Dynamic Authentication for Cross-Realm SOA-Based Business Processes
13
,((( 75$16$&7,216 21 6(59,&( &20387,1* 0$186&5,37 ,' '\QDPLF $XWKHQWLFDWLRQ IRU &URVV5HDOP 62$%DVHG %XVLQHVV 3URFHVVHV -LH ;X 0HPEHU ,((( &RPSXWHU 6RFLHW\ 'DFKHQJ =KDQJ /X /LX 0HPEHU ,((( ;LDQ[LDQ /L $EVWUDFW² 0RGHUQ GLVWULEXWHG DSSOLFDWLRQV DUH HPEHGGLQJ DQ LQFUHDVLQJ GHJUHH RI G\QDPLVP IURP G\QDPLF VXSSO\FKDLQ PDQDJHPHQW HQWHUSULVH IHGHUDWLRQV DQG YLUWXDO FROODERUDWLRQV WR G\QDPLF UHVRXUFH DFTXLVLWLRQV DQG VHUYLFH LQWHUDFWLRQV DFURVV RUJDQL]DWLRQV 6XFK G\QDPLVP OHDGV WR QHZ FKDOOHQJHV LQ VHFXULW\ DQG GHSHQGDELOLW\ &ROODERUDWLQJ VHUYLFHV LQ D V\VWHP ZLWK D 6HUYLFH2ULHQWHG $UFKLWHFWXUH 62$ PD\ EHORQJ WR GLIIHUHQW VHFXULW\ UHDOPV EXW RIWHQ QHHG WR EH HQJDJHG G\QDPLFDOO\ DW UXQWLPH ,I WKHLU VHFXULW\ UHDOPV GR QRW KDYH D GLUHFW FURVVUHDOP DXWKHQWLFDWLRQ UHODWLRQVKLS LW LV WHFKQLFDOO\ GLIILFXOW WR HQDEOH DQ\ VHFXUH FROODERUDWLRQ EHWZHHQ WKH VHUYLFHV $ SRWHQWLDO VROXWLRQ WR WKLV ZRXOG EH WR ORFDWH LQWHUPHGLDWH UHDOPV DW UXQWLPH ZKLFK VHUYH DV DQ DXWKHQWLFDWLRQSDWK EHWZHHQ WKH WZR VHSDUDWH UHDOPV +RZHYHU WKH SURFHVV RI JHQHUDWLQJ DQ DXWKHQWLFDWLRQ SDWK IRU WZR GLVWULEXWHG VHUYLFHV FDQ EH KLJKO\ FRPSOLFDWHG ,W FRXOG LQYROYH D ODUJH QXPEHU RI H[WUD RSHUDWLRQV IRU FUHGHQWLDO FRQYHUVLRQ DQG UHTXLUH D ORQJ FKDLQ RI LQYRFDWLRQV WR LQWHUPHGLDWH VHUYLFHV ,Q WKLV SDSHU ZH DGGUHVV WKLV SUREOHP E\ GHVLJQLQJ DQG LPSOHPHQWLQJ D QHZ FURVVUHDOP DXWKHQWLFDWLRQ SURWRFRO IRU G\QDPLF VHUYLFH LQWHUDFWLRQV EDVHG RQ WKH QRWLRQ RI VHUYLFH RULHQWHG PXOWLSDUW\ EXVLQHVV VHVVLRQV 2XU SURWRFRO UHTXLUHV QHLWKHU FUHGHQWLDO FRQYHUVLRQ QRU HVWDEOLVKPHQW RI DQ\ DXWKHQWLFDWLRQ SDWK EHWZHHQ WKH SDUWLFLSDWLQJ VHUYLFHV LQ D EXVLQHVV VHVVLRQ 7KH FRUUHFWQHVV RI WKH SURWRFRO LV IRUPDOO\ DQDO\]HG DQG SURYHQ DQG DQ HPSLULFDO VWXG\ LV SHUIRUPHG XVLQJ WZR SURGXFWLRQ TXDOLW\ *ULG V\VWHPV *OREXV DQG &52:1 7KH H[SHULPHQWDO UHVXOWV LQGLFDWH WKDW WKH SURSRVHG SURWRFRO DQG LWV LPSOHPHQWDWLRQ KDYH D VRXQG OHYHO RI VFDODELOLW\ DQG LPSRVH RQO\ D OLPLWHG GHJUHH RI SHUIRUPDQFH RYHUKHDG ZKLFK LV IRU H[DPSOH FRPSDUDEOH ZLWK WKRVH VHFXULW\UHODWHG RYHUKHDGV LQ *OREXV ,QGH[ 7HUPV² $XWKHQWLFDWLRQ LQWHURUJDQL]DWLRQDO VHFXULW\ PXOWLSDUW\ LQWHUDFWLRQV 6HUYLFH2ULHQWHG $UFKLHFWXUH :HE VHUYLFHV —————————— —————————— ,1752'8&7,21 LWK WKH HPHUJHQFH RI VHUYLFHRULHQWHG WHFKQRORJLHV G\QDPLVP DQG IOH[LELOLW\ DUH EHFRPLQJ WKH FRUH FKDU DFWHULVWLFV RI PRGHUQ LQWHURUJDQL]DWLRQDO EXVLQHVV SURF HVVHV VXFK DV EXVLQHVV DSSOLFDWLRQ LQWHJUDWLRQ GLVWULEXWHG DXFWLRQ VHUYLFHV DQG RUGHU SURFHVVLQJ > @ :LWKLQ D VHU YLFHRULHQWHG DUFKLWHFWXUH 62$ DQ RUJDQL]DWLRQ PD\ HQ FDSVXODWH DQG SXEOLVK LWV DSSOLFDWLRQV DV VHUYLFHV DQG VHOHFW DQG LQWHUDFW DW UXQWLPH ZLWK WKH VHUYLFHV SURYLGHG E\ RWKHU RUJDQL]DWLRQV +RZHYHU IRU ERWK XVHU DQG YHQGRU RUJDQL]D WLRQV WKLV UDLVHV LPPHGLDWH SUREOHPV RI VHFXULW\ WUXVW DQG GHSHQGDELOLW\ >@ 8QWLO WKHVH SUREOHPV DUH DGGUHVVHG DQG VROYHG VDWLVIDFWRULO\ WKH SRWHQWLDO RI DXWRPDWLF LQWHU RUJDQL]DWLRQDO EXVLQHVV SURFHVVHV ZLOO EH VHYHUHO\ UHVWULFWHG ,Q D G\QDPLF DQG GLVWULEXWHG HQYLURQPHQW LW LV RIWHQ GLI ILFXOW IRU D FRPSOH[ EXVLQHVV SURFHVV WR IROORZ D VWDWLF EXVL QHVV VSHFLILFDWLRQ 7KH H[HFXWLRQ RUGHU RI LWV DFWLYLWLHV DW UXQWLPH LV XVXDOO\ XQSUHGLFWDEOH DQG RQ VRPH RFFDVLRQV WKH DFWXDO H[HFXWLRQ RI D SURFHVV FDQ EH ³RQHRIDNLQG´ >@ 7KH DSSOLFDWLRQV DQG VHUYLFHV LQYROYHG LQ D FRPSOH[ EXVL QHVV SURFHVV DUH W\SLFDOO\ KHWHURJHQHRXV SURYLGHG E\ GLI IHUHQW RUJDQL]DWLRQV 6LQFH HDFK RUJDQL]DWLRQ KDV LWV RZQ VHFXULW\ PHFKDQLVPV DQG SROLFLHV WR SURWHFW LWV ORFDO UH VRXUFHV WKH EXVLQHVV SURFHVV KDV WR RSHUDWH DPRQJVW PXOWL SOH KHWHURJHQHRXV VHFXULW\ UHDOPV $ VHFXULW\ UHDOP LV D JURXS RI SULQFLSDOV HJ SHRSOH FRPSXWHUV VHUYLFHV WKDW DUH UHJLVWHUHG ZLWK DQ DXWKHQWLFDWLRQ DXWKRULW\ DQG PDQDJHG WKURXJK D FRQVLVWHQW VHW RI VHFXULW\ SURFHVVHV DQG SROLFLHV $Q DXWKHQWLFDWLRQ DXWKRULW\ LV D WUXVWHG SULQFLSDO WKDW SHU IRUPV UHOLDEOH DXWKHQWLFDWLRQ IXQFWLRQV >@ $XWKHQFDWLRQ LV D FULWLFDO PHDVXUH IRU DQ\ VHFXULW\ UHDOP %HIRUH D SULQFLSDO LV DOORZHG WR DFFHVV WKH UHVRXUFHV LQ D UHDOP LWV LGHQWLW\ PXVW EH YHULILHG 'LIIHUHQW IURP SUHYLRXV FURVVUHDOP DXWKHQWLFDWLRQ PH FKDQLVPV ZKLFK HLWKHU UHTXLUH IHGHUDWHG DXWKHQWLFDWLRQ E\ PDLQWDLQLQJ GLUHFW FURVVUHDOP DXWKHQWLFDWLRQ UHODWLRQVKLSV EHWZHHQ DQ\ SDLU RI VHFXULW\ UHDOPV RIWHQ LPSUDFWLFDO RU KLJKO\ FRVWO\ RU UHTXLUH DGGLWLRQDO FUHGHQWLDO FRQYHUVLRQ IURP RQH GRPDLQ WR DQRWKHU LQ WKLV SDSHU ZH SUHVHQW D QHZ VROXWLRQ IRU G\QDPLFDOO\ DXWKHQWLFDWLQJ WKH VHUYLFHV IURP GLIIHUHQW UHDOPV IRU 62$EDVHG EXVLQHVV SURFHVVHV DW UXQ WLPH ZLWK ORZ RYHUKHDG 7KH PDLQ FRQWULEXWLRQV RI RXU ZRUN DUH XVLQJ WKH PXOWLSDUW\ VHVVLRQ FRQFHSW WR VWUXFWXUH G\QDPLF EXVLQHVV SURFHVVHV D VLPSOH EXW HIIHFWLYH ZD\ WR HVWDEOLVK RQWKHIO\ WUXVW UHODWLRQVKLSV EHWZHHQ WKH PHP EHUV RI D EXVLQHVV VHVVLRQ DQG D VHW RI SURWRFROV IRU PXO WLSDUW\ VHVVLRQ PDQDJHPHQW VXSSRUWHG E\ IRUPDO DQDO\VLV [[[[[[[[[[[ [ ,((( ²²²²²²²²²²²²²²²² J. Xu is with School of Computing, University of Leeds, Leeds, West Yorkshire, LS2 9JT, UK. E-mail: [email protected] D. Zhang is with Beijing Research Centre of Huawei Technology, Shang- di, Beijing, 100085, China. E-mail: [email protected] L. Liu is with School of Engineering and Information Sciencesm, Middle- sex University, London, NW4 4BT, UK. E-mail: [email protected] X. Li is with Faculty of Computer Science, Beihang University, Haidian, Beijing, China. E-mail:[email protected] Manuscript received Oct 20, 2009. This work was supported in part by the UK EPSRC/BAE Systems NECTISE project (EP/D505461/1), the ESRC MoSeS project (RES-149-25-0034), the EPSRC WRG project (EP/F057644/1), the EPSRC CoLaB project (EP/D077249/1) and Major Program of the Na- tional Natural Science Foundation of China (No.90818028). : Digital Object Indentifier 10.1109/TSC.2010.33 1939-1374/10/$26.00 © 2010 IEEE This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
-
Upload
praveen-kalimireddy -
Category
Documents
-
view
152 -
download
1
Transcript of Dynamic Authentication for Cross-Realm SOA-Based Business Processes
