-Oriented Architectures

Cover -- Contents -- 1 Introduction -- 1.1 Security for Web Services and Security Goals -- 1.2 Privacy -- 1.3 Goals and Scope of the Book and its Intended Audience -- 1.4 An Overview of the Book8217;s Content -- 2 Web Service Technologies, Principles, Architectures, and Standards -- 2.1 SOA and Web Services Principles -- 2.2 Web Services Architecture -- 2.3 Web Services Technologies and Standards -- 2.3.1 SOAP -- 2.3.2 Web Services Description Language (WSDL) -- 2.3.3 Service Discovery: Universal Description, Discovery and Integration (UDDI) -- 2.3.4 Considerations -- 2.4 Web Services Infrastructure -- 3 Web Services Threats, Vulnerabilities, and Countermeasures -- 3.1 Threats and Vulnerabilities Concept Definition -- 3.2 Threat Modeling -- 3.3 Vulnerability Categorizations and Catalogs -- 3.4 Threat and Vulnerabilities Metrics -- 4 Standards for Web Services Security -- 4.1 The Concept of Standard -- 4.2 Web Services Security Standards Framework -- 4.3 An Overview of Current Standards -- 4.3.1 8220;Near the wire8221; security standards -- 4.3.2 XML Data Security -- 4.3.3 Security Assertions Markup Language (SAML) -- 4.3.4 SOAP Message Security -- 4.3.5 Key and Trust Management standards -- 4.3.6 Standards for Policy Specification -- 4.3.7 Access Control Policy Standards -- 4.4 Implementations of Web Services Security Standards -- 4.5 Standards-related Issues -- 5 Digital Identity Management and Trust Negotiation -- 5.1 Overview of Digital Identity Management -- 5.2 Overview of Existing Proposals -- 5.2.1 Liberty Alliance -- 5.2.2 WS-Federation -- 5.2.3 Comparison of Liberty Alliance and WS-Framework -- 5.2.4 Other Digital Identity Management Initiatives -- 5.3 Discussion on Security of Identity Management Systems -- 5.4 Business Processes -- 5.4.1 Deploying Multifactor Authentication for Business Processes -- 5.4.2 Architecture -- 5.5 Digital Identity Management in Grid Systems -- 5.6 The Trust Negotiation Paradigm and its Deployment using SOA -- 5.7 Trust Negotiation and Digital Identity Management -- 5.7.1 Automated Trust Negotiation and Digital Identity Management Systems: Differences and Similarities -- 5.8 Integrating Identity Management and Trust Negotiations -- 5.8.1 Architecture of a SP in FAMTN -- 5.8.2 An Example of a Use Case: FSP in Liberty Web Services Framework -- 5.9 Negotiations in an FAMTN Federation -- 5.9.1 Ticketing system in an FAMTN Federation -- 5.9.2 Implementing Trust Tickets Through Cookies -- 5.9.3 Negotiation in Identity Federated Systems -- 5.10 Bibliographic Notes -- 6 Access Control for Web Services -- 6.1 Approaches to Enforce Access Control for Web Services -- 6.2 WS-AC1: An Adaptive Access Control Model for Stateless Web Services -- 6.2.1 The WS-AC1 Model -- 6.2.2 WS-AC1 Identity Attribute Negotiation -- 6.2.3 WS-AC1 Parameter Negotiation -- 6.3 An Access Control Framework for Conversation-Based Web services -- 6.3.1 Conversation-Based Access Control -- 6.3.2 Access Control and Credentials -- 6.3.3 k-Trust Levels and Policies -- 6.3.4 Access Control Enforcement -- 6.3.5 K-Trustworthiness Levels Computation -- 6.3.6 Architecture of the Enforcement System -- 7 Secure Publishing Techniques -- 7.1 The Merkle Signatures -- 7.1.1 Merkle Signatures for Trees -- 7.1.2 Merkle Signatures for XML Documents -- 7.1.3 Merkle Hash Verification for Documents with Partially Hidden Contents -- 7.2 Applic.