Authentication Scheme for REST

Abstract

REST has been established as an architectural style for designing distributed hypermedia systems. With an increased adoption in Cloud and Service-oriented Computing, REST is confronted with requirements not having been central to it so far. Most often the protection of REST-based service systems is, e.g., solely ensured by transport-oriented security. For mission-critical enterprise applications securing data in transit only, is, however, not a sufficient safeguard. This introduces a vital demand for REST Security, which is currently an active research and development topic, focusing on one specific instantiation of REST merely, though, namely on HTTP.

This paper augments REST by an authentication scheme, while remaining on the same level of abstraction as the architectural style itself. The introduced authentication scheme for REST is then mapped to HTTP. Based on this concrete instantiation, an empirical study is conducted in order to analyse the current state of the art in authentication techniques for REST-ful HTTP. The developed scheme and its HTTP instantiation in particular offer a methodical framework for assessing and comparing the available work, which shows to be incompatible and incomplete in terms of the provided protection. Moreover, this generic authentication scheme can be used to deduce other concrete means related to existing and upcoming technologies for implementing REST-based systems.