Overview of Modern Web Architectures, Standards, Security, and Future Directions
Overview of Modern Web Architectures,
Standards, Security, and Future Directions
Dr. Mohammad Iqbal
(Thanks to Zhenhua Guo, 2009)
1
Outline
Web App Case Study
Modern Web Characteristics
Modern Web Architecture : OpenSocial
Architecture
Components
Security
Background
Authorization
Out of Scope: Authentication
Future Directions
2
Modern Web App
Case Study : Facebook
Your current status
Friends
photos
Facebook
More than 200 million active users
Activities of
MS paid $240 million foryour
1.6friends
percent
Video
Comment, Rate
Aggregation
with Picasa
groups
Chat
More apps!
3
Previous Web App
Case Study : Yahoo! Directory
Provider-defined directory
4
Examples of two “versions” of web apps
1995-2005 Web
2005-Present Web
Britannica Online
Wikipedia
Akamai
BitTorrent
Directories
(Taxonomy)
Tagging
(Folksonomy)
Tightly coupled apps
App Mashup/Integration
Home page
Blog
5
Web 2.0
“Second generation of web development and web
design”
Web 2.0 vs. Web 1.0
Technical point of view
Similar technologies as Web 1.0: HTML, Javascript, XML, HTTP, etc.
Web2.0 makes the web programmable
User’s point of view
Read-write collaborative web
Participatory nature
Blogging, commenting, rating
Cooperate, not control
Sharing, creation of data
Facebook interoperates with Google Picasa, Yahoo! Flickr,
Blogs, etc
User centric
Web is a platform. Users add content (“value”)
6
Web 2.0
Enterprise Approach
Web 2.0 Approach
Portlets
Gadgets, Widgets
SOAP
RSS, Atom, JSON
WSDL
REST(GET, PUT, POST ,DELETE)
Workflow managers
Mash-ups (e.g. Yahoo Pipes)
Server side integration Client-side integration (AJAX)
Gateways
Debate (Buzzword vs. Real progress) is going on, but it
has begun to coalesce.
User-centric social network portals
“Web 2.0 Architectures: What entrepreneurs and information architects
need to know”
OpenSocial: case study that illustrates or motivates several Web 2.0
topics of discussion.
We will use Open Social to illustrate Web 2.0 architecture
7
OpenSocial
A coherent open architecture designed for
social network services and applications.
Common APIs across many websites
REST/RPC protocols – for server-to-server interactions
Javascript APIs – for browser-to-server interactions
Authorization mechanism, Data model …
Usage
Supported by MySpace, Google Orkut, Twitter,
LinkedIn, XiaoNei…
Internationalization
Rival: Facebook
8
Open Social Javascript API Example
Data
Model
Fetch profile
information
of owner
JavaScript
API
example
AJAX!!!
Person: ID, NAME, NICKNAME, ADDRESSES, EMAILS,
STATUS, MOVIES, MUSIC,FOOD …
Activity: TITLE, URL, BODY, PRIORITY …
// Creates a data request object to use for
// sending and fetching data from the server.
var req = opensocial.newDataRequest();
// Adds an item to fetch data from the server
req.add(req.newFetchPersonRequest('OWNER'), “owner”);
// Sends a data request to the server
req.send(function(data) {
owner = dataResponse.get("owner").getData();
});
9
Open Social Message Examples
Request (HTTP POST)
157 Bytes
[{"method" :"people.get",
"params" :{
"userId" : ["@owner"],
How about the corresponding
"groupId" : "@self",
representation in XML???
"id"
: "owner",
"fields" :
["id","name", "thumbnailUrl", "profileUrl", "id", "displayName"]}}]
JSON
[{"id"
:"owner",
"data" :{
"displayName" :
"profileUrl" :
"id"
:
"thumbnailUrl":
"name"
:
...... }}]
Response
"Guo Zhenhua"
"/Main#Profile.aspx?uid=3672642670645936703,
"06881043280087178653",
"http://www.orkut.com/img/i_nophoto64.gif",
{ "familyName":"Zhenhua", "givenName":"Guo" },
10
Request message
represented in XML
<request>
<method>people.get</method>
<params>
<userId>
<id>@owner</id>
</userID>
<groupId>@self</groupId>
<id>owner</id>
<fields>
<field>id</field>
<field>name</field>
<field>thumbnailUrl</field>
<field>profileUrl</field>
<field>id</field>
<field>displayName</field>
</fields>
<params>
281 Bytes
</request>
JSON
Lightweight, Simple
Can represent basic data structures
(number, string, boolean, object, array)
Textual human-readable
Easy to generate and manipulate
Not extensible, No namespace
Hard to represent complex data structures
References
User-defined type
XML
Extensible
Support namespace
Support representation of complex
data structures.
