Int. J. Web and Grid Services, Vol. 6, No. 1, 2010
User profile management: reference model and web services implementation Zhongxu Ma, Daniel L. Silver and Elhadi M. Shakshuki* Jodrey School of Computer Science, Acadia University, Wolfville, NS, Canada E-mail:
[email protected] E-mail:
[email protected] E-mail:
[email protected] *Corresponding author Abstract: A user profile is a structured representation of an individual user’s characteristics and personal preferences with respect to a software application or computing device. As the variety and complexity of applications and mobile devices increase, there is a growing need and interest in personalisation. This necessitates methods of managing user profile content such that it can be accessed, updated and potentially shared over communication networks. This research investigates User Profile Management (UPM) as a network-based service for managing user profile content. The major requirements for a good UPM service are defined. A reference model is proposed that includes an architecture, profile data schema, a protocol, basic command functions and security mechanisms. A prototype UPM service and four client applications based on the reference model are developed using Java and web services technologies. Scenarios are constructed to demonstrate the value of the UPM reference model and the web services implementation. We conclude that the proposed reference model provides a solid foundation for developing UPM services and that web services technologies are suitable for implementing the reference model in a distributed network environment. Keywords: user profiling; web services; reference model; user profile management. Reference to this paper should be made as follows: Ma, Z., Silver, D.L. and Shakshuki, E.M. (2010) ‘User profile management: reference model and web services implementation’, Int. J. Web and Grid Services, Vol. 6, No. 1, pp.1–34. Biographical notes: Zhongxu Ma is a recent graduate (MSc in Computer Science) from the Jodrey School of Computer Science, Acadia University, Canada. His main research interests focus on network services and web software programming. Dr. Daniel L. Silver is an Associate Professor and Director of the Jodrey School of Computer Science, Acadia University, Canada (MSc, PhD in Computer Science, University of Western Ontario). His enjoys teaching courses in AI, e-commerce and software engineering. His research focuses on advanced methods of machine learning and their application in data mining, user modelling and intelligent agents. He has published widely in related conferences and journals and is regularly called upon to review articles and research applications. He has been a National Science and Engineering Council Copyright © 2010 Inderscience Enterprises Ltd.
1
2
Z. Ma et al. research grant recipient for the last nine years and was a member of an interdisciplinary team that received a Canadian Foundation for Innovation award for the development of the Acadia Digital Culture Observatory. From 2007 to 2009, he was the President of the Canadian AI Association (CAIAC). For the last 16 years he has operated a consulting business (CogNova Technologies) that offers services in the areas of machine learning and data mining. Dr. Elhadi M. Shakshuki is an Associate Professor at the Jodrey School of Computer Science at Acadia University, Canada. He received his MASc and PhD degrees in Systems Design Engineering from the University of Waterloo, Canada. He is an Adjunct Professor at Dalhousie University, Canada. He is on the editorial board of the Journal of Ubiquitous Computing & Intelligence and the Journal of Internet Technology and Secured Transactions. He is on the editorial reviewer board of the Journal of Computational Intelligence Research and Journal of Information Technology and Web Engineering. He has authored and co-authored more than 110 research papers in journals, conferences and workshops. He is the founder of the International Conference on Ambient Systems, Networks and Technologies. He is the co-founder of the IEEE Symposium on Web and Mobile Information Systems, the ACM Symposium on Intelligent Systems Techniques for Ad hoc and Wireless Sensor Networks and the IEEE Workshop on Cooperative Distributed Systems.
1
Introduction
The number of people using Information and Communication Technology (ICT) in their daily business activities continues to grow as new voice and data applications become available on internet connected desktop and mobile platforms. The variety of application parameters and presentation choices has necessitated the use of user profiles as a method of personalising the interface and functionalities of many software applications (e.g., web browsers, e-mail clients, and word processors) and mobile devices (PDAs and cellular phones). Many people find they have to tediously enter similar profile data into two or more devices, repeating the exercise each time they must replace one of the devices or software packages. Ideally, user profile information should be accessible from any application, on any device, at any time over the web provided the user can be authenticated. User Profile Management (UPM) is becoming an increasingly important area of research. This is because of the demand for personalised software applications and portable computing and communication devices. Most recently, adaptive user interface technology makes it possible to automatically model user preferences that may change over time. These services should be network based and offer easy-to-use but secure storage and transport of reusable user profile information. A common and extensible profile schema could be of benefit to users, software developers and potentional UPM service providers. Also, a UPM service can help users recover their laptop computer after problems, such as hard drive crash, or after a cell phone is lost or stolen.
User profile management: reference model and web services implementation
3
This research introduces a reference model for UPM that defines an architecture, profile data schema, communication protocol, command functions and security items for managing user profile information over a public network. In addition, it demonstrates a prototype UPM service and four client applications based on the reference model and developed using Java and web services technologies. Currently, there is no open reference model for UPM. Our main research objectives are: •
To define the fundamental requirements for the UPM service over a network.
•
To develop a reference model based on the UPM service requirements.
•
To implement a prototype UPM service and prototype applications using distributed computing technology.
•
To demonstrate the benefits and limitations of the implementation and the reference model.
The rest of this paper is organised as follows. Section 2 provides an overview of the relevant background. Section 3 defines the major requirements for user profile management and then proposes a reference model that provides the necessary architecture, schema, protocol, functions, security mechanisms, and example scenarios. Section 4 presents a web-services-based implementation of the reference model. Section 5 uses two scenarios to illustrate and discuss the implementation which is based on the reference model, and provides a discussion on the reference model. Section 6 discusses the related work in the light of the proposed reference model and implementations. Finally, Section 7 summarises and discusses future work.
2
Background
2.1 Definitions A user profile is a structured representation of the characteristics and preferences of an individual user associated with a specific context (Aleksy et al., 2008; Amato and Straccia, 1999; Liu et al., 2008). A user profile usually contains a set of information, preferences, rules and settings that are customised by a user to configure a device or service in a personalised way (ETSI, 2005; Petersen et al., 2008). A user profile can be associated with a single service or device; or multiple services or devices. In addition, a user may have one and/or more profiles for various environments. UPM consists of the acts, operations, or functionalities for handling and controlling the user profile information. UPM operations include creation, deletion, activation, deactivation, and update of a user profile. UPM can be provided by an organisation such as an application software company or Internet Service Provider (ISP) for saving, updating, and restoring of profile information.
