SECURING DISTRIBUTED.NET APPLICATIONS USING ADVANCED RUNTIME ACCESS CONTROL

Abstract. The architecture and integration of distributed applications increased in complexity over the last decades. It was Service Oriented Ar-chitecture (SOA) that answered most of the emerging questions by its ex-plicit and contract-based interface definitions for services and autonomous components. The exposed functionality can be used by anyone who has access to the public interface of SOA applications. Due to loose secu-rity handling, risks often emerge in SOA applications. Interfaces are usu-ally published to an unnecessarily wide set of clients. Although there are attempts to implement fine-grained access control mechanisms in object-oriented programming languages like Eiffel, C # and Java, these solutions are in-process that means that they cannot cross service contract bound-aries in distributed applications. For these, it is of utmost importance to validate the type and the identity of the caller, track the state of the business process and even validate the client itself using simple, declara-tive syntax. In this paper we present a framework that aims to introduce fine-grained access control mechanisms in the context of distributed.NET applications. We present a semi-formalized description of the framework and also a pilot implementation. 1