Security Engineering For Service-Oriented Architectures

Noisy data appear very naturally in applications where the authentication is based on physical identifiers. This book provides a self-contained overview of the techniques and applications of security based on noisy data. It provides a comprehensive overview of the theory of extracting cryptographic keys from noisy data, and describes applications in the field of biometrics, secure key storage, and anti-counterfeiting. The growing popularity of Service Oriented Architectures is mainly due to business and technology trendsthat have crystallized over thepast decade. On the business side, companies struggle to survive in a competitive - vironment that pushes them towards a tighter integration into an industry's value chain, to outsource non core business operations or to constantly- engineer business processes. These challenges boosted the demand for sc- able IT-solutions, with e?orts ultimately resulting in a ?exible architectural paradigm - Service Oriented Architectures. On the technical side, middleware standards, technologies and archit- turesbasedonXMLand Webservicesaswellastheirsecurityextensionshave matured to a sound technology base that guarantees interoperability across enterprise and application boundaries - a prerequisite to inter-organizational applications and work?ows. While the principles and concepts of Service Oriented Architectures may lookevidentandcogentfromaconceptualperspective, therealizationofint- organizational work?ows and applications based on the paradigm "Service Oriented Architecture" remains a complex task, and, all the more when it comes to security, the implementation is still bound to low-level technical knowledgeandhence error-prone. The number of books and publications o?ering implementation-level c- erageofthetechnologies, standardsandspeci?cationsasrequiredbytechnical developers lookingfor guidance on how to"add"security to service oriented solutions based on Web services and XML technology is already considerable and ever growing. The present book sets a di?erent focus. Based on the p- adigmof Model Driven Security, it shows how to systematically designand realize security-critical applications for Service Oriented Architectures. While their basic principles and ideas are well understood and cogent from a conceptual perspective, the realization of interorganizational workflows and applications based on service-oriented architectures (SOAs) remains a complex task, and, especially when it comes to security, the implementation is still bound to low-level technical knowledge and hence inherently error-prone. Hafner and Breu set a different focus. Based on the paradigm of model-driven security, they show how to systematically design and realize security-critical applications for SOAs. In their presentation, they first detail how systems and security engineering go hand in hand and are integrated from the very start in the requirements elicitation and the design phase. In a second step, they apply the principles of model-driven security to SOAs. Model-driven security is an engineering paradigm that aims at the automatic generation of security-critical executable software for target architectures. Based on the general principles of model-driven software development, the automation of security engineering through proven and reliable mechanisms guarantees correctness and facilitates an agile and flexible approach to the implementation and high-level management of security-critical systems. Their book addresses IT professionals interested in the design and realization of modern security-critical applications. It presents a synthesis of various best practices, standards and technologies from model-driven software development, security engineering, and SOAs. As a reader, you will learn how to design and realize SOA security using the framework of an extensible domain architecture for model-driven security. Noisy data appear very naturally in applications where the authentication is based on physical identifiers. This book provides a self-contained overview of the techniques and applications of security based on noisy data. It covers both the theory of authentication based on noisy data and shows it in practice as a key tool for prevention of counterfeiting. Biometrics and physical unclonable functions are discussed extensively. Key new technologies discussed include: -Algorithms to derive secure keys form noisy data in particular from Physical Unclonable Functions and Biometrics, - also the theory which proves that those algorithms are secure is made accessible; Practical Implementations of the above mentioned algorithms; - Techniques that give insight in the security of those systems in practice; An overview and detailed description of new applications that become possible by using these new algorithms. This book can serve as a starting point for PhD students entering the field and will also benefit professionals. "Noisy data appears very naturally in applications where authentication is based on physical structures (e.g. physical unclonable functions) or physiological properties (e.g. biometrics). This book examines how the presence of noise has an impact on information security, and describes how it can be dealt with and even used to generate an advantage over traditional approaches. In addition, it provides a self-contained overview of the techniques and applications of security based on noisy data."--Résumé de l'éditeur "Noisy data appears very naturally in applications where authentication is based on physical structures (e.g. physical unclonable functions) or physiological properties (e.g. biometrics). This book examines how the presence of noise has an impact on information security, and describes how it can be dealt with and even used to generate an advantage over traditional approaches. In addition, it provides a self-contained overview of the techniques and applications of security based on noisy data."--Jacket