2.2 Benefits We have identified four major benefits of having user profiles and UPM. They are described as follows:
4
Z. Ma et al.
1
Customisation and personalisation: Profiles make it possible for users to customise their software applications and hardware devices.
2
Restoration: If the application or device is replaced, the profiles restore the users’ preferences easily without them having to manually enter the information.
3
Reuse: After a user profile is created, it can be reused for applications or devices that have the same or similar configuration so that users need not configure their preferences or input their information repeatedly.
4
Sharing: There is potential value to users and organisations sharing portion of user profiles. For example, employees of a company could have a common look and feel to their software applications through shared user profile information.
2.3 UPM reference model A UPM reference model provides a guide by which ICT stakeholders can cooperate to develop and use a UPM service over the distributed networks. A reference model of this type must provide the following fundamental components: •
Architecture: A UPM service must provide a way for exchanging information among client applications and one or more UPM servers over the network. To communicate between two computing devices, an architecture is needed which includes a structured set of modules for implementing the communication function (Stallings, 2007).
•
Protocol: A standard communication protocol is required for network-based UPM. A communication protocol consists of rules that represent an agreement for controlling data communication between the communicating devices (Forouzan, 2007). Without a protocol, the application/device profile provider and UPM service provider would not know how to communicate with each other over a network.
•
Functions: A reference model must define the fundamental command functions for a network service, such as ‘create a user profile’ and ‘put information in the profile’ in a UPM service. These functions are carried out using the communication protocol.
•
Data schema: A UPM reference model defines the exchange of user profile information between a user application/device and a UPM service provider. This must include a standard schema that describes the format of profile information for the various stakeholders.
•
Security methods: Because the reference model will be implemented over public networks, security is an important criterion. The access and the integrity of data during storage and transmission must be considered (Forouzan, 2007).
2.4 Web services Over the last few years, web services have been used more frequently for network centric solutions as the scope and functionalities of the services have matured. The primary goal of web services is to achieve interoperability among various applications over the network regardless of the programming language in which the applications are
User profile management: reference model and web services implementation
5
written and the operating environment in which the applications are hosted. Web services achieve this goal by adopting open standards and protocols such as XML, SOAP, WSDL, and UDDI.
3
UPM reference model
This section provides the core contributions of this paper. The first subsection specifies the fundamental requirements for a reference model for UPM. The second and third subsections present the proposed architecture and user profile schema. The fourth subsection discusses the protocol, functions and the final subsection talks about important security issues.
3.1 Requirements The purpose of a reference model for user profile management is to provide a general guideline for developers of software systems in a distributed network environment. This should begin with the specification of the requirements of such a reference model. This section identifies the major requirements: an architecture, a standard communication protocol and an associated set of functions, and a set of recommended security mechanisms.
3.1.1 Architecture One of the key requirements of the UPM service is the architecture which is a conceptual framework that identifies the components of the UPM service. Also, the architecture can illustrate the connectivity and relationship among the UPM components and their associated functionalities. Because the UPM components are located in a distributed environment and each component is developed and maintained independently on separate platforms, a multi-tier architecture (also called n-tier architecture) is required to provide flexible interaction among the UPM components.
3.1.2 Standard profile data schema A user profile usually contains a set of information, preferences, rules and settings that are customised by a user to consume a device or service in a personalised way. A user profile can include the specific features of services and devices, explicit user personal information and preferences, and implicit user models. Therefore, the profile data schema must: •
support a variety of data types including text, image, audio, and video
•
be extensible and eligible for validation
•
facilitate access, update and exchange of profile data by various machines, software applications, and humans.
6
Z. Ma et al.
3.1.3 Standard protocols and functions A protocol and command functions are needed for the communications between applications and the UPM service in a distributed network environment. A connectionless protocol is sufficient for the UPM service because communication between the service and an application will normally not require multiple interactions. Therefore, it is not necessary to maintain a connection between the application and the service. As is the case with a web server, the UPM service may receive a large number of concurrent requests from different applications. A connectionless protocol will provide a performance advantage by not requiring the service to maintain the state of a connection for an indefinite period of time. We have identified nine fundamental functions of a UPM service that can be issued by a user or a profile administrator. The profile administrator can check the profile and profile service status, and create or delete a user profile or a user profile group. Both the profile administrator and the user can read, write, execute or remove profile data. Each of these functions requires an associated protocol element defined within the UPM reference model.
3.1.4 Security Security is an important aspect of most reference models. We have identified the following security requirements for the UPM service: •
Authentication and authorisation: Methods are needed to ensure that the stored profile data on the server is accessed by only authorised users. It may be necessary to define different access rights for different portions of the profile. For example, a user may be part of a project group in which certain user profile data is shared for the purposes of efficiency and effectiveness. This may require setting up a user profile group and identifying individuals as being part of the group.
•
Privacy: During transmission over the network, methods are needed for protecting the profile data from malicious access.
•
Integrity: Profile data integrity is needed to ensure that the data has not been modified accidentally or deliberately during transmission. Also, it is required to maintain the data integrity during the data manipulation process on the server, such as database operations.
3.2 UPM architecture Based on a service-oriented architecture, the proposed UPM architecture is composed of three fundamental components: the UPM requestor, the UPM provider and the UPM publishing service, as shown in Figure 1. From a client/server architectural perspective, the UPM provider acts as the server part that consists of two main entities: the UPM service that manages operations to the user profile content and a DBMS that stores the profile data in a standard format using an exchange language such as XML. Acting as the role of the client, the UPM requestor consists of three entities: the application, the interface module, and the service finder module. The UPM publishing service is responsible for publishing the UPM service and
User profile management: reference model and web services implementation
7
helping the service requestor to find and bind with the service provider. All three architecture components: UPM requestor, UPM provider and UPM publishing service are language-independent and platform-independent: 1
UPM provider component. The key component of the UPM provider is the UPM service. It is responsible for performing all UPM functions. The right-hand side of Figure 1 shows the internal architecture of the UPM service. The UPM service includes a publish module, a communication module, a security module and an action module. The publish module is responsible for publishing the service. The communication module’s main task is to handling the message to and from the service requestor, passing the request to the security module and receiving the response from the action module. The security module’s main function is to authenticating and authorising the user’s request according to his/her access rights. The module also ensures that only those client applications that have the right to read, write or execute a user profile attribute or method can do so. The action module is responsible for performing the profile management functions authorised by the security module.
