Security Personalization for Internet and Web Services

• Published in: International journal of web services research 2008-01, Vol.5 (1), p.1-23
• Main Authors: Yee, George O.M, Korba, Larry
• Format: Article
• Language: English
• Subjects: Analysis; Consumer preferences; Customer satisfaction; Customer services; Customers; Customization; Growth; Internet; Internet service providers; Online services; Security; Web services
• ISSN: 1545-7362; 1546-5004
• DOI: 10.4018/jwsr.2008010101

The growth of the Internet has been accompanied by the growth of Internet services (e.g., e-commerce, e-health). This proliferation of services and the increasing attacks on them by malicious individuals have highlighted the need for service security. The security requirements of an Internet or Web service may be specified in a security policy. The provider of the service is then responsible for implementing the security measures contained in the policy. However, a service customer or consumer may have security preferences that are not reflected in the provider’s security policy. In order for service providers to attract and retain customers, as well as reach a wider market, a way of personalizing a security policy to a particular customer is needed. We derive the content of an Internet or Web service security policy and propose a flexible security personalization approach that will allow an Internet or Web service provider and customer to negotiate to an agreed-upon personalized security policy. In addition, we present two application examples of security policy personalization, and overview the design of our security personalization prototype.