Johannes Meinecke

A modeling approach to federated identity and access management

As the Web is increasingly used as a platform for heterogeneous applications, we are faced with new requirements to authentication, authorization and identity management. Modern architectures have to control access not only to single, isolated systems, but to whole business-spanning federations of applications and services. This task is complicated by the diversity of todays specifications concerning e.g. privacy, system integrity and distribution in the web. As an approach to such problems, in this paper, we introduce a solution catalogue of reusable building blocks for Identity and Access Management (IAM). The concepts of these blocks have been realized in a configurable system that supports IAM solutions for Web-based applications.

Modeling federations of Web applications with WAM

One aspect of modern Web technology is that it is not only employed to connect users to sites, but to an increasing degree to bring together applications, as e.g. with the help of Web services. Particularly, these applications can reside under the control of different organizations. In this case, the Web is actually used as a means for establishing federations between the organizations behind their technical systems. This enables creating integrated business processes and thus facilitates seamless cooperation between multiple businesses. Naturally, the construction of such solutions raises specific concerns that go beyond traditional approaches, including questions of access control, identity management and evolution in the context of federation. Emerging federation specifications like WS-federation or liberty alliance are now offering standardized protocols as solutions to some of these problems. Along with the technological base, the process of establishing and operating federations also requires dedicated models to plan and describe the systems on an architectural level. Conventional approaches to modeling software in general and Web applications in particular do not specifically focus on federated architectures. For that purpose, we propose the Webcomposition architecture model (WAM), a modeling formalism based on our experience on developing federations of Web applications as well as the concepts found in recent federation specifications.

Aletheia: an architecture for semantic federation of product information from structured and unstructured sources

Product-related information can be found in various data sources and formats across the product lifecycle. Effectively exploiting this information requires the federation of these sources, the extraction of implicit information, and the efficient access to this comprehensive knowledge base. Existing solutions for product information management (PIM) are usually restricted to structured information, but most of the business-critical information resides in unstructured documents. We present a generic architecture for federating heterogeneous information from various sources, and argue how this process benefits from using semantic representations. An reference implementation tailor-made to business users is explained and evaluated. We also discuss several issues we experienced that we believe to be valuable for researchers and implementers of semantic information systems, as well as the information retrieval community.

Building blocks for identity federations

Technologies like XML and Web Services have posed new requirements to authentication, authorization and identity management for the Web as an application platform. Beyond merely providing access control for a single isolated system, modern, flexible architectures support a business-spanning federation of applications and services by sharing digital identities. The diversity of todays specifications and the many aspects to be considered, like e.g. privacy, system integrity and distribution in the Web, makes the construction of these architectures a very time-consuming task. Thus, a uniform view on the overall system is needed that abstracts from technological issues. This can be achieved by extracting the core concepts from the emerging Federation technologies and specifications and formalize them to an extent that they can be used as a foundation for configurable applications and services. In this paper, we introduce a solution catalogue of reusable building blocks for Identity and Access Management (IAM). We also present a configurable system that supports IAM solutions in Web-service-based applications.

Capturing the essentials of federated systems

Today, the Web is increasingly used as a platform for distributed services, which transcend organizational boundaries to form federated applications. Consequently, there is a growing interest in the architectural aspect of Web-based systems, i.e. the composition of the overall solution into individual Web applications and Web services from different parties. The design and evolution of federated systems calls for models that give an overview of the structural as well as trust-specific composition and reflect the technical details of the various accesses. We introduce the WebComposition Architecture Model (WAM) as an overall modeling approach tailored to aspects of highly distributed systems with federation as an integral factor.

Supporting Secure Deployment of Portal Components

With the growth of the World Wide Web, it has become more and more important to find implementation models tailored especially for Web applications. Unlike traditional applications, Web portals are required to be constantly up to date and are therefore often subject to changes at runtime. Consequently Web application frameworks have been developed that allow the construction and manipulation of Web pages consisting of pre-built components as an alternative to re-programming. The capability of such systems rises with the number of available components. Hence it is advisable to facilitate their deployment and exchange with a supporting architecture. The achieved increased use of third party components also results in higher risks for the provider of the portal. Especially the resource access by the contained code poses a potential threat and lowers the acceptance for foreign components. This paper proposes a robust architecture for the installation, administration and exchange of portal components and addresses the need for protection against malicious code.

Identifying the Truth: Aggregation of Named Entity Extraction Results

Huge amounts of textual information relevant for market analysis, trending or product monitoring can be found on the Web. To exploit that knowledge a number of extraction services were proposed that extract and categorize entities from given text. Prior work showed that a combination of individual extractors can increase quality. However, so far no system exists that is fully applicable to reasonably combine real world extraction services that differ substantially in the entity types they extract and the schemata used. In this paper, we propose an aggregation system and a corresponding aggregation process that can be used for these services. We present a number of novel aggregation techniques that incorporate schema-information as well as entity extraction specific characteristics into the aggregation process. The aggregation system is broadly evaluated on six real world named entity recognition services and compared to state of the art approaches.

Identifying Security Aspects in Web-Based Federations

Todays Web applications and their respective business processes reside under the control of different organizations. Establishing federations between these organizations, i.e. bringing these business processes together by transcending organizational and security borders, raises a new class of security questions concerning the management of trust relationships between the autonomous bodies that wish to work together. Based on the Webcomposition architecture model we provide a modeling approach for federated Web applications. In this paper we present a methodology for formalizing these models using the ambient calculus for use in further computation. Based on the results we help the users to identify and detect security related aspects in Web-based federations.

FDX: federating devices and web applications

Electronic devices have been used for the support of everyday tasks in domestic and professional environments for some time now. Currently, there is a tendency towards a combined application of individual gadgets that are connected within locally confined environments via a diversity of protocols and technologies like UPnP, WLAN and Bluetooth. As one step further in this direction, there is the vision of devices that are globally and uniformly connected through the WWW, extending the Mobile Web to a Ubiquitous Web. Hence, this allows for scenarios where actions on one device can trigger events on an arbitrary other device, and where third-party Web services from anywhere in the world are involved. Ultimately, this results in federations of devices and Web services belonging to different households, companies, suppliers and service providers, forming new kinds of Web applications that integrate devices as an additional dimension. To fulfill this vision, solutions are required that are able to abstract from the different device implementations and bridge the gap between the device and the Web. In this paper, we present the Federated Device Assembly (FDX) approach that offers an integrated management platform for wrapping and as such connecting arbitrary devices to enable new forms of Web applications along with the means to model such federations. Furthermore, we demonstrate how the required infrastructure systems can be realized by introducing a reference architecture and a generic Web service interface.

Aspects of service‐oriented component procurement in web‐based information systems

Modern information systems are increasingly built on Web‐based and component‐based platforms. This raises the need for a service‐oriented infrastructure to simplify the management and procurement of corresponding components. Special focus lies on the deployment and distribution of such software artifacts within the context of the World Wide Web to promote their reuse and there‐fore to save development costs. At the same time, the integrity of the overall system must not be neglected. The use of components from third‐party vendors poses a potential security threat requiring additional care. Furthermore remains the issue of usage rights for the components and the data they provide. Flexible mechanisms can offer a huge range of different licensing models to be enforced on the runtime process. This paper presents an approach to deal with these challenges together with an implementation of a software system supporting component‐based Web portals.