Wrappers - a mechanism to support state-based authorisation in Web applications

被引：2
作者：
Olivier, MS
Gudes, E
机构：
[1] Rand Afrikaans Univ, ZA-2006 Auckland Pk, South Africa
[2] Ben Gurion Univ Negev, IL-84105 Beer Sheva, Israel
来源：
DATA & KNOWLEDGE ENGINEERING | 2002年 / 43卷 / 03期
关键词：
Web security; application security; access control; wrappers; state-based authorisation;
D O I：
10.1016/S0169-023X(02)00129-5
中图分类号：
TP18 [人工智能理论];
学科分类号：
081104 ; 0812 ; 0835 ; 1405 ;
摘要：
The premises of this paper are (1) security is application dependent because application semantics directly influence proper protection; but (2) applications are generally too complex to be trusted to implement security as specified by the given security policy. These problems are aggravated if the application operates over time and space. This paper proposes the use of a simple program (a "wrapper") that has enough knowledge about a specific application's potential states and the actions that are permissible in each state. Using this knowledge, it is able to filter requests that should not reach an application at a given point. (C) 2002 Elsevier Science B.V. All rights reserved.
引用
收藏
页码：281 / 292
页数：12
相关论文
共 14 条
  • [1] ATLURI V, 1997, DATABASE SECURITY, V10, P240
  • [2] BISKUP J, 1994, DATABASE SECURITY, V7, P3
  • [3] Demurjian S, 2000, INT FED INFO PROC, V43, P79
  • [4] FARMER WM, 1997, LNCS, V1146, P118
  • [5] Ford Warwick, 1997, Secure Electronic Commerce: Building the Infrastructure for Digital Signatures and Encryption
  • [6] Garfinkel Simson., 1996, PRACTICAL UNIX INTER
  • [7] Gudes E., 1999, Journal of Computer Security, V7, P287
  • [8] Harel D., 1998, MODELING REACTIVE SY
  • [9] MCCOLLUM CD, 1998, DATABASE SECURITY, V11, P17
  • [10] Specifying application-level security in workflow systems
    Olivier, MS
    van de Riet, RP
    Gudes, E
    [J]. NINTH INTERNATIONAL WORKSHOP ON DATABASE AND EXPERT SYSTEMS APPLICATIONS, PROCEEDINGS, 1998, : 346 - 351
12