A mechanism for operation level role based access control in web services

Many online businesses offer their functionality as web services. Due to the ubiquitous presence of web services security, especially the service access control is becoming a serious issue. Traditionally, access control was applied on a complete web service which contains a number of operations where each operation offers some special functionality. If access is to be given to a user for few selected operations then separate web services need to be offered corresponding to these operations. Due to this, large number of web services with small functionalities need to be deployed. Since these large number of services need to be published in the UDDI registry, it becomes bulky. Also, for each operation, separate invocation of each service is to be made. Existing most of the access control systems are identity based in which decision is taken on the basis of subject identity. With the increase in number of users, Role Based Access Control (RBAC) is useful as it provides access control to a group instead of individual users and is also easy to scale. In this work, a method has been proposed to provide more fine grained access control on web services at operations level based on roles by extending XACML policy specifications.