The proliferation of web services as self-contained web accessible programs and the idea of the Semantic Web of making information computer-interpretable enables the dynamic composition of complex services assembled from various individual services and typically distributed over the web. Following the paradigm of pervasive computing, pro-active agents are installed on mobile phones or PDAs operating on the web and handle the context-aware discovery of appropriate services and use AIbased plan generation techniques to dynamically compose the retrieved service to solve complex tasks. Functional composition of complex services is well understood and supported.
However, the introduction of web services in general and dynamic web service
composition (e.g. [
To protect the privacy of user related information, the data used in web
services is always classified according to its confidentiality. Web services require the
corresponding clearances to deal with confidential data. Both classifications and
clearances are denoted by a so-called security types. There is a partial ordering ≤
on security types which allow us to compare them. The set of all security types
together with ≤ forms a lattice. Similar to the approach presented by Bell and
LaPadula [
However, in practice we would like to select the clearances of web services and also the classification of data with respect to individual categories or types of information. For instance, while we trust a travel agent to keep our travel routes confidential we might have mixed feelings when providing the same agent with a direct debit authorization for our bank account. Analogously, a given datum may allow us, for instance, to infer confidential information about the location of a person or confidential information about his bank account. Hence, both classifications of data and clearances of web services are described by a vector of security types. Each entry in the vector denotes the classification or clearance with respect to a particular category or roles (like, for instance, location or payment information).
The clearances of web services are assessed by the owner of the planning agent or, in case of a delegation, by an agent acting on behalf of the provider. Thus, an information provider (typically the user) can specify which web service it trusts to keep data private with respect to given categories, or not. Analogously, the user determines the classification of the data that he enters to the agent and that will be provided to web services during plan execution. Web services classify data they provide as an output by integrating the classifications of all data used to compute the result. The data can be either input data from the caller or own data. In the first case the classification is given by the caller and in the second case the requirements of their own security policies for this data has to be taken into account.
The set of categories used to invoke a web service may change while processing the request. When a called web service provides new information, it may introduce a new category and classify the new data also with respect to this new category. In this way a subsequently called web service can formulate its security requirements for its provided data by defining also the clearances of all web services with respect to the new category. In this case, all data provided by the calling web service have to be classified as public with respect to the newly introduced categories. This is to avoid the blocking of external data by classifying them as confidential for a new category but providing no web service with a corresponding clearance.
All the above mechanisms are embedded in the extended type calculus. The extension belongs to the call of web services. In this context, we defined security specifications for web services which are defined and published by the agents similiar to the functional specifications. Thus, the information flow of confidential data is monitored by the type calculus which propagates the security requirements of the user and of the involved web services along the planning and execution of dynamically composed web services.
The described mechanisms together with the type system prevent any kind of “accidental” revealment because the plans are checked before the execution. However, the user of a planning agent has to trust that the web service will not send confidential data to some unauthorised web services. To overcome this problem we expand our approach by the application of certified web services. To ensure that only the certified parts of an agent get knowledge of the received input the approach has to be extended by the application of Trusted Computing or Proof Carry Code mechanisms.