XML Security — A Comparative Literature Review <s> Source <s> In the area of e-commerce of multimedia content, protection and management of Intellectual Property Rights (IPR) is a key issue. Using a broker as intermediary between copyrighted material purchasers and content providers helps, apart from increasing the market perspectives, to improve the way of handling the IPR aspects. The conditions in which multimedia content is sold may vary from one case to another, especially in a B2B environment. For this reason, negotiation of copyright conditions at the purchase moment is to become more and more important.We are developing an application that represents IPR information using metadata and uses a specific protocol for negotiation purposes. All of this in a broker-based multimedia content e-commerce system. We are also experimenting with the use of agent technology to implement the negotiation protocol. The result of the negotiation is an electronic contract, that should be signed by the interested parties. Apart form specifying this data structure, we are working in the integration of an electronic signature mechanism using the XML Signature specification. <s> BIB001 </s> XML Security — A Comparative Literature Review <s> Source <s> In this article we evaluate different certificate validation mechanisms to be possibly used within the Wireless Public Key Infrastructure (W-PKI). An implementation of a standard compliant signed content application offering full PKI functionality served as means for evaluating different mechanisms. We compared short-lived certificates, Certificate Revocation Lists (CRLs), the Online Certificate Status Protocol (OCSP) and the XML Key Management Specification (XKMS) with regard to security, interoperability, complexity and performance in terms of size and scalability. The evaluation has lead to propose OCSP for delegated certificate validation. It has to be pointed out though, that OCSP should be enhanced with full delegation capabilities, such as the ones offered by XKMS. <s> BIB002
Sum 2002 2003 2004 2005 2006  ACM  09  3  3  0  2  1  IEEE  14  2  0  4  7  1  ScienceDirect 06  0  1  2  1  1  Springer  21  0  2  7  7  5  Sum  50  5  6  13  17  9   Table 1 : Classification according to source and publication year After the selection process we formulated a priori hypotheses whose veriand/or falsification is the dedicated goal of this work. An objective consideration, regarding the hypotheses, is guaranteed during the review process, due to the predefined focuses. Besides the analysis of our a priori hypotheses, we furthermore describe several observations which were made during the literature review. Table 2 in the Appendix of this work provides the basis for the following hypotheses and observations. In order to check the relationship between certain standards, we defined values for this correlation: • No relation = No. of mentions in the article < 3 • Some relation = No. of mentions > 3, but standard is not an elementary component of the article Regarding the appliance of XML Security in connection with Web Services, it turned out that 24 articles bear no, 9 some and 17 strong relation to Web Services. I.e., more than half of all works of the reviewed literature deals with the usage of XML Security in conjunction with Web Services. Considering only articles in connection with the appliance of XML Security standards, this relationship is even more obvious: 19 of 29 articles which are concerned with concrete applications deal with Web Services as well. Remarkably often Grid Systems are also mentioned in this context. As a result of the literature review, this hypothesis could be validated. Some enterprises, e.g. RSA and Forum Systems, offer XML Security support only within their Web Service Security Suites. Thus, we assume that this trend will continue since XML Security seems to merge more and more with Web Service Security. 3.2 H2: W3C XML Security standards are accepted and their quality is not put into question It proved true that the Scientific Community plays an important role in the evolution of such technologies. Without any doubt you can gain valuable insight into the (dis)advantages of XML Security by reading scientific literature about this topic. As a result, some publications included criticism, but some also mentioned potential for improvement and modifications for adapting the standards to special areas. Criticism focused mainly on bad performance and security problems, i.e. the presentation problem. Both issues are discussed in detail in sections 4.1 and 4.2. In fact, only two articles questioned one or several standards: BIB002 compares certificate validation mechanisms and states that XKMS is similar to the Online Certificate Status Protocol (OCSP) concerning security, complexity and interoperability, but that it is clearly worse regarding performance and scalability, concluding that OCSP has to be preferred to XKMS. ) criticizes a part of the XML Signature standard, which states that first references and afterwards the signature is validated. By using custom transforms which are referencing malicious code, this can lead to a security vulnerability. Section 4.2 provides further details about this issue. Although both articles address serious problems, these will not form an insurmountable obstacle in the evolution of XML Security. Nevertheless the criticism reveals that at some point of this technology further research and development is necessary. 3.3 H3: The XML-based Security Standards (XML Signature, XML Encryption, XKMS, SAML, XACML, XrML) are overlapping This hypothesis did not validate as clearly as expected, because only a little more than half (26) of the articles discussed two or more standards whereas the number of works with three or more standards is relatively high (18). This can be traced back to the fact that none of the standards was mature at the time of publication. In this respect, scientists preferred to tackle only an aspect of XML Security instead of the integration of several premature standards. This presumption could be verified because more articles, published in the last two years, work on two standards at least. Regarding XML-based standards which are not assigned to XML Security, some interesting observations could be made: XrML emerges only one time in BIB001 . Due to their similarity XACML and SAML often occur together, particularly in connection with Web Services. Based on XML Security, a lot of these articles focus on establishing an integrated security system for Web Services, with SAML for Single Sign-On and 3.4 H4: Many articles are published by enterprises and/or are published in connection with enterprises, i.e. the IT industry accelerates further evolution The analysis shows that the Scientific Community is unambigiously in the hands of the universities. Only 8 articles were published by enterprises -4 by universities in conjunction with enterprises. Mainly companies from North America and Europe published those articles whereas IBM (5 articles) claimed the majority. It seems as if the basic framework and the design goals would have been specified by the industry, while now the universities have to keep on "supervising" this technology up to market maturity. This impression deceives since the enterprises participate in the development but do not publish all of their scientific work in digital libraries. You only have to take a look at the websites of Verisign, Entrust or IBM to be able to ascertain this. The articles of the enterprises tend to deal on the more practical tier as opposed to the other reviewed publications. Nonetheless this hypothesis cannot be validated. Rather, the universities do a good and valuable job in this respect.