Security Models for Web-Based Applications


Nov 3, 2013 (3 years and 7 months ago)


Security Models for Web
Based Applications


The World Wide Web was originally developed as a publishing
medium for public documents, so provided few controls for restricting
access to information. As a wider range of documents
and services
appeared on the web, these needed improved security facilities and a
number of systems were proposed to satisfy the new requirements.
For example, e
commerce, most popular web application today
already have over 1$ trillion over the next years
. Because of
unauthorized access to credit card information, this web application
will face to the daunted challenge.

Factors of Internet Information Security:

The massive interconnection of heterogeneous and distributed

The availability of high
volumes of sensitive information at the
end systems maintained by corporations and governments

Easy distribution of automated of automated malicious software
by misfeasors

The ease with which computer crimes can be committed
anonymously from acros
s geographic boundaries

The lack of forensic evidence in computer crimes, which makes
the detection and prosecution of criminals extremely difficult[1]

Secure Web services

There are fundamental business reasons underlying the existence
of various s
ecurity mechanisms. The

of the entity
asserting an identity when requesting a service allows businesses to
offer different classes of service to different customers. The business
reason for
data integrity

is to ensure that each party in a tr
can have confidence in the business transaction. There is also a
business and legal need to have an
audit trail

and some evidence of
no repudiation

to address liability issues. And more and more
businesses are becoming aware of the internal threa
ts to their
applications by employees or others

the firewall. Some
business transactions require that

be provided on a
service invocation or its data (such as credit card numbers). Also
businesses on the Internet need to protect them
selves from

attacks. This is the environment in which we need to provide
a security service model.

Access Control Models:

For protecting the information systems against unauthorized
access to or modification of information, inform
ation security have
been introduced some models to address the access control
requirement of distributed application. They are discretionally access
control model and mandatory access control model, and role
access control model, task
based access co
ntrol model. [2][3]

Discretionary Access Control Model

DAC is a means of restricting access to objects based on the
identity of subjects and/or groups to which they belong. The controls
are discretionary in the sense that a user or process given
scretionary access to information is capable of passing that
information along to another subject. Discretionary control is the
most common type of access control mechanism implemented in
computer systems today. The basis of this kind of security is that
individual user, or program operating on the user's behalf, is allowed
to specify explicitly the types of access other users (or programs
executing on their behalf) may have to information under the user's
control. Discretionary security differs from ma
ndatory security in that
it implements the access control decisions of the user. Mandatory
controls are driven by the results of a comparison between the user's
trust level or clearance and the sensitivity designation of the

ry Access Control (DAC)
The Criteria defines
discretionary access control as: A means of restricting access to
objects based on the identity of subjects and/or groups to which they
belong. The controls are discretionary in the sense that a subject with
certain access permission is capable of passing that permission
(perhaps indirectly) on to any other subject.

DAC controls are used to restrict a user's access to protected
objects on the system. The user may also be restricted to a subset of
the p
ossible access types available for those protected objects.
Access types are the operations a user may perform on a particular
object (e.g., read, write, execute). Typically, for each object, a
particular user or set of users has the authority to distribut
e and
revoke access to that object. Users may grant or rescind access to
the objects they control based on "need to know" or "whom do I' like"
or other rules. DAC mechanisms control access based entirely on the
identities of users and objects. Discretionar
y access control
mechanisms restrict access to objects based solely on the identity of
subjects who are trying to access them. This basic principle of
discretionary access control contains a fundamental flaw that makes
it vulnerable to Trojan horses [3], [
4]. On most systems, any program,
which runs on behalf of a user, inherits the DAC access rights of that
user [5].

