Sciweavers

TOPLAS
2008

Verifying policy-based web services security

13 years 3 months ago
Verifying policy-based web services security
WS-SecurityPolicy is a declarative language for configuring web services security mechanisms. We describe a formal semantics for WS-SecurityPolicy and propose a more abstract language for specifying secure links between web services and their clients. We present the architecture and implementation of tools that (1) compile policy files from link specifications, and (2) verify by invoking a theorem prover whether a set of policy files run by any number of senders and receivers correctly implements the goals of a link specification, in spite of active attackers. Policy-driven web services implementations are prone to the usual subtle vulnerabilities associated with cryptographic protocols; our tools help prevent such vulnerabilities. We can verify policies when first compiled from link specifications, and also re-verify policies against their original goals after any modifications during deployment. Moreover, we present general security theorems for all configurations that rely on compi...
Karthikeyan Bhargavan, Cédric Fournet, Andr
Added 15 Dec 2010
Updated 15 Dec 2010
Type Journal
Year 2008
Where TOPLAS
Authors Karthikeyan Bhargavan, Cédric Fournet, Andrew D. Gordon
Comments (0)