2
UPM publishing service component. After the UPM functions are created and placed on a network server, the UPM provider needs to publish them for internet service discovery. The UPM service description can be published to multiple registries using different mechanisms, for example, through simple direct publication, or through more complicated means such as various types of UDDI registries. A UDDI registry is better for satisfying the requirements of a commercial UPM service.
3
UPM requestor component. The UPM requestor requests actions of the UPM service on behalf of an application residing on an internet connected computing device (e.g., PDA, desktop, laptop). Both the interface module and the service finder module can be independent of or embedded in the application which sends requests to invoke the UPM service. The service finder module is used to find and retrieve the UPM service description. After retrieving the description, the application can make a request directing to UPM service provider. The interface module is responsible for handling the requests received from the application and the responses returned by the UPM service provider.
3.3 User profile schema The user profile is represented using XML. We have chosen XML because it has several advantages for representing the profile information. One of them is that data and documents represented in XML can be processed by different types of applications, which makes it more applicable to exchange and share the data or documents among the components (agents, applications and database). Figure 2 shows an example of a user profile schema written in XML. The user profile includes both general user information that is applicable over all applications and more volatile application specific information. The user profile data is validated against an XML Schema to secure the integrity of the data.
8 Figure 1
Z. Ma et al. UPM architecture UPM Provider
UPM Requestor
UPM Service
Service Finder Module
Internet
Publish Module
Communication Module Interface Module
Application
Security Module
UPM Publishing Service
Action Module
UPM service DB
Figure 2
User profile schema pid general UserID alphanum …. UserName alpha …. …....... Application1 …. …. …. …........ … …. … … .. ………
User profile management: reference model and web services implementation
9
3.4 UPM protocol and command functions The communication between the UPM service entities follows a connectionless request/response protocol. Each communication is a two-step process: a UPM service requestor initiates a connectionless request to the service provider in the form of a request packet. After receiving the request packet and servicing the request, the provider sends a response packet back to the requestor. The service requestor and the provider do not maintain the state beyond the request/response communications, which means each request/response is executed independently without knowledge of the previous. This is the same as the HTTP web page request and response sequence. The general request and response message structures are validated against the XML UPM schema to ensure that both the UPM service requestor and provider agree on the message content. Table 1 defines notations and abbreviations used to describe the UPM requests and responses. We propose that basic communications between the UPM requestor and the UPM provider consist of a minimum of nine commands. Each command requires associated functionality within the server. Table 1
UPM notations and abbreviations
Notation/Abbreviation
Description
(…)
Means all parameters are required
Means one of the parameters must be chosen
Uid
User ID
Upw
User password
Pid
Profile ID
object
Profile object
object attribute
Object attribute represents a property of a profile object
object method
Object method represents a function of a profile object
objectName
Name of an object
objectAttributeName
Name of an object attribute
objectMethodName
Name of an object method
objectAndAttributeNames
All names of the objects and attributes in a profile
nuid
New user ID specified with a create user profile command
nupw
New user password specified with a create user profile command
nurole
New user role which can be either user or administrator
listOfUid
List of user IDs
commess
Completion message, indicating the success or reason for failure
Table 2 details each of the commands and the expected responses. There are four user commands (1–4) and five administrator commands (5–9). For all commands, the UPM requestor must provide a valid user id, uid, and a user profile password, upw. These are used to verify that the requestor has authority to access, modify or delete the requested profile information.
10
Z. Ma et al.
Table 2
UPM requests and responses
UPM request (parameters)
UPM response (parameters)
1 put (uid, upw, pid, , )
put (commess)
2 get (uid, upw, pid, )
get (commess,)
3 remove (uid, upw, pid, )
remove (commess)
4 execute (uid, upw, pid, objectMethodName)
execute (commess, objectAttribute)
5 status (uid, upw, )
status (commess, objectAndAttributeNames)
6 createup (uid, upw, pid, nuid, nupw, nurole)
createup (commess)
7 createupg (uid, upw, pid, listOfUid)
createupg (commess)
8 deleteup (uid, upw, pid)
deleteup (commess)
9 deleteupg (uid, upw, pid)
deleteupg (commess)
User commands (put, get, remove, execute) are described as follows: •
The put command requests the UPM provider to write an entire object or an object attribute or object method to a specified user profile, pid, along with the object name, objectName, or attribute name, objectAttributeName, or method name, objectMethodName. The UPM provider responds with a completion message, commess.
•
The get command provides the name of object, objectName, or attribute, objectAttributeName, or method, objectMethodName, for retrieving it from the specified user profile, pid. The UPM provider responds with a completion message, commess, along with the requested entire object or attribute or method provided the request was completed successfully.
•
The remove command requests the deletion of an object, object attribute or method from a specified user profile, pid. The UPM requestor provides a specified user profile ID, pid, and the name of an object or attribute or method. The UPM provider responds with a success message or an error message.
•
The execute command requests to run an object method from a specified user profile, pid. The requestor provides objectMethodName that specifies the method location. The UPM provider executes the method and returns the results by passing back an object attribute, or responds with an error message if the execution fails.
Administrator commands (status, createup, createupg, deleteup, deleteupg) are described as follows: •
The status command requests the status of a specified user profile, pid, or the status of all the profiles, all. The UPM provider responds with a completion message, commess, along with the requested profile(s) status which includes all objects and their attribute names in the profile(s). This can be used to check whether a UPM provider is functional and the status of a profile or all profiles.
User profile management: reference model and web services implementation 11 •
The createup command requests the creation of a new profile with a specified profile ID, pid, a new user ID, nuid, and a new user password, nupw. The completion message, commess is returned.
