Providing privacy for Web services by anonymous group identification

In this paper we present a SOAP extension for protecting the privacy of users of a Web service. This extension allows a user to prove to a remote SOAP server to be member of a trusted group without revealing his/her identity. Our extension has been designed as to ensure interoperability among SOAP applications written in different programming languages. We developed also some implementations of our extension using different programming languages. Moreover, we conducted an extensive experimentation of our implementation to prove its feasibility in a real-world context. In sums, our work suggests that privacy can be added to Web services with very little impact on the application developer and without compromising the performance of Web services.

1. Introduction

The recent technological trends are pushing toward a thorough adoption of Application Service Provider (ASP) oriented architectures in building complex distributed software systems. The goal of this approach is to let a software system delegate the fulfillment of special purpose tasks to external specialized software agents rather than implementing them by itself. This has both the effects of reducing the costs and improving the quality of the overall system. Web Services are nowadays referred to as the de facto standard enabling technology for the implementation of the ASP model. They offer a simple solution for the integration of heterogeneous systems while proposing a loosely coupled approach to service providing.