1 / 7

McLean, VA August 8, 2006

SOA, Semantics and Security. McLean, VA August 8, 2006. Application 1 “Service Consumer”. Application 2 “Service Provider”. SOA interactions require answering five key questions.

finian
Download Presentation

McLean, VA August 8, 2006

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. SOA, Semantics and Security McLean, VA August 8, 2006

  2. Application 1 “Service Consumer” Application 2 “Service Provider” SOA interactions require answering five key questions • How can the Consumer dynamically discover the existence of a Provider, which can provide the services being requested? • Assuming the Consumer knows of the Provider’s existence, how can it locate the Provider? • Assuming the Consumer has located the Provider, how can the two describe how to connect to each other, in a standard format which can be understood regardless of their IT platforms? • Assuming they have described themselves, how can they exchange messages in a common messaging format which is independent of their underlying platforms? • Assuming they have agreed upon a common messaging format, what data format can they use to exchange data independent of their underlying database technologies?

  3. High Level Description • Web Service Provider (Provider) develops its description and specifies its interfaces using WSDL, and registers itself in the public UDDI registry • Web Service Consumer (Consumer) queries the UDDI registry in real time, and discovers that Provider has services it is looking for • Consumer downloads Provider’s WSDL specification from the Provider (including the format of SOAP messages the Provider can accept) • Consumer then develops a request in the form ofan XML based SOAP message (using a SOAP engine to translate from its native format to SOAP) • Consumer then “calls” Provider by sending the SOAP message over HTTP • Provider receives the SOAP message and translates to its own native format using a SOAP decoder • Provider composes a reply as a SOAP message in a format which can be understood by Consumer (the incoming SOAP message from Consumer also includes information on the format of SOAP messages it can accept) • Provider then “replies” to Consumer by sending the SOAP message over HTTP UDDI Service Registry Reference models, architecture, specifications and standards realize SOA interactions only in part; semantics are also vital Application 1 “Service Consumer” 1 4 2 3 3 2 4 5 5 8 6 7 1 8 Semantics are most often thought of in terms of understanding messages and functions... 6 7 Application 2 “Service Provider”

  4. ... semantics are necessary to properly secure services also! • Sharing information sharing across organizational boundaries requires semantics not only to properly interact with services but also to properly secure services also. • Shared semantics help to: • Locate and trust sources of information used to understand or enforce security requirements • Comprehend the available data upon which policy authors can to craft access control policy • Distribute decision and enforcement of access control policies • Represent service identity and authentication information to services • Even the various authorization models that can be applied to an SOA require shared understanding of attributes, policy and authoritative sources • Attribute based access control • Attribute taxonomies • Service taxonomies

  5. Service Consumer Service Provider Organization A Security PEP Security PEP XML Firewall XML Firewall Organization B Traditional Firewall Traditional Firewall Audit Service Audit Service PKI PKI Authorization Policy Store Authorization Policy Store Service Logs Service Logs Policy Information Service Policy Information Service Attribute Information Service Attribute Information Service Certificate Validation Service Certificate Validation Service Policy Decision Service Policy Decision Service Identity & Attribute Store Identity & Attribute Store Semantics and security are key pieces of successful interactions across organizational boundaries • Complete SOA Security solution augments traditional security solutions and infrastructure to provide a more robust application layer security model • Lines of communication utilize Transport Layer Security (SSL) • Messages signed to provide message level security (message integrity) • Protects message integrity when handled by intermediaries • Components illustrated are solely logical … capabilities may be combined based on COTS capabilities

  6. Some of the places that taxonomies and semantics matter “In-Line Authorization” “Pre-Authorization” How should I expressthe action I’d like to execute? What policy should I apply to a service request? What attributes canI forward to a PEP? What do the attributes mean? Legend: PEP – Policy Enforcement Point AP – Attribute Point PDP – Policy Decision Point

  7. Rebekah Metz Booz Allen Hamilton Telephone: 703.377.1471 Email: metz_rebekah@bah.com Questions?

More Related