•
The createupg command requests to create a specified group user profile, pid, and add the list of user IDs, listOfUid, to that group for sharing the specified profile. The UPM provider responds with a completion message, commess, indicating success or failure.
•
The deleteup command requests the deletion of a specified user profile, pid. The returned commess indicates the success or failure of the deletion.
•
The deleteupg command requests the deletion of a specified user profile, pid. The UPM provider responds with a completion message, commess, indicating success or showing the reason why the request cannot be executed.
3.5 UPM security A comprehensive user profile management service must provide proper security mechanisms so as to ensure the integrity, privacy and confidentiality of the profile information. Since the profile service will be provided in a diverse, distributed and public environment, the profile data may be exposed to various external threats ranging from random or simple acts to targeted and complicated acts. Different mechanisms are needed to work together to provide a multi-tiered, consistent, end-to-end security context on the internet (Hartman et al., 2003). In this research, we consider two key security aspects: access control to profile information stored on the server and the security of profile information during transmission. Profile access is controlled at two levels. At the level of an entire user profile object or at the level of an individual object attribute or object method. A profile user can issue the commands put, get, execute, and remove if a valid user ID (uid) and password (upw) combination are provided. A profile administrator has the authority to also issue the commands: status, createup, creatupg, deleteup or deleteupg. Shared profile access can be controlled by setting up a group user profile ID, pid, with a list of valid user IDs. Each user within the group has the corresponding right to get, put and execute the attributes and methods associated with that group pid. The Profile transmission security is required to protect the integrity and confidentiality of the profile data during a complete UPM request/response transaction. The internet environment includes many computing devices, proxies, gateways, and so on. Consequently, many intermediaries may be involved between the UPM requestor and UPM provider. One solution is to adopt the most recent digital signature and encryption mechanisms to sign and encrypt the request/response message that traverses between the UPM requestor and provider.
3.6 Scenarios The following two example scenarios demonstrate the protocols and functionalities of the proposed UPM reference model.
12
Z. Ma et al.
3.6.1 Scenario 1: Four UPM requests from an e-mail client In this scenario, we assume that Peter has an e-mail client application installed on his laptop computer. The e-mail client has an in-coming message filter that is created and saved by the UPM service. Therefore, the user profile of the e-mail client must include both attributes and methods, as shown in Figure 3. The attributes contain both general attributes, such as personal information (e.g., Peter’s name and e-mail address), and application specific attributes such as the representation of the e-mail filter model (e.g., an artificial neural network). In addition, the user profile contains a method, called buildEmailFilterModel, that is used to develop the e-mail filter model from a set of training data. Figure 3
Example of user profile object for an e-mail client
PeterHome EmailClient UserName text Peter Smith UserEmailAddress emailAddress
[email protected] POP3Server url mail.acadiau.ca SMTPServer url smtp.acadiau.ca BackgroundColor text blue FriendsList XMLdata Jacky
[email protected] ... …
User profile management: reference model and web services implementation 13 Figure 3
Example of user profile object for an e-mail client (continued)
buildEmailFilterModel javaClass buildEmailModel.class EmailFilterModelData EmailFilterModel … EmailFilterModelData XMLdata 0.12,0.23,-3.7 … EmailFilterModel XMLdata 0.52,0.39,0.44 … … ...
Figure 4
Writing an object attribute to a user profile
UPM client_101 request: put email client application information on UPM server UPM-22. client_101 UPM-22 put Peter p8034y PeterHome EmailClient.FriendsList [XML of EmailClient.FriendsList] UPM server UMP-22 response: put command completed. UPM-22 client_101 put success
14 Figure 5
Z. Ma et al. Getting an entire user profile object (see online version for colours)
UPM client_101 request: get whole profile for the email client application from UPM server UPM-22. client_101 UPM-22 get Peter p8034y PeterHome EmailClient UPM server UMP-22 response: get command completed with whole profile. UPM-22 client_101 get success [XML of entire EmailClient object]
Figure 6
Removing a portion of a user profile object (see online version for colours)
UPM client_101 request: remove the BackgroundColor attribute from email client profile on UPM server UPM-22. client_101 UPM-22 remove Peter p8035y PeterHome EmailClient.BackgroundColor UPM server UMP-22 response: remove command failed because of authentication error. UPM-22 client_101 remove Failure.AuthenticationFailure
User profile management: reference model and web services implementation 15 Figure 7
Executing an object method of a user profile (see online version for colours)
UPM client_101 request: execute the buildEmailModel method of the email client application object. client_101 UPM-22 put Peter p8034y PeterHome EmailFilterModelData [XML of EmailClient.EmailFilterModelData] execute Peter p8034y PeterHome buildEmailModel UPM server UMP-22 response: execute command completed successfully and the EmailClient object attribute, FilterModel, is returned. UPM-22 client_101 put success execute success [XML of new EmailClient.EmailFilterModel]
The four figures (Figures 4 through Figure 7) illustrate the UPM functions that Peter can request. Figure 4 shows how Peter’s e-mail client can update his user profile at the UPM provider after he revises his friends list. Figure 5 shows how the e-mail client can request to load Peter’s entire e-mail profile. Figure 8 shows Peter’s e-mail client request to remove the attribute, BackgroundColor, from his e-mail client profile. The request fails because the password to access the user profile is incorrect. Figure 6 shows how the e-mail client can request the UPM to remove part of Peter’s profile object. Figure 7 shows how the e-mail client can request the UPM to develop a new filter model and return the new model to the e-mail client.
16
Z. Ma et al.
3.6.2 Scenario 2: Five UPM requests from an administration tool In this scenario, we assume that Tina is an administrator with a user ID, admin5. She makes five requests using the UPM administration tool to: 1
check a user profile status (Figure 8)
2
create a new user profile for Mike Fang (Figure 9)
3
delete the user profile for Tim Home (Figure 10)
4
create a new user profile for a group called ‘project10’ (Figure 11)
5
to delete a user profile group for the project5 team (Figure 12).
