Guest Editorial: Security and Dependability in SOA and Business Processes

THIS special issue presents recent research results in a field of research that is itself rather new. When Service Oriented Architectures (SOA) came of age, no specific security technology for web services was available and transport protocols security mechanisms were used instead. For instance, web services message confidentiality was achieved using transport security protocols like SSL and HTTPS. Web services that needed authentication used transport authentication (i.e., the Basic or Digest HTTP authentication mechanisms) or certificate-based schemes. When the research community started to address the problem of web service security, we had to recognize that many of the features that make web services attractive (above all, composition and open service-to-service invocation) conflicted with traditional security models and solutions. So, it was back to the drawing board for many of us. Meanwhile, securing web services looked to many practitioners more like an art than a science. A major problem that surfaced early was supporting authenticity of service invocations across compositions. Indeed, weak authentication chains were at the basis of many early attacks to services. Today, SOAP headers support SOAP-specific security mechanisms that aim to achieve a) end-to-end security along the chain of intermediaries leading to a SOAP web service and b) full independence from the security mechanisms of transport protocols. In this special issue, the paper ”Two-Dimensional Trust Rating Aggregations in Service-Oriented Applications“ by Yan Wang and Lei Li provides an up-to-date view of the crucial problem of aggregating trust levels within composite services and business processes. Early debate on web service security also brought forward the idea of supporting message-level security using SOAP headers. Besides authentication, SOAP headers have been used since then to support a number of security mechanisms. Headers can carry encryption metadata, ensuring confidentiality of a SOAP message, or information on a digital signature scheme according to the XML Signature standard, ensuring that SOAP messages have originated from the appropriate client and were not modified in transit. Also, SOAP headers can be used to return to clients a security token to be used in future calls to the service. These security mechanisms are now well understood, and research is focusing on the performance problems posed by processing SOAP security headers. In this special issue, the paper “Server-Side Streaming Processing of WS-Security,” by Nils Gruschka et al., paves the way to efficiently enforcing SOAP security. A distinct though closely related issue is using XMLbased languages to express access permissions to web services. More than 11 years ago, one of us (E. Damiani) wrote and sent to the W3C mailing list an “XML access control manifesto” stating that “Using XML to express access and usage policies will allow for naturally expressing such policies organization-wide (associating a policy to an XML schema) and site-wide (associating a policy to a single XML document). Like usual metadata, access and usage policies expressed this way are both machine and humanreadable; moreover, they can be transferred together with data, and processed via standard enforcement engines.” In the following years, much work research was devoted to developing XML-based policy languages and models. The XACML (eXtensible Access Control Markup Language) specification emerged, defining a declarative access control policy language implemented in XML and a processing model describing how to interpret the policies. While SOAP web services were considered a natural target for XACML policies from the very beginning of XACML standardization, a major problem when using XACML to state access control policies for SOAP web services is the naming of resources, as SOAP data objects are typically not made available through a URI. The “Web Services Profile” of XACML (WS-XACML), written by Anne Anderson, bridged this gap by proposing XACML-based formats for authorization and privacy policies for web services. Today, XACML is still an important reference for research. In this special issue, the paper “Runtime Administration of an RBAC Profile for XACML,” by Xu Min et al., describes a solution for efficient administration of role-based access control policies using XACML, while the paper “Adaptive Reordering and Clustering Based Framework for Efficient XACML Policy Evaluation,” by Mohamed Shehab et al., describes an innovative framework for efficient evaluation of XACML policies. The Web Services Security specification (WS-Security) can also be regarded as a development of the idea of using SOAP headers to carry security-related information. It is closely related to the WS-Policy specification, that, in turn, develops the idea of a machine-readable format for access control policies. IEEE TRANSACTIONS ON SERVICES COMPUTING, VOL. 4, NO. 4, OCTOBER-DECEMBER 2011 255