Sciweavers

Share
ACSAC
2008
IEEE

Please Permit Me: Stateless Delegated Authorization in Mashups

9 years 3 months ago
Please Permit Me: Stateless Delegated Authorization in Mashups
Mashups have emerged as a Web 2.0 phenomenon, connecting disjoint applications together to provide unified services. However, scalable access control for mashups is difficult. To enable a mashup to gather data from legacy applications and services, users must give the mashup their login names and passwords for those services. This all-ornothing approach violates the principle of least privilege and leaves users vulnerable to misuse of their credentials by malicious mashups. In this paper, we introduce delegation permits – a stateless approach to access rights delegation in mashups – and describe our complete implementation of a permit-based authorization delegation service. Our protocol and implementation enable fine grained, flexible, and stateless access control and authorization for distributed delegated authorization in mashups, while minimizing attackers’ ability to capture and exploit users’ authentication credentials.
Ragib Hasan, Marianne Winslett, Richard M. Conlan,
Added 28 May 2010
Updated 28 May 2010
Type Conference
Year 2008
Where ACSAC
Authors Ragib Hasan, Marianne Winslett, Richard M. Conlan, Brian Slesinsky, Nandakumar Ramani
Comments (0)
books