Controle de acesso a Web Services baseado em um protocolo de autenticação segura

Abstract

Computing is causing a revolution in peoples and business life. Internet is for sure the reason why this ubiquitous computing is present in all almost all daily process. Web Services offers a new way to use Internet, where remote applications can communicate each other using interoperable standards. Through this approach the Web can be the source not of only information, but distributed computing. In this environment security is a critical issue and the security model to Web Services is not fully defined. Access control is a way to guarantee that only the users, or systems, that are fully recognized can access services and information. Passwords are a spread way used to accomplish this. Nevertheless, most systems currently used to perform this control shows deficiencies and an intruder can break it down. This work presents and deploys a solution for the Web Services authentication control. This solution is based on SRP (Secure Remote Password), a strong-based password authentication protocol. To accomplish this, the protocol has to be extended in offer authentication control as an independent layer can be built on any available Web Services plataform. In this work we have used Apache AXIS for this end.