Heavyweight
Slow and verbose
OpenSocial - Architecture
Components
Interface –
REST, Javascript APIs
Client – Ajax, Gadget
Message Format –
JSON, XML
Security - OAuth
Data Model
Logic level
12
OpenSocial Interface – REST
REST – REpresentational State Transfer
Based on HTTP (client/server + stateless server)
Resource-oriented (resource can be anything)
Each resource is identified by a unique URL
State transition (Link resources together)
Resources have multiple representations (JSON,XML)
Uniform interfaces
GET
How to access top ten Twitter topics?
Read
resource
verb
POST
Create
PUT
Update
GET http://search.twitter.com/trends.json
DELETE
Delete
Returns the top ten topics
that are currently trending on Twitter.
* CRUD – Create, Read, Update, Delete
13
Analysis of REST
Treat the web as a big database of resources
Constraint
Good for CRUD operations
Stateless
HTTP (request-response)
Beyond REST
Stateful applications
Streaming Applications
Workflow Execution
Push-Based systems
Pub-Sub systems
14
REST Alternative
SOAP-based WS
SOAP
Message format
UDDI
1
2
3
Service Registration
WSDL
Service description interface
4
Publish – Bind – Find
About 60 core ws-* protocols
Designed for server-server interactions
SOAP and WSDL are really complicated
Browser-based apps are second-class
citizens.
15
AJAX
OpenSocial Client Tech – AJAX
Rationale
Update sections without refreshing the whole page
More interactive
More responsive
Requires less bandwidth
Asynchronous JavaScript and XML
HTML + CSS Presentation
DOM Document model (for dynamic manipulation)
XMLHttpRequest Asynchronous Communication
JSON/XML Data exchange format
Javascript Bring these together
17
Data
Model
OpenSocial - Data Model
Define data models for basic objects in social
network
Relationships between objects can not be
represented.
Person
Activity
AppData
Friend of a Friend (FOAF) – Based on W3C RDF
XHTML Friends Network (XFN)
Other possible issues
Groups, roles, communities
Strength of relationships
Relationships in which more than two objects are involved
Scalability (in terms of number of friends)
19
Security in OpenSocial
20
Beyond Functionalities - Security
Identity
“On the internet, nobody knows you're a dog”
Claimed Identity ≠ Real Identity
Data protection
Who can access your Facebook data?
Increasing risk of identity theft and impersonation.
Cartoon by Peter Steiner.
The New Yorker, July 5, 1993 issue
(Vol.69 (LXIX) no. 20) page 61
Favorite color, mother’s maiden name, …
“Friends” and applications have access to this
“Predicting Social Security numbers from public data”
Communication links
Messages are passed by intermediary machines
Intermediaries understand your messages?
Intermediaries alter your messages?
Intermediaries forge your messages?
21
Security Requirements (in Web)
Connection level
SSL/TLS
System Implementation level
Confidentiality
Integrity
Non-repudiation
Prevention of replay attack
Redirect
Session stealing (cookie)
Cross-site scripting, Cross-site request forgery
Securer programs +
User education
Architecture level
Authentication
Single Sign-On
Authorization
Delegation
22
Challenges
Technical Challenges
Loosely coupled components
No single, isolated trusted base
Domain-specific policies
Separation of security policies and security mechanisms.
Possible solutions
Authentication
Central Authentication Service
Cosign
OpenID
Authorization
Shibboleth
OAuth
23
OpenSocial Authorization – OAuth
Motivation
Solution
Delegated authorization protocol
Light-weight
Explicit user consent
Based on REST
3rd-party App
Twitter
Drawbacks
To allow third party apps to access users’ data stored at service
provider without requiring username and password.
Vulnerable to session fixation attack (http://oauth.net/advisories/2009-1)
Delegation granularity (Service provider-specific)
Access token expiration and revocation
Resources
http://oauth.net/
24
Authentication
OpenSocial does not define authentication mechanism.
Different accounts for different service providers
Twitter, Facebook, Myspace, Orkut, Hi5 …
Same data everywhere
Account linking
Linking Disparate Account IDs Across Multiple Systems or Applications
Identity
Federation
Web
Server
Identification
Provider
Web
Server
Web
Server
=>
Identity portability
N
W
Web
Server
E
S
Trust
Relationship
Web
Server
Identification
Provider
Web
Server
25
Authentication – OpenID
Motivation
Provide lightweight authentication service across domains
Solution
Users are asked to prove ownership of their OpenID identifiers.
OpenID identifiers are URLs (e.g. http://zhenhua-guo.blogspot.com).
Service provider and identity provider are clearly separated.
Authentication delegation (service provider → identity provider)
Advantages
Drawbacks
Cross-domain authentication
Attribute exchange beyond authentication
Single Sign-On
Easy OpenID provider switch
Phishing attack
Resources
http://fcom.us.es/blogs/nuevafcom/files/2008/09/openid-1.jpg
Supported by Facebook, Verisign, Sourceforge, Yahoo, etc.
