# On the Need for a General REST-Security Framework
## 9 Conclusions and Outlook  
REST is an established approach for designing distributed applications and service systems that scale at large. This is especially true for the web while other domains are following likewise. At the same time, the areas of adoption increase in criticality, making the need for appropriate security measures a necessity. The application of transport-oriented security is by far not sufficient and needs to be supplemented by adjacent message-oriented security mechanisms. In the latter respect, REST behaves very specific in comparison to existing approaches such as SOAP in the Web Services domain. This renders a straightforward adoption of available schemes and technologies from this domain infeasible. This is due to REST being an abstract architectural style on the one hand, that can be applied to many distinct technologies and environments. On the other hand, the particularities of REST demand for tailored approaches and schemes in order to not contradict with the REST constraints. The introduced methodology marks an important step towards a structured and controlled procedure for developing appropriate security means for REST-based service systems and applications. \begin{table}
\begin{tabular}{l c c c c c c c c} \hline \hline  & \multicolumn{8}{c}{**REHMA**[28]} \\ \cline{2-10}
**Message Elements to Be Signed** & \multicolumn{3}{c}{**Request**} & \multicolumn{3}{c}{**Response**} \\ \cline{2-10}  & **C** & **R** & **U** & **D** & **C** & **R** & **U** & **D** \\ \hline URI & & & & & & & & & \\ Version number & & & & & & & & & \\ Method & & & & & & & & & \\ Status code & - & - & - & - & - & \(\bullet\) & \(\bullet\) & \(\bullet\) & \(\bullet\) \\ Connection & & & & & & & & & \\ Cache-control & & & & & & & & & \\ Location & - & - & - & - & - & - & - & - \\ Accept & - & - & - & - & - & - & \(\bullet\) & - & - \\ Content-type & & & & & & & & & & \\ Content-length & & & & & & & & & \\ Transfer-encoding & & & & & & & & & \\ Host & & & & & & & & & \\ Hash of body & & & & & & & & & \\ Time variant parameter & & & & & & & & & & \\ \hline \hline \end{tabular}
\begin{tabular}{l c c c c c c c} \hline \hline  & \multicolumn{8}{c}{RECMA [31]} \\ \cline{2-7}
**Message Elements to Be Signed** & \multicolumn{3}{c}{**Request**} & \multicolumn{3}{c}{**Response**} \\ \cline{2-7}  & **C** & **R** & **U** & **D** & **C** & **R** & **U** & **D** \\ \hline Version number & & & & & & & & & \\ Type & & & & & & & & & \\ Token length & & & & & & & & & \\ Code (method code, response code) & & & & & & & & \\ Message ID & & & & & & & & \\ Token & & & & & & & & \\ Uri-host, Uri-port, Uri-path & & & & & & & & & \\ Max-age & & & & & & & & & \\ Location-path, location-query & - & - & - & - & - & - & - & - \\ Accept & & & & & & & & & \\ Content-format & & & & & & & & & \\ Body length (payload-length) & & & & & & & & & \\ Hash of body & & & & & & & & & \\ Time variant parameter & & & & & & & & & \\ \hline \hline \end{tabular} Legend: \(\bullet\) mandatory signed, \(\bigcirc\) not signed, \(\bigcirc\) optionally signed, \(\bigcirc\) not specified, - not required.  
\end{table} 
Table 4: To be signed message elements by REST-ful HTTP message authentication (REHMA) and REST-ful CoAP message authentication (RECMA). The practical applicability of the introduced methodology has been proven by an adoption of it to authentication. The introduced generic REST message authentication scheme has then been instantiated to the REST-ful protocols HTTP and CoAP. A comparison with the current state of the art revealed that the available technologies are inhomogeneous and contain many vulnerabilities or do not comply with the REST constraints. This further emphasizes the need for a general and methodical approach towards REST-security as has been proposed by this paper. Finally, an initial attempt towards REST message confidentiality is introduced discussing requirements and specifics to be considered while developing the complete picture of a general REST message security framework.