Figure 8
Checking the status of a user profile
UPM client_101 request: check status of a user profile on UPM server UPM-22. client_123 UPM-22 status admin5 Tina3245P PeterHome UPM server UMP-22 response: status command completed successfully with the profile that contains all its object and attribute names. UPM-22 client_123 status success [XML of the profile containing all its objects and attributes names]
Figure 9
Creating a new user profile
UPM client_123 request: create a new user profile on UPM server UPM-22. client_123 UPM-22 createup admin5 Tina3245P MikeZHome Mike Fang fang3m8
User profile management: reference model and web services implementation 17 Figure 9
Creating a new user profile (continued)
normal UPM server UMP-22 response: createup command completed successfully. UPM-22 client_123 createup success
Figure 10 Deleting a user profile UPM client_123 request: delete the user profile for Tim on UPM server UPM-22. client_123 UPM-22 deleteup admin5 Tina3245P TimCHome UPM server UMP-22 response: deleteup command completed successfully. UPM-22 client_123 deleteup success
Figure 11 Creating a new user profile group UPM client_123 request: create a new group user profile that includes Kevin, Mary and Jane. client_123 UPM-22 createupg admin5 Tina3245P project10 Kevin, Mary, Jane
18
Z. Ma et al.
Figure 11 Creating a new user profile group (continued) UPM server UMP-33 response: createupg command completed successfully. UPM-22 client_123 createupg success
Figure 12 Deleting a user profile group UPM client_123 request: delete the group user profile from UPM server UPM-22. client_123 UPM-22 deleteupg admin5 Tina3245P project5 UPM server UMP-22 response: deleteupg command completed successfully. UPM-22 client_123 deleteupg success
4
UPM implementations
We implemented a prototype of the UPM reference model using web services and Java technologies. The UPM implementation has three parts: 1
Java server side code implements the UPM service functionalities and a MySQL DBMS is used as the user profile repository
2
a UDDI server is implemented as the UPM publishing service
3
four user applications are implemented to act as UPM service requestors.
The applications include a User Profile Administration Tool, a Bookmark Manager, a Contact Manager, and an E-mail Client prototype. Each of the three components of the UPM reference model, the requestor, provider and publishing service, is meant to be platform and language independent. Therefore,
User profile management: reference model and web services implementation 19 various platforms (e.g., Java platform and Microsoft .NET) and programming languages (e.g., Java, C#, VB.Net) could be used for implementing the UPM reference model. In our implementation, we adopted the following programming languages, software and libraries: •
Sun J2SE (version 1.4.2) is used as the runtime environment for developing Java server side and client side programs.
•
Eclipse (version 3.0) is an open source IDE which is used as the development tool in the program.
•
MySQL (version 4.1) is an open source DBMS and used as the repository of the UPM service in the implementation.
•
Glue (version 4.1.2) is a distributed computing Java platform which is used for creating and deploying UPM service (webMethods Inc., 2004).
4.1 Architecture and protocols Figure 13 shows the implementation of the reference model architecture. The left part of the figure is the UPM client acting as the UPM requestor, and the right part is the UPM service provider. The service provider consists of a MySQL DBMS and Glue web application server code. A Glue UDDI server implements the UPM service publishing service. HTTP is utilised as the internet transport protocol in the UPM implementation. SOAP is a messaging protocol used over HTTP to encode the UPM request and response messages using XML format. Use of SOAP makes it possible for UPM clients and services to communicate freely via XML messages, even if the parties are implemented by different programming languages and run on different platforms. Figure 13 User profile management architecture UPM Provider
UPM Requestor
UPM Service Service Finder Module [Java]
Internet [SOAP/ HTTP]
[Glue Web Application Server]
Publish Module Communication Module
Communication Module
Security Module
[Java]
Application [Java]
UPM Publishing Service [Glue UDDI Server]
Action Module
UPM service DB [MySQL]
SOAP over HTTP is used for packaging and transporting the communications involved in all of the following UPM operations:
20
Z. Ma et al.
•
The publish module of the UPM service uses the UDDI publish API to register the service information to the Glue UDDI server as a WSDL file.
•
The service finder module of the UPM client uses the UDDI inquiry API or a browser to access the UDDI server and retrieve the UPM service description contained in a WSDL file.
•
After receiving the UPM service information, the communication module of the UPM client sends requests and receives responses to and from the communication module of the UPM service using SOAP.
4.2 UPM service provider We used MySQL as the DBMS to implement the UPM service repository. The Java Database Connectivity (JDBC) API is adopted for accessing the database using Java and SQL is used for querying the tables. The UPM database includes a few tables which store the users’ profile information as well as the actual profile data, including the profile objects, attributes and methods. The UPM service consists of several packages which correspond to each module of the UPM reference model architecture and provide the following associated functions: •
publish the UPM service to the UPM service registry
•
receive the requests and send the responses from and to the UPM requestor
•
validate the UPM requests
•
execute the requests.
4.3 UPM publication and discovery UDDI is a comprehensive registry mechanism which provides dynamic and flexible ways for service publication and discovery. Glue provides both UDDI Publishing API and an Inquiry API that can perform publication and inquiry operations respectively. We used the class provided by Glue and constructed a Glue UDDI server as a registry repository for the UPM service. The server can receive publication operations, inquiry operations and administration operations.
4.4 UPM service requestors Four client applications are implemented as the UMP service requestors. The User Profile Administration Tool (see Figure 14) is implemented to illustrate an administrator’s role in providing a UPM service. Also, the tool is used to provide a diagnostic tool for testing the functions of the three user applications: Bookmark Manager (Figure 15), Contact Manager (Figure 16) and E-mail Client prototype (Figure 17). Figure 14 shows the main interface of the Administration Tool. The left upper panel is used for showing a list of profile IDs and the left lower panel is used for entering the profile ID, profile object or object attribute name. The right panel is used to show either the profile information in a tree view or the profile status in a text view. The bottom panel contains the buttons representing each implemented UPM function.
