EPICS: A Framework for Enforcing Security Policies in Composite Web Services

With advances in cloud computing and the emergence of service marketplaces, the popularity of composite services marks a paradigm shift from single-domain monolithic systems to cross-domain distributed services, which raises important privacy and security concerns. Access control becomes a challenge...

Full description

Saved in:
Bibliographic Details
Published in:IEEE transactions on services computing 2019-05, Vol.12 (3), p.415-428
Main Authors: Ranchal, Rohit, Bhargava, Bharat, Angin, Pelin, Othmane, Lotfi Ben
Format: Article
Language:English
Subjects:
Access control
active bundles
Authentication
Automata
Clients
Cloud computing
composite web services
Credit cards
Data retrieval
Distributed databases
Policies
Privacy
Security
System effectiveness
Web services
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:With advances in cloud computing and the emergence of service marketplaces, the popularity of composite services marks a paradigm shift from single-domain monolithic systems to cross-domain distributed services, which raises important privacy and security concerns. Access control becomes a challenge in such systems because authentication, authorization and data disclosure may take place across endpoints that are not known to clients. The clients lack options for specifying policies to control the sharing of their data and have to rely on service providers which offer limited selection of security and privacy preferences. This lack of awareness and loss of control over data sharing increases threats to a client's data and diminishes trust in these systems. We propose EPICS, an efficient and effective solution for enforcing security policies in composite Web services that protects data privacy throughout the service interaction lifecycle. The solution ensures that the data are distributed along with the client policies that dictate data access and an execution monitor that controls data disclosure. It empowers data owners with control of data disclosure decisions during interactions with remote services and reduces the risk of unauthorized access. The paper presents the design, implementation, and evaluation of the EPICS framework.
ISSN:1939-1374
1939-1374
2372-0204
DOI:10.1109/TSC.2018.2797277