Privacy Protection for Role-based Access Control in Service Oriented Architecture

Service Oriented Architecture (SOA) changes the way of conducting business by opening their services to the larger business world over the networks. However, the “open” and “interoperable” properties of SOA make privacy a sensitive security issue. In SOA, service providers (SPs) limit permission of access to specific authorized Access Requestors (ARs). SPs need to verify ARs’ identity information, but ARs may not willing to disclose their privacy to unknown SPs in an open system. To solve this conflict in SOA environment, we propose privacy preserving protocols for role-based access control (RBAC) in the SOA environment. The security analysis demonstrates that our protocols are privacy protected. Moreover, the implementation of the proposed protocols are compatible with current SOA standards and technologies such as XACML and SOAP.