User profile management: reference model and web services implementation 21 Figure 14 Main interface of the user profile administration tool (see online version for colours)
Figure 15 Bookmark manager interface (see online version for colours)
22
Z. Ma et al.
Figure 16 Contact manager interface (see online version for colours)
Figure 17 E-mail Client prototype main window (see online version for colours)
Most people who use a browser to surf the internet have their own bookmark (or favourites) set, the Bookmark Manager is implemented to illustrate that personal bookmarks can be saved and managed as a profile object. The purpose of implementing the Contact Manager is similar to that of the Bookmark Manager. User contact information can be taken as a profile object and centrally and persistently managed by the UPM service. The Bookmark Manager and the Contact Manager could be merged and developed further as a more complex organiser tool or as a part of any application that may need to use these pieces of information.
User profile management: reference model and web services implementation 23 The E-mail Client prototype was implemented in the Intelligent Information Technology Research Laboratory at Acadia University through the joint effort of three graduate students. The E-mail Client prototype not only has basic functions such as the ability to send and receive messages, but it can also filter incoming messages for junk e-mail based on a learned prioritisation model. Alternatively, it can recommend a message folder for each incoming e-mail based on a learned categorisation model.
5
UPM service: illustrative examples
Four UPM use scenarios were constructed to test the implementation and to demonstrate the UPM reference model. In this section, we describe two scenarios and discuss the success of the UPM reference model and the web services based implementation in terms of each scenario’s objective.
5.1 Scenario 1: Returning a user profile The objective of this scenario is to demonstrate how a user profile can be returned to a new e-mail client. In this scenario, Laura buys a new laptop computer. The new laptop has been installed with an operating system and some fundamental software, but Laura still needs to install application software from her old laptop. One application is called the Smart E-mail Client (see Figure 17) which has an in-coming e-mail message filter for detecting spam e-mail based on a learned user model. The e-mail client profile contains one method, Update User Model, and four attributes: account settings, friends list, user model parameters and user model data. After the installation, Laura requests that her entire user profile be imported (downloaded) from the UPM service to her e-mail client (see Figure 18). This scenario is constructed to: •
Demonstrate the load of user profile information from the UPM service to an e-mail client using the get function.
•
Illustrate maintenance of general user information and specific application information.
Figure 18 Import the whole profile (see online version for colours)
24
Z. Ma et al.
Figure 19 shows the ‘get’ request sent by the e-mail client to the UPM service and Figure 20 shows the service response. Note that for this or any request to be carried out by the UPM service, Laura must ensure that she has configured her e-mail client with a valid UPM user ID, password and profile ID. The imported profile is passed to the e-mail client for configuration and local saving. Figure 19 Import e-mail client profile 57.66.39.142 Acadia_IITRL_UPM_service_02 get mlaura lauraemailpd lauraHomeProfile EmailClient
Figure 20 Response from UPM service to import e-mail client profile Acadia_IITRL_UPM_service_02 57.66.39.142 success lauraHomeProfile EmailClient Account XMLdata mlaura lauraEmailPD
[email protected] smtp.acadiau.ca pop3.acadiau.ca FriendList XMLdata
[email protected] …
User profile management: reference model and web services implementation 25 Figure 20 Response from UPM service to import e-mail client profile (continued)
[email protected] UM information 0.3 0.7 0.3 EmailFilterModelData text 0.12,0.23,-3.7
….
Figure 21 Manage user profile menu items (see online version for colours)
26
Z. Ma et al.
Figure 22 Account information window (see online version for colours)
Figure 23 Friends list window (see online version for colours)
User profile management: reference model and web services implementation 27 Figure 24 User model parameter configuration window (see online version for colours)
Figure 21 demonstrates that Laura can manage each user profile attribute separately through the ‘Manage User Profile’ menu item. Figures 22 and 23 show the configuration windows that result when the ‘E-mail Account Settings’ item and the ‘Friends List’ item are selected. Each profile attribute value is loaded from the local file to its configuration window when the window is activated. For example, Figure 24 shows the user model parameters window. The values downloaded from the UPM service are displayed in this window. Notice the suspect cut-off value (0.7), the spam cut-off value (0.3), and the FriendList Priority Credit value (0.3). Now, Laura can use the Smart E-mail Client as she did on her old laptop computer.
5.2 Scenario 2: Manipulating a user profile The objective of this scenario is to show how to create, delete and check a user profile. In this scenario, Tina is an administrator of the UPM service. She routinely uses the User Profile Administration Tool to manage the profile data stored in the UPM service repository. This scenario is constructed to: •
Illustrate the prototype User Profile Administration Tool.
•
Demonstrate several UPM Administration commands: create a user profile, check profiles statuses, load and update a user profile, and delete a user profile.
28
Z. Ma et al.
Tina receives a request to create a new profile for Andy. To do this, she clicks the ‘Create’ button on the administration tool interface (see Figure 14). Using the pop-up dialog window shown in Figure 25, Tine inputs Andy’s new profile information and clicks the ‘Create’ button. Figure 25 Create new user profile dialog (see online version for colours)
The status function allows Tina to check the status of a specified profile or all the profiles in the UPM service repository. Tina wants to check the status of all profiles, so she enters ‘all’ in the Profile ID text field of the administration tool and clicks the ‘Status’ button. The UPM service responds with a list of all profiles along with their object and attributes names. Figure 26 shows the result of the status request. The left panel lists all the profile IDs (contains Andy’s new profile, andyWorkProfile, at the end of the list) and the right panel contains the UPM service status as well as each profile status (contains a summary list of its objects and attributes). Should a user have difficulties accessing a UPM service because of a network problem, the user can ask a UPM service administrator to perform the request for him. For example, assume that Jack wants to update a profile attribute, such as the Bookmark Manager preferences, in the UPM service repository. If he is having problems doing this himself, he can contact Tina to access his profile and change the preferences for him. The User Profile Administration Tool allows an administrator to ‘get’ and ‘put’ the whole profile, or a profile object, or an object attribute. In this case, Tina needs to view Jack’s existing set of bookmark preferences and update one of the attribute values. To get Jack’s whole profile, Tina selects Jack’s profile ID, jackprofile, from the list in Figure 26. She then clicks the ‘Get’ button. Figure 27 shows the resulting window with Jack’s profile containing two profile objects: BookmarkManager and ContactManager. The BookmarkManager object includes two attributes: BookmarkList and BookmarkPreferences. Tina can change the XML encoded values of the attributes. After clicking the ‘Put’ button, Jack’s entire profile is updated to the UPM service.
