An Information security framework for web services in enterprise networks

Download
2015
Sarıkoz, Bahadır Gökhan
Web Service, an open standard based on existing Internet protocols, provides a flexible solution to web application integration. It provides faster, more practical and more effective way of solutions for the organizational structures. Online shopping, billing, reservation and other way of standards provided to people mostly depend on web services. On the other hand, it provides corporate identity and functionality of an organization. Since the importance and the necessity of the web services increase day by day, the level of criticality also increases in the same level. In the meanwhile, the necessary measurements are to be taken into account in order to provide 7/24 productivity. Such measurements includes several subjects from the load testing to effective coding for best service. However, cyber security attacks, one of the most important issues nowadays are the root cause in order to take vital measurements. Preventing web services from these cyber security attacks requires several aspects from different perspectives including network-based security, protocol-based security, signature-based security and other types of control mechanisms. In this study, an information security framework has been proposed in order to define the complete security aspects of a web service of an enterprise network. Within this framework, a sample information security modeling for a web service has been presented with respect to the several types of attacks. The mentioned modeling has been tested and measured for pre-defined and specified scenarios.

Suggestions

A certificate based, context aware access control model for multi domain environments
Yortanlı, Ahmet; Koçyiğit, Altan; Department of Information Systems (2010)
A certificate based approach is proposed for access control operations of context aware systems for multi domain environments. New model deals with the removal of inter-domain communication requirement in access request evaluation process. The study is applied on a prototype implementation with configuration for two di erent cases to show the applicability of the proposed certificate based, context aware access control model for multi domain environments. The outputs for the cases show that proposed access ...
Automated Web Services Composition with the Event Calculus
Aydin, Onur; Çiçekli, Fehime Nihan; Cicekli, Ilyas (2007-10-24)
As the web services proliferate and complicate it is becoming an overwhelming job to manually prepare the web service compositions which describe the communication and integration between web services. This paper analyzes the usage of the Event Calculus, which is one of the logical action-effect definition languages, for the automated preparation and execution of web service compositions. In this context, abductive planning capabilities of the Event Calculus are utilized. It is shown that composite process ...
A knowledge based product line for semantic modeling of web service families
Orhan, Umut; Doğru, Ali Hikmet; Department of Computer Engineering (2008)
Some mechanisms to enable an effective transition from domain models to web service descriptions are developed. The introduced domain modeling support provides verification and correction on the customization part. An automated mapping mechanism from the domain model to web service ontologies is also developed. The proposed approach is based on Feature-Oriented Domain Analysis (FODA), Semantic Web technologies and ebXML Business Process Specification Schema (ebBP). Major contributions of this work are the c...
Semantic Annotation of Web Services with Lexicon-Based Alignment
Cantürk, Deniz; Karagöz, Pınar (2011-07-04)
As the number of available web services published in registries and on web sites increases, web service discovery becomes a challenging task. One solution to the problem is to use distributed web service search system composed of domain specific sub service discoverers. Using ontology is the most common practice to specify domain knowledge. However, an important problem at this point is the lack of semantic annotation for currently available web services. For this reason, there is a strong need for a mechan...
An Approach for automated verification of web applications using model checking and replaying the scenarios of counterexamples
Paçin, Yudum; Betin Can, Aysu; Department of Information Systems (2015)
The increase in the use of web applications in various domains, raised the importance of the methodologies for verification of web applications. We propose a framework for the verification of web applications with respect to access control, link consistency and reachability properties using model checking. In this approach, users define the properties by explanatory guidance of user interface. The execution traces that lead to a property violation is translated to a script that automates the replaying of th...
Citation Formats
B. G. Sarıkoz, “An Information security framework for web services in enterprise networks,” M.S. - Master of Science, Middle East Technical University, 2015.