Since its birth in 1990, the Web has evolved from a simple, stateless delivery mechanism for static hypertext documents to a fully-edged run-time environment for distributed, multi-party applications. Security becomes increasingly important in this context, but is typically only an afterthought in this process. The next wave, the Future Internet, will continue to rely on the same web application technology, while adopting more p2p and mashup-style approaches. Today's server-centric solutions will give way to a rich and stateful client-centric paradigm with even less manageable security and even more severe threats to the web-based economy of the Future Internet. Data and services from multiple heterogeneous domains, aggregated both on the server-side and on an end-user's client, demand for a novel, comprehensive security solution that increases the user's trust into the technological infrastructure.
WebSand tackles this demand by departing from the observation that security should be server-driven. Even though security preferences from end-users at the client-side have to be taken into account, only the service developers at the server-side have the necessary expertise and context information to define the policies to be enforced. Moreover, server-driven security can be deployed relatively easily, since much can be achieved without updating the client-side platform.
In the course of WebSand, a framework is developed that consists of four major building blocks:
Our chair
SAP AG
Katholieke Universiteit Leuven
Chalmers Tekniska Högskola
Siemens AG.