User profile management: reference model and web services implementation 29 Figure 26 Result of the status request (see online version for colours)
Figure 27 Get and put Jack’s whole profile (see online version for colours)
Tina can also delete a specified user profile using Administration Tool. For example, Figure 28 shows that Tina selects ‘testProfile’ user profile in the left list panel and clicks the ‘Delete’ button. A warning message pops up asking if she is certain of the deletion. After she clicks the ‘Ok’ button, the profile is deleted from the UPM service repository.
30
Z. Ma et al.
Figure 28 Delete a specified profile ‘testProfile’ (see online version for colours)
5.3 Discussion The prototype software implementations and scenario testing have demonstrated that the UPM reference model is a valuable guide for developing a general UPM service: •
The proposed n-tier, service-oriented architecture allows the distributed UPM components: the UPM requestor, the UPM service provider, and the UPM publishing service to interact with each other over the network.
•
XML provides a flexible and clear structure for describing the user profile information. Both the user profile information and the request/response messages can be validated against the corresponding XML schema.
•
The implemented functions: get, put, remove, status, createup, and deleteup perform well using a connectionless protocol.
•
The implemented authentication and authorisation methods provide effective access control to the profile information stored on a central server.
The implementations and scenario testing have also shown that web service technologies can be used to develop an effective UPM service: •
SOAP is used for packaging the UPM request/response messages.
•
WSDL is used to describe the UPM service.
•
UDDI is used to publish and fetch the UPM service.
User profile management: reference model and web services implementation 31
6
Related work
Several research groups and companies have made significant contributions to UPM; however, each of these contributions focuses on limited aspects of the set of UPM requirements addressed in this paper. In 1997, Netscape submitted to W3C a proposal called Open Profiling Specification (OPS) which contributes a standard for exchanging profile information (W3C.OPS, 1997). Similarly, both Liberty Alliance (2002) Project and Microsoft (2002) .NET Passport provide a single-sign-on service and standard mechanisms for identity management so users can easily and securely manage and control their identity information. Architectures have also been proposed for sharing personal data between websites such as the sharing of contact information between e-commerce sites (Cingil, 2002; Boll, 2002). Two other contributions in the area of profile management are 3GPP’s Generic User Profile (GUP) (3GPP, 2003) and Open Mobile Alliance’s (OMA) User Agent Profile (UAProf) (OMA.org, 2003). GUP is a collection of data that is stored and managed by different entities. GUP limited itself to the definition of the profile structure without making assumption about profile content. The UAProf specification defined device capabilities and user preferences within the mobile system domain. A recent effort came from the European Telecommunications Standards Institute (ETSI, 2005) which provides a guideline for application and device developers to solve common issues of UPM. The guidelines focused on the requirements of UPM from a user’s perspective and have not considered other UPM requirements such as architecture and protocols. Several other papers and projects have made contributions to UPM with a focus on mobile devices and services (Petersen et al., 2008; Jorstad and Do van Thanh, 2007). A data warehouse is presented for managing mobile data based on a three-tier architecture, focusing on the architecture and its components (Helal et al., 2001). User profile information management for mobile environments is discussed in Sur and Hammer (2003). Profile data sharing among various network devices based on the specification of the 3rd Generation Mobile System is presented in Sahuguet et al. (2003). Three recent contributions concern UPM with a focus on mobile devices and environments. For example, Marie et al. (2002) presented a UPM architecture and profile structures for mobile devices using web services. They proposed architecture similar to ours for achieving the UPM requirements; however, they did not provide details of the framework, such as the command functions. An architecture for handling user profiles of mobile devices that covers access management and security issues is provided in Bartolomeo et al. (2005). This work described an architecture for customising terminals and devices and focused on security and distribution of profile data, without considering the protocol and functions of the UPM requirements. Lastly, Lucent and Sun (2006) have recently done work on the shared use of user profiles in the context of ‘Federated Identity Management’. In their work, they have described how user profile data can be placed on an identity manager server where it can be accessed by service providers over networks. The work provided a high-level view of the proposed management system and its benefits for each involved parties. However, it does not describe the details in terms of a
32
Z. Ma et al.
reference model which can be used for implementing a UPM service. Mobile user’s profiles have also been used extensively in mining mobile users locations (Goh and Taniar, 2004a, 2004b).
7
Summary and future work
This research has investigated the requirements of a network-based UPM, proposed a UPM reference model, and implemented a UPM service using web services technologies. This has been motivated by the increase in software applications and mobile computing devices that utilise user profiles. The research proposed an open UPM reference model that provides the components and architecture of the UPM service, a communication protocol, a list of fundamental UPM functions, a general and extensible schema, and some discussion of the major security issues. We then implemented a UPM service prototype and several client applications to test the major aspects of the reference model. The major contributions of the research include: •
A definition of the key requirements of a UPM service, including the architecture, the user profile schema, the protocol and functions, and the security issues.
•
A reference model based on the requirements of a UPM. The architecture of the UPM service includes three fundamental parts: the service provider, the service requestor, and the service publisher. Each architecture component was described and its modules were defined with their associated functionalities. The user profile information is described using the XML format. The user profile can include not only the objects and attributes, but also the functional methods. A user profile can include general user information and specific application or device information. The UPM protocol and request/response command sequences are defined. Finally, user profile storage and communication security issues are discussed.
•
A prototype of UPM service provider and four client applications (that act as UPM service requestors) are implemented to validate the major aspects of the reference model.
•
Web service standards and protocols are used in the implementation, including SOAP, WSDL and UDDI.
•
A demonstration of the prototype UPM service, running through various scenarios, has shown that the reference model provides valuable guidelines for developing a UPM service.
We see the following as areas of future work in network-based UPM: •
We implemented the authentication and authorisation mechanisms for profile security during its storage on the server. Security during the transmission of the profile information is equally important. We proposed but did not implement the combination of XML-Encryption and XML-Signature as a solution to provide confidentiality and integrity of the message transported between the UPM service provider and requestor.
