A Logic-Based Access Control Approach For Web Services

Web Services technology enables organisations to exploit software as a service. Services are accessed by method invocations. Method interfaces are described and published, and may be freely available. In Web Services environments, access control is required to cross the borders of security domains, to be implemented between heterogeneous systems. Interaction is between remotely located parties who may know little about each other. Access control generally assumes that identity is established. To overcome the limitations of identity-based solutions, domainindependent access control information is added to a message. As a Web Service endpoint is required to integrate such information into its access control decision-making process, issues arise such as; whom to accept access control information from; what the format of such information must be; how to inform the requestor of the format; and how to give access to methods based on presented access control information. To address such issues, a logic-based access control approach is defined for a Web Service endpoint. A logic-based authorization manager is described, that provides a formal foundation of logical reasoning, to enable the enforcement of consistent access control decisions over the resources of Web Services.