26
OAuth and OpenID
Based on relaxed REST
Use SSL/TLS to guarantee confidentiality,
integrity and non-repudiation.
Scalability
Vulnerable to
Phishing
Cross-site scripting
Cross-site request forgery
27
Conclusions
Adoption of web 2.0
Services, not packaged software
Open Architecture and Open Standards
Interoperability
Flexibility
Integration
Security
Adoption in scientific communities
Traditional gateways
LEAD, Earth System Grid
Gateways that integrate web 2.0 technologies
myExperiment, SciVee, Sakai
Open Life Science Gateway
PolarGrid Portal
Research Opportunities
Social network in scientific communities
Data Integration
Manual integration
Unified specification
Adaptive integration
Security model
Collaboration and Cooperation
Open, Flexible, Scalable, …
Data Mining
Tag, Comment, Email, Blog, …
29
Future Directions
Semantic Web (Web 3.0?)
Machine-readable representations of resources and
relationships
Artificial Intelligence, Data Mining
Search Engine
Recommendation System
Scaling
Question Answering
Information search
Information retrieval
Social Network Analysis
Flow pattern recognition
Strength of connections
30
My Research
Gadget Layout Management
OAuth implementation
Implement 2-legged OAuth
Integrate 3-legged OAuth
PolarGrid Portal
Zhenhua Guo, Raminderjeet Singh, Marlon Pierce
Building the PolarGrid Portal Using Web 2.0 and
OpenSocial. GCE09 Grid Computing Environments
33
2009 workshop at SC09
Reference
Papers
Distributed Systems
Hongbin Liu, Shrideep Pallickara, Geoffrey Fox. Performance of Web Services Security.
Proceedings of the 13th Mardi Gras Conference, 2005
Satoshi Shirasuna, Aleksander Slominski, Liang Fang, Dennis Gannon. Performance
comparison of security mechanisms for grid services. Proceedings of the Fifth IEEE/ACM
International Workshop on Grid Computing, 2004
Shrideep Pallickara, Marlon E. Pierce, Harshawardhan Gadgil, Geoffrey Fox,
Yan Yan, Yi Huang. A Framework for Secure End-to-End Delivery of Messages in
Publish/Subscribe Systems. The 7th IEEE/ACM International Conference on Grid
Computing, 2006
Cesare Pautasso, Olaf Zimmermann, and Frank Leymann. Restful web services vs. "big"'
web services: making the right architectural decision. Proceeding of the 17th international
Conference on World Wide Web, 2008
Michael zur Muehlen, Jeffrey V. Nickerson and Keith D. Swenson . Developing web
services choreography standards—the case of REST vs. SOAP.
http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B6V8S-4CF5FWK1&_user=10&_rdoc=1&_fmt=&_orig=search&_sort=d&_docanchor=&view=c&_searchStrId
=1058155249&_rerunOrigin=scholar.google&_acct=C000050221&_version=1&_urlVersion
=0&_userid=10&md5=e9c0b58f44e71de372ea92e94b34f385
Reference (cont.)
Authentication
Clifford Neuman, Theodore Ts'o. Kerberos: An Authentication Service for Computer
Networks. IEEE Communications, 1994
John Kohl, B. Clifford Neuman, Theodore T'so. The Evolution of the Kerberos
Authentication System. In Distributed Open Systems, pages 78-94. IEEE Computer
Society Press, 1994
David Recordon , Drummond Reed. OpenID 2.0: a platform for user-centric identity
management. Proceedings of the second ACM workshop on Digital identity management,
2006
Drummond Reed, Les Chasen, William Tan. OpenID identity discovery with XRI and
XRDS. IDtrust, ACM International Conference Proceeding Series, Vol. 283, pp. 19-25,
ACM, 2008
35
Reference (cont.)
Authorization
David Chadwick, Alexander Otenko. The PERMIS X.509 role based privilege management
infrastructure. Future Generation Computer Systems, 19(2), pp. 277-289, 2003
David Chadwick, Gansen Zhao, Sassa Otenko, Romain Laborde, Linying Su,
Tuan-Anh Nguyen. PERMIS: a modular authorization infrastructure. Concurrency and
Computation: Practice and Experience, 20(11), pp. 1341-1357, 2008
Von Welch, Frank Siebenlist, Ian Foster, John Bresnahan, Karl Czajkowski, Jarek Gawor,
Carl Kesselman, Sam Meder, Laura Pearlman, Steven Tuecke. Security for Grid Services.