based Access Control Model

The fundamental principal of Role
Based Access Control
(RBAC) is that the decision to allow access t
o objects is based
on the role of the user, rather than permission based on other
user at their prudence. Hence, this enables a flexible access
control model, which can accommodate both military and non
military organization. The determination of the role
and the allocation of each role’s capabilities are not determine
by each individual who may be the system administrator. Each
role capability is determined by the organization’ security policy.
The greatest advantages of RBAC are its flexibility

and low
management overhead. Its flexibility allow the administrator to
enforce the principle of Least Privilege, conflict between duties,
dynamic and/or static separation of duties. Administrator using
RBAC can easily enroll and revoke the user’s role me
based on the user’s jobs and responsibilities. In large
organization or distributed system, RBAC framework can also
establish such that the administrative task can be
decentralized. Thus, it can naturally reflect the organizational
structure. Curr
ently, we are developing a RBAC module for the
Apache web server. It provides a number of proposed RBAC
features. The aim of this RBAC module is to gain experience in
implementation of RBAC, its environment and support in
accessing objects/information remo
tely. The current
implementation is only a small part of overall investigation of
RBAC environment. Future work will investigate RBAC’s
support for locally stored objects, as well as for CORBA and
COM objects.

Mandatory Access Control Model:

goal of MAC model is to control information flow in case that
makes the information confidentiality and integrity. The need for a
mandatory access control (MAC) mechanism arises when the
security policy of a system dictates that the object owner must not
ecide protection decisions and the system must enforce the
protection decisions (i.e., the system enforces the security policy over
the wishes or intentions of the object owner). The mandatory access
control policy is expressed in terms of security labels
attached to
subjects and objects. A label on an object is called a security
classification, while a label on a user is called a security clearance. It
is important to understand that a Secret users may run the same
program’s such as a text editor, as a Sec
ret subjects or as an
Unclassified subject. Even though both subjects run the same
program on behalf of the same user, they obtain different privileges
due to their security labels. It is assumed that the security labels on
subjects and objects, once assig
ned, cannot be changed (except by
the officer). This last assumption, that security labels do not change,
is known as tranquility.

Two approaches for web security:[3]

based Approach

The agent
based approach to Web mining involves the

of sophisticated AI systems that can act autonomously
or semi
autonomously on behalf of a particular user, to discover and
organize Web
based information. Generally
the agent
based Web
mining systems can be placed into the following three categories:

telligent Search Agents

Several intelligent Web agents have been developed that search for
relevant information using characteristics of a particular domain (and
possibly a user profile) to organize and interpret the discovered

Information Fi

A number of Web agents use various information retrieval
techniques and characteristics of open hypertext Web documents to
automatically retrieve, filter, and categorize them For example,
HyPursuit uses semantic information e
mbedded in link structures as
well as document content to create cluster hierarchies of hypertext
documents, and structure an information space.

Personalized Web Agents

Another category of Web agents includes those that obtain or
learn user preferenc
es and discover Web information sources that
correspond to these preferences, and possibly those of other
individuals with similar interests (using collaborative filtering).

based Approach

Using PKI certificates refer to public
key infras
tructure technology
will be expected to be unique in the future with PKI technology
maturing. PKI technology can be forced access control in the Web
environment. These technology can be used to either support a
host’s access control or provide a separate a
ccess control
mechanism based on trust centers.


Through this article, several security modes for web
application as
well as approaches have been showed. Web
based application has
been increasing in the future; Access control issues relate
d to web
security have become a problem, which cannot be neglected.
Whatever models have been developed , its purposed will be focused
on matching the user needs and protecting their privacy on the


[1] W. B. Frakes and R. Baeza

Information Retrieval Data Structures and
. Prentice Hall, Englewood Cliffs, NJ, 1992.

[2] M. Balabanovic, Yoav Shoham, and Y. Yun. An adaptive agent for automated
web browsing.
Journal of Visual Communication and Image Representation
, 6(4),

[3] R. Weiss, B. Velez, M. A. Sheldon, C. Namprempre, P. Szilagyi, A. Duda, and
D. K. Gifford. Hypursuit: a hierarchical network search engine that exploits
link hpertexxt clustering. In
Hypertext'96: The Seventh ACM Conference
on Hypertext
, 199

[4] James B.D, Joshi, Walid G. Areff Ghafoor, Eugene H. Spafford: Security
Models for Web
based Applications. Communications of the ACM. 44(2),2001.

[5] SandHU, R.S. and Samarati, P.1997. Authentication, access control and
intrusion detection. In the Co
mputer Science and Engineering Handbook,
A.B.Tucker, Ed. CRC Press, Inc., Boca Raton, FL, 1929