User profile management: reference model and web services implementation 33 •
In our implementation, the user profile contains only text data; however, the profile is meant to contain other data types, such as images, audio, and video. It would be appealing to illustrate that the UPM service can manage profile information of other data types.
•
Users of the UPM service should be aware of profile information that is shared and have control over which parts of their profile information are to be kept private. More refined levels of user profile security is an open area of research.
•
More implementation and testing are needed to demonstrate the benefits of using the proposed UPM reference model for portable computing devices, such as PDAs and cellular phones.
•
An efficient and effective UPM service should provide reliability and scalability as profile information increases. More work on the scalability of the proposed reference model and implementation are needed.
•
Finally, web services provide flexible technologies for implementing the UPM service; however, they are known to have efficiency problems because of their use of XML. Alternative methods of implementing the reference model could be explored, such as intelligent agents.
References 3GPP (2003) ‘3GPP Generic User Profile (GUP) – architecture’, Stage 2 (Release 6), www.3gpp.org/. Aleksy, M., Butter, T. and Schader, M. (2008) ‘Architecture for the development of context-sensitive mobile applications’, Mobile Information Systems, Vol. 4, No. 2, pp.105–117. Amato, G. and Straccia, U. (1999) ‘User profile modeling and applications to digital libraries’, Proceedings of the Third European Conference on Research and Advanced Technology for Digital Libraries (ECDL-99), ECDL’99, Paris, France, pp.184–197. Bartolomeo, G., Berger, F., Eikerling, H.J., Martire, F. and Salsano, S. (2005) ‘Handling user profiles for the secure and convenient configuration management of mobile terminals and services’, Proceedings of the 1st International Workshop on Secure and Ubiquitous Networks (SUN 05), in conjunction with the 16th International Conference on Database and Expert Systems Applications (DEXA 2005), Kopenhagen, pp.272–277. Boll, S. (2002) ‘Modular content personalization service architecture for e-commerce applications’, Proceedings of the Fourth IEEE International Workshop on Advanced Issues of E-Commerce and Web-Based Information Systems (WECWIS’02), Newport Beach, California, USA, p.213. Cingil, I. (2002) ‘Supporting global user profiles through trusted authorities’, ACM SIGMOD Record, Vol. 31, pp.11–17. ETSI (2005) ‘ETSI EG 202 325 Human Factors (HF)’, User Profile Management, http://webapp .etsi.org/action/PU/20051018/eg_202325v010101p.pdf (retrieved 25 November 2005). Forouzan, B.A. (2007) Data Communications and Networking, 4th ed., McGraw-Hill Higher Education, New York. Goh, J. and Taniar, D. (2004a) ‘Mining frequency pattern from mobile users’, Proceedings of the 8th International Conference on Knowledge-Based Intelligent Information and Engineering Systems, KES 2004, Part III, Lecture Notes in Computer Science, Vol. 3215, pp.795–801.
34
Z. Ma et al.
Goh, J. and Taniar, D. (2004b) ‘Mining physical parallel pattern from mobile users’, Proceedings of the International Conference on Embedded and Ubiquitous Computing, EUC 2004, Lecture Notes in Computer Science, Vol. 3207, pp.324–332. Hartman, B., Flinn, D.J., Beznosov, K. and Kawamoto, S. (2003) Mastering Web Services Security, John Wiley & Sons, Inc., New York. Helal, S., Hammer, J., Zhang, J. and Khushraj, A. (2001) ‘A three-tier architecture for ubiquitous data access’, Proceedings of the ACS/IEEE International Conference on Computer Systems and Applications, Beirut, Lebanon, 25–29 June, pp.177–180. Jorstad, I. and Do van Thanh (2007) ‘A framework and tool for personalisation of mobile services using semantic web’, Proceedings of the International Conference on Mobile Data Management, Oslo, Norway, pp.402–406. Liberty Alliance (2002) ‘The Liberty Alliance project’, http://www.projectliberty.org/ (retrieved 11 November 2004). Liu, H., Salem, B. and Rauterberg, M. (2008) ‘Adaptive user preference modeling and its application to in-flight entertainment’, Proceedings of the 3rd International Conference on Digital Interactive Media in Entertainment and Arts, Athens, Greece, pp.289–294. Lucent and Sun (2006) ‘Identity management for converged networks’, http://www.project liberty .org/resources/whitepapers/Identity_Management_for_Converged_Networks.pdf (retrieved 20 June 2006). Marie, H.A., Tore, J. and Than, D.v. (2002) ‘Offering user profile as an XML web service’, Proceedings of the Fifth International Baltic Conference on DB and IS, Tallinn, Estonia, 3–6 June, Vol. 1, pp.309–320. Microsoft (2002) ‘Microsoft .NET Passport’, http://www.passport.net/ (retrieved 11 November 2004). OMA.org (2003) ‘User agent profile’, http://www.openmobilealliance.org/release_program/ docs/UAProf/OMA-UAProf-V2_0-20030520-C.PDF (retrieved 11 December 2004). Petersen, F., Bartolomeo, G. and Pluke, M. (2008) ‘Personalization and user profile management’, International Journal of Interactive Mobile Technologies, Vol. 2, No. 4, pp.25–29. Sahuguet, A., Hull, R., Lieuwen, D. and Xiong, M. (2003) ‘Enter once, share everywhere: user profile management in converged networks’, Proceedings of the First Biennial Conference on Innovative Data Systems Research, Asilomar, California. Stallings, W. (2007) Data and Computer Communications, 7th ed., Prentice-Hall, New Jersey. Sur, G. and Hammer, J. (2003) Management of User Profile Information in UbiData, CISE Technical Report TR03-001, Department of CISE, University of Florida, Gainesville, Florida. W3C.OPS (1997) ‘Submission of OPS to W3C’, http://www.w3.org/Submission/1997/6/ Overview.html webMethods Inc. (2004) ‘webMethods glue’, http://www.webmethods.com/meta/default/folder/ 0000008448 (retrieved 10 November 2004).
