Web Service Runtime Access Enforcement Module for XML Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web service security mechanisms rely solely on access control at the web service layer, which only enforces restrictions at the time of data access, and lack dynamic generation of security definitions based on data structure permissions, leading to inefficiencies and increased load on the XML server.
Innovation Solution
Implementing a two-level security system where web service runtime access enforcement modules determine and enforce permissions based on XML structure-based access control lists, dynamically generating user-specific WSDL files to restrict access at the web service layer, thereby reducing the load on the XML server and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control is enforced only at the web service layer, then security restrictions are applied, but the XML server bears the full load of processing all requests including unauthorized ones
Solution Approach 1:
The patent applies preliminary action by generating user-specific WSDL files before actual web service calls are made. The WSDL files are pre-configured with only those operations and data elements that the user is authorized to access, based on their permissions defined in the XML schema. This allows the web service layer to filter unauthorized requests before they reach the XML server, reducing server load while maintaining security.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a web service runtime environment that acts as a mediator between clients and the XML server. This intermediary generates and enforces user-specific WSDL files, which serve as a security filter. The mediator translates general XML schema permissions into specific web service access controls, preventing unauthorized requests from reaching the XML server.
2Reliability
If standardized security mechanisms like XACML or WS-Policy are configured in the web service runtime environment, then access restrictions can be enforced, but security policies are not dynamically generated based on data structure permissions
Solution Approach 1:
The patent applies self-service by enabling the web service runtime environment to automatically generate user-specific WSDL files based on the user's permissions defined in the XML schema. The system serves itself by translating XML structure permissions into web service access controls without requiring manual configuration of security policies. This automation reduces complexity while maintaining reliable access restriction enforcement.
Solution Approach 2:
The patent changes the parameter of security policy generation from static manual configuration to dynamic automatic generation. By using the XML schema's permission definitions as input parameters, the system dynamically generates appropriate WSDL files for each user. This parameter change allows security policies to adapt automatically to different users and permissions, reducing configuration complexity.
3Ease of operation
If all web service operations are made available in WSDL files, then clients have full access information, but unauthorized operations cannot be identified and restricted earlier
Solution Approach 1:
The patent applies local quality by making WSDL files user-specific rather than universal. Each user receives a customized WSDL file that contains only the operations and data elements they are authorized to access, based on their permissions in the XML schema. This localized approach maintains ease of operation by providing clear, relevant interfaces while simultaneously improving reliability by excluding unauthorized operations from the visible interface.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Certain example embodiments relate to techniques for automatically deriving web service permissions based on XML structure permissions. A call for a web service operation is received from a client at a web service runtime engine. XML data objects from a database of XML data obj ects located on an XML server implicated by the called web service operation are identified. The XML data objects have corresponding XML data structures. Access permissions for the user for the identified XML data objects are retrieved from the XML server. The access permissions for the web service previously were generated automatically from access permissions based on the XML data structures for corresponding XML data objects. The called web service operation is either permitted or prohibited based on a determination, at the web service runtime engine and based on the retrieved access permissions, whether the called web service operation can be performed. In this way, data access requests are handled in the "higher" web service layer. Also user specific WSDL files may be generated based on the access permissions of the user to the XML data objects.