Twelfth International Symposium on High Performance Distributed Computing, IEEE
Press, 2003
Ian Foster, Carl Kesselman, Gene Tsudik, Steven Tuecke. A Security Architecture for
Computational Grids. ACM Conference on Computers and Security, pp. 83-91, ACM
Press, 1998
Mary Thompson, William Johnston, Srilekha Mudumbai, Gary Hoo, Keith Jackson,
Abdelilah Essiari. Certificate-based Access Control for Widely Distributed Resources.
Proceedings of the 8th USENIX Security Symposium (SECURITY-99), pp. 215-228,
Usenix Association, 1999
Anirban Chakrabarti, Anish Damodaran, Subhasis Sengupta. Grid Computing Security: A
Taxonomy. IEEE Security & Privacy, 6(1), pp. 44-51, 2008
Tom Barton, Jim Basney, Tim Freeman, Tom Scavo, Frank Siebenlist, Von Welch,
Rachana Ananthakrishnan, Bill Baker, Monte Goode, Kate Keahey.Identity federation and
attribute-based authorization through the globus toolkit, Shibboleth, GridShib, and
MyProxy. 5th Annual PKI R&D Workshop, 2006
Reference (cont.)
Ralf Groeper, Christian Grimm, Stefan Piger, Jan Wiebelitz. An Architecture for
Authorization in Grids using Shibboleth and VOMS. Euromicro Conference-Software
Engineering and Advanced Applications, pp. 367-374, IEEE Computer Society, 2007
Von Welch, Tom Barton, Kate Keahey, Frank Siebenlist. Attributes, anonymity, and
access-shibboleth and globus integration to facilitate grid collaboration. 4th Annual PKI
R&D Workshop, 2005
Laura Pearlman, Von Welch, Ian T. Foster, Carl Kesselman, Steven Tuecke. A Community
Authorization Service for Group Collaboration. POLICY, pp. 50-59, IEEE Computer
Society, 2002
Roberto Alfieri, Roberto Cecchini, Vincenzo Ciaschini, Luca dell'Agnello, Ákos Frohner,
Alberto Gianoli, Károly Lörentey, Fabio Spataro. VOMS, an Authorization System for
Virtual Organizations. European Across Grids Conference, Lecture Notes in Computer
Science, Vol. 2970, pp. 33-40
Springer, 2003
Laura Pearlman, Von Welch, Ian T. Foster, Carl Kesselman, Steven Tuecke. A community
authorization service for group collaboration. Proceedings of the 3rd IEEE International
Workshop on Policies, 2002
Laura Pearlman, Von Welch, Ian Foster, Carl Kesselman, Steven Tuecke. The community
authorization service: Status and future. Proceedings of Computing in High Energy
Physics, 2003
Reference (cont.)
Justin Binns, Jonathan DiCarlo, Joseph Insley, Ti Leggett, Cory Lueninghoener, John-Paul
Navarro, Michael Papka. Enabling community access to TeraGrid visualization resources.
Concurrency and Computation: Practice and Experience, 19(6), pp. 783-794, 2007
Jim Basney, Marty Humphrey, Von Welch. The MyProxy online credential repository.
Software: Practice and Experience, 2005
Jason Novotny, Steven Tuecke, Von Welch. An online credential repository for the grid:
MyProxy. High Performance Distributed Computing, 2001. Proceedings. 10th IEEE
International Symposium
Andreas Pashalidis, Chris Mitchell. A Taxonomy of Single Sign-On Systems. Information
Security and Privacy: Australasian Conference, 2003
Thomas Groß. Security Analysis of the SAML Single Sign-on Browser/Artifact Profile.
Annual Computer Security Applications Conference, pp. 298-307, IEEE Computer Society,
2003
Minor (Artificial Intelligence) Related
Patrick Kelley, Paul Drielsma, Norman Sadeh, Lorrie Faith Cranor. User-controllable
learning of security and privacy policies. Proceedings of the 1st ACM workshop on
Workshop on AISec, pp. 11-18, ACM, 2008
Guang Xiang, Ge Yu, Xiangli Qu, Xiaomei Dong, Lina Wang. A Hybrid Machine
Learning/Statistical Model of Grid Security. Grid and Cooperative Computing, Lecture
Notes in Computer Science, Vol. 3251, pp. 348-355, Springer, 2004
Reference (cont.)
Specifications
Shibboleth Architecture - Protocols and Profiles
Web Services Security: SOAP Message Security 1.1 (WS-Security 2004)
Security Assertion Markup Language(SAML) V2.0 Technical Overview
Security and Privacy Considerations for the OASIS Security Assertion Markup
Language(SAML) V2.0
XML Encryption Syntax and Processing
An Internet Attribute Certificate Profile for Authorization (RFC 3281)
Technical Comparison: OpenID and SAML - Draft 06
OpenID (http://openid.net/developers/specs/)
OAuth 1.0(http://oauth.net/core/1.0/)
Central Authentication Service (http://www.jasig.org/cas/protocol)
Questions?
© Copyright 2024