The architectural style named Representational State Transfer (REST) is nowadays widely established and still enjoys a growing popularity.One of the core principles of REST is referred as "Hypermedia as the Engine of Application State" (HATEOAS).HATEOAS is one of the foundations of the scalability that RESTful systems provide and enables the decoupling of client and server.But the realization of HATEOAS is challenging, because there is no systematic approach how to enforce the constraint.Therefore, the implementation is mostly up to the developer of a RESTful service.This work describes a new method of how to apply the HATEOAS constraint.We describe a method that systematically enables HATEOAS based on REST API models and the integration of access control mechanisms.In order to avoid unauthorized access attempts and unnecessary network traffic, the resource representations are customized to the requesting subject.References that lead to not accessible resources, are not included in the customized resource representations.Therefore, an attribute based access control mechanism is extended to distinguish between static and dynamic attributes.A 2-phase authorization procedure is introduced that relies on this discrimination and determines the references which must be included in the resource representation.The result is a flexible realization of HATEOAS based on formal models.

This work introduces RestACL - an access control language for RESTful Services - and compares it with XACML using formal methods. XACML is a generic approach that targets Attribute Based Access Control (ABAC) in general. RestACL is founded on the ideas of the ABAC model, too, but utilizes the concepts of REST enabling a quicker evaluation of access requests. This work gives a brief introduction over the main ideas of RestACL and proves its evidence by giving transformation rules to translate security policies from RestACL to XACML and vice versa. The formalized transformation descriptions show the expressive strength of RestACL, because they demonstrate that any generic ABAC policy written in XACML can be expressed with RestACL, too. The correctness and completeness of RestACL can be proved with the transformation rules, too.

Quality assurance and improvement of educational services are essential tasks for universities and other higher education institutions. This requires a well-defined quality management system (QMS) as well as an excellent and seamless information system support. Since editing service and review documents with office tools is not enough, a consistent and coherent management of all data is needed in an environment for authors. Data analysis, especially target-performance comparisons, and flexible generation of a variety of web and PDF documents are required tasks. This paper investigates the problems of simple file solutions in more detail and derives general requirements for better software support. Based on the requirements we propose an object-oriented framework that is able to handle structured documents associated with organizational networks.