1. Infrastructure Service Approach to Handling Security in Service-Oriented Architecture Business Applications Doina Iepuras

2. SOA Security Authentication – validating the identity of the message originator Authorization – controlling the use of the services Privacy – no unwanted intercepts while transmitting a message Integrity – confidence that message has not been modified

3. SOA Security Levels Transport Layer Security –Point-to-point security –Encryption for data in motion Cons Not granular enough Reduced auditing capabilities

4. SOA Security Levels Message Level Security – End-to-end security – WS-Security - integrity via cryptographic mechanisms – WS-Policy – framework describing rules and policies Cons Implementation for each message

5. Application Managed Security

6. Application Proxy Common interface that can receive and respond to web service calls Reduce the load on the enterprise’s infrastructure Caches and manages authentication and authorization requests

7. Gateway Security Pattern Handles different transport layers Performs enhanced message transformations Coarse-grained authorization of the request message and its origins Validation of the request format

8. Enterprise Service Bus Supports integration and flexible reuse of heterogeneous business components –Routing messages between services –Conversions of transport protocols –Transforming requests from one message format to another

9. Security as a Service Access control decisions should be made each time a message reaches a transition point Allows early detection of unauthorized requests Eliminates unnecessary security processing at the application layer Issue: a lot of redundancy

10. Security as a Service Implement security as a set of services Application relies on services to acquire a security decision What if security is already implemented within the application? –The decisions should still be made via a service which gets the decision from the application implementation

11. Security as a Service Security Decision Service - segregates the security decision functionality Security Enforcement Service – applies security decisions to a request

12. Security as a Service within the ESB ESB enables the security as a service model Services are implemented as mediations which provide reusable functionality –Service for Encryption/decryption –Service for Validating digital signatures –Service for Authenticating the requestor

13. ESB Model

14. Validation of request format Transport and end-to-end security for service implementations Enables layered security approach by separating enforcement and decision services Single point of control for identity mapping Can be implemented gradually

15. Q&A