Name
Abstract | ||
|---|---|---|
Recently an increasing number of web applications especially cloud computing systems utilize representational state transfer (REST) API to deploy their services for simplicity and clarity. Users can employ the same interface to invoke various applications from the Internet. For security purposes, service providers would control the access to the provided interface through policy enforcement. Yet the access control of REST interfaces lacks a uniform standard regarding the policy language and corresponding enforcement implementation, which brings two limitations: i) Users have to deal with totally different types of policies to accommodate certain systems. ii) Service providers have to design their own platform-specific authorization policy language and the related enforcement mechanisms. In this paper, we propose a REST Policy Language (RestPL) to express the authorization policies especially for REST APIs. RestPL is ensured to be request-oriented, based on our definition of the standard request form. This indicates that a RestPL policy can be automatically generated from an actual request, which helps mitigate a user's pressure during policy designing. Furthermore, we also provide a reference implementation for the enforcement code of RestPL based on regular expressions and deploy it on OpenStack Liberty to demonstrate its feasibility. The experimental results indicate the enforcement overhead of RestPL can be reduced to 80.6% compared with the original policy. In addition, we show that an end-user can also benefit from RestPL for reducing the learning effort by at least 41.6%. |
Year | DOI | Venue |
|---|---|---|
2016 | 10.1109/ICWS.2016.92 | 2016 IEEE International Conference on Web Services (ICWS) |
Keywords | Field | DocType |
representational state transfer,access control,security policy,request-oriented | Representational state transfer,World Wide Web,Computer security,Computer science,Access control,Security policy,Database | Conference |
ISBN | Citations | PageRank |
978-1-5090-2676-0 | 2 | 0.41 |
References | Authors | |
7 | 5 | |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Yang Luo | 1 | 15 | 8.44 |
| hongbo zhou | 2 | 13 | 3.48 |
| Qingni Shen | 3 | 71 | 22.47 |
| Anbang Ruan | 4 | 38 | 6.47 |
| Zhonghai Wu | 5 | 34 | 12.36 |