Enhancing Security Modeling for Web Services Using Delegation and Pass-On

In recent years, the issues in web service security have been widely investigated and various security standards have been proposed. But most of these studies and standards focus on the access control policies for individual web services and do not consider the access issues in composed services. Consider a simple service chain where service s₁ accesses s₂, and s₂, in turn, accesses service s₃. The information returned from s₃ to s₂ may be used to compute some results that are further returned to s₁. The current web service security framework does not provide any mechanisms to control such an information flow, and hence, sensitive information may be leaked to s₁ without the consensus of s₃. In this paper, we propose an enhanced security model to facilitate the control of information flow through service chains. It extends the basic security models by introducing the concepts of delegation and pass-on. Based on these concepts, new certificates, certificate chain, delegation and pass-on policies, and how they are used to control the information flow are discussed.