—————————— ——————————
J. Xu is with School of Computing, University of Leeds, Leeds, West
Yorkshire, LS2 9JT, UK. E-mail: [email protected] D. Zhang is with Beijing Research Centre of Huawei Technology, Shang-
di, Beijing, 100085, China. E-mail: [email protected] L. Liu is with School of Engineering and Information Sciencesm, Middle-
sex University, London, NW4 4BT, UK. E-mail: [email protected] X. Li is with Faculty of Computer Science, Beihang University, Haidian,
Beijing, China. E-mail:[email protected] Manuscript received Oct 20, 2009. This work was supported in part by
the UK EPSRC/BAE Systems NECTISE project (EP/D505461/1), the ESRC MoSeS project (RES-149-25-0034), the EPSRC WRG project (EP/F057644/1), the EPSRC CoLaB project (EP/D077249/1) and Major Program of the Na-tional Natural Science Foundation of China (No.90818028).
Digital Object Indentifier 10.1109/TSC.2010.33 1939-1374/10/$26.00 © 2010 IEEE
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
p large prime number
a exponentiation base
A, B, C session partners
SA session authority
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
IDA identifier of A
S multi-party session with identifier IDS
Pri(A) private key of principal A
Pub(A) public key of principal A, i.e. (aPri(A) mod p) = IDA
X, Y range over statements
(M, N) composite message composed of messages M and N
K(A, B) secret key generated with Pri(A) and Pub(B); K(A, B) = (Pub(B))Pri(A) = aPri(A) Pri(B) mod p; K(A, B) =K(B, A)
MAC(M)K message authentication code of M gener-ated with secret key K
Secure(M) message M is transmitted by a secure chan-nel
Valid(M)K composite message (M, MAC(M)K)
Pub(A) Pub(A) is good [6]. That is its corresponding Pri(A) will never be discovered by any other principals and Pub(A) is not weak (e.g., Pub(A)=1)
#M M is fresh, i.e. M has not been sent in a mes-sage at any time before the current run of the protocol
SP(A, S) statement that A is a session partner of S. Particularly, SP(SA, S) is always true
A B K(A,B) is A’s secret key to be shared with B. No third principal aside from A and B can deduce K(A, B). But A have not yet get confir-mation from B that B knows K(A, B).
A B K(A,B) is a key held by A. No third principal aside from A and B can deduce K(A, B). and A has received key confirmation from B which indicates that B actually knows K(A, B).
A| X A believes that statement X is true
A X A is an authority on X, i.e. A has jurisdiction over X
A M A receives message M from somebody.
(1) A F: Secure(Request, IDS, IDA) (2) F A: Secure(IDB, IDS) (3) A SA: Valid(SP(B,S), IDB, IDA, IDSA, IDS, N)K(A, SA)
(4) SA A: Valid(Confirm, N+1) K(SA, A)
(5) A B: Valid(Invoke, IDA, IDB, IDS, N1)K(A, B)
(6) B A: Valid(Reply, IDB, IDA, IDS, N1+1)K(B, A)
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
Lemma 1 A Valid(M)K(A,B), , and A| #M, then A| B | M.
Proof: This lemma can be deduced directly from Rule 6.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
