The document outlines a security model for Service-Oriented Architecture (SOA) in enterprise systems, emphasizing the importance of various security requirements such as confidentiality, integrity, authentication, and authorization. It discusses approaches to ensuring security, including message-level security, security as a service, and policy-driven security, and presents a case study on the Agresso Integration Hub to illustrate these concepts. The conclusion highlights the need for a unified security framework to address the challenges of SOA security effectively.

1. SOA Security Model for Enterprise Systems Integration Vivek Jonnaganti

2. Agenda Introduction Security requirements of SOA Approaches to security Unified Web services security SOA security model Case-study at Agresso Conclusion

3. Introduction These three domains form together a so-called Service-based Business Environment [2]

4. SOA Example 1: LIBRIS BYGGDOK GU Bibliotek KTH Bibliotek Chalmers Bibliotek Kungl Bibliotek LIBRIS environment (Broker)

5. SOA Example 2: Google search Google-search environment (Broker + Provider)

6. Model delineation High flexibility (allows redundancy) Low reusability Low flexibility (redundancy not allowed) High reusability

7. SOA Enterprise Environment Elements of a SOA, adapted from the CBDI Service Oriented Architecture Practice Portal Web services architecture

8. Security requirements of SOA: Functional Confidentiality Prevent disclosure of information to unauthorized individuals or systems Integrity and non-repudiation Implies that data cannot be manipulated without authorization Authentication Process of verifying the identity of users Authorization Permission to use a resource Protection against attacks Ensures that attackers do not gain control over applications

9. Security requirements of SOA: Non-functional Interoperability Security solutions must not break compatibility of services Manageability Refers to the ease with which a security a security solution can be managed Ease of development Complexity reduces adoption of any security solution

10. Message level security Trust models depicting the point-to-point and end-to-end configurations [4]

11. Message level security: WS-Security An OASIS standard which allows message-level security to be implemented with SOAP Specifications include; How to attach signature and encryption headers to SOAP messages? How to attach security tokens such as X.509 certificates and Kerberos tickets to messages?

12. Message level security: WS-Security Security token service model [4]

13. Security as a service Security implemented as an infrastructure service, for e.g. offered by the ESB

14. Security as a service: SAML Security Assertion Markup Language (SAML) Framework for exchange of security related information between trusting parties Key standard for federated identity systems Cross domain Single-Sign On (SSO) Three components of the SAML specification are; Assertions (authentication, attribute and authorization) Protocol Binding Assertions are exchanged among sites and services using the protocol and binding

15. Security as a service: SAML SAML Implementation

16. Security as a service: AON Application-oriented networking (AON) involves network devices designed to aid computer-to-computer application integration Salient features of AON include; Enhances XML processing capabilities Provides secure and fast movement of XML and non-XML messages Provides consistent policy enforcement for security, transaction routing, etc. Fosters XML-based technologies and SOA

17. Policy driven security Security policy decisions separate security logic from business logic Easier to ensure consistency of security enforcement across multiple applications Challenges to be addressed; Ease of development and administration Consistency of security checks Interoperability of security solutions

18. Policy driven security: Declarative programming Used as a mechanism to separate a concern from the rest of the solution Different degrees to which declarative security can be employed; Internal use within an enterprise to ensure consistency Use at design time to ensure interoperability Use at runtime to ensure interoperability Machine-readable expression of what is required in a message exchange from a WS-Standards perspective WS-Policy is an emerging standard that makes this approach possible

19. Policy driven security: WS-Policy WS-Policy framework specifies; Syntax for writing policies Algorithm for comparing policies Policy-based approach to ensuring interoperability between two parties in a web service message exchange Sign the body of the request Encrypt the body of the request Encrypt the signature of the body Include a timestamp as the last entry in WS-Security header

20. Policy driven security: WS-Policy Query via WS-MetadataExchange or look up policies attached to WSDL/UDDI entities as described in WS-PolicyAttachment.

21. Unified Web services security Enterprise Application Security Integration (EASI) solution Firewalls and access control Internal security Policies, procedures and tools in place Enterprise security architectures must support end-to-end security across many application components

22. SOA Security Model Holistic security model with a breakdown of security services

23. SOA Security Model Authorization services Controls access to services based on a set of policies Authentication services Security token service that can help issue and validate authentication credentials Identity services Managing, sharing, federating and accessing of identity information from a variety of authoritative identity sources

24. SOA Security Model Confidentiality services Provide the capabilities to protect sensitive information from disclosure and to detect unauthorized modification of data Audit services Provides mechanisms to submit, store and report on audit data submitted as system events

25. Case-study at Agresso - Background Agresso Integration Hub is a middleware, deployed as a SOA infrastructure Provides fundamental functions for services exposure and adaptable business process Provides a wide set of capabilities to manage and integrate services and events across applications

26. Case-study at Agresso – Integration workflow

27. Case-study at Agresso - Solution Identity Management (IdM) system which can access identity information from different authorized sources Confidentiality of the messages can be protected by making use of WS-Security ESB has to be implemented as a policy-enforcement point Web-services can advertize their local policies and specify their policy requirements by making use of WS-Policy SOA governance module can be used to deploy auditing services which store the logs of all XML traffic

28. Conclusion Context of security changes with respect to SOA Security approaches to SOA include; Message level security Security as a service Policy driven security Security approaches can be unified into a single framework e.g. EASI model SOA security model provides a holistic approach to secure the environment Case study to evaluate the security model and solve security vulnerabilities of Agresso Integration Hub

30. References How to Identify, Specify and Realize Services for your SOA (Part I), by Ali Arsanjani IBM, 2005 An integrated model for SOA Governance by Kingkarn Kanchanavipu, August 2008. SOA Security by Ramarao Kanneganti and Prasad Chodavarapu, 2008 Manning Publication Co. Security in a Web Services World: A Proposed Architecture and Roadmap, A joint security whitepaper from IBM Corporation and Microsoft Corporation, April 2002, Version 1.0 How SAML works? A newsletter by Preston Gralla, April 2002. The Network's New Role by Taf Anthias and Krishna Sankar, ACM Queue vol. 4, no. 4 - May 2006 Does Application-Oriented Networking Impact SOA and Web Services? by Bijoy Majumdar, Vikas Kumar and Vivek Raut, Dec 2005 Understanding Web Services Policy, by Asir S Vedamuthu and Daniel Roth, Microsoft Corporation, July 2006 Mastering Web Services Security by Bret Hartman, Donald J. Flinn, Konstantin Beznosov, and Shirley Kawamoto, 2003 Wiley Publishing Inc. Enterprise Application Security Integration for Application Servers and Portals, by Randy Heffner, June 2001. Agresso Integration Hub Roadmap, Agresso Whitepaper (Draft) Service-oriented agility: Methods for successful Service-Oriented Architecture, by Pal Krogdahl, Gottrried Luef and Christoph Steindl, July 2005 MSDN .NET Framework Developer Centre - What's New in Web Services Enhancements (WSE) 3.0. SOA in Practice – The Art of Distributed System Design by Nicolai M. Josuttis, August 2007 Broker Architecture for Web-services – Tech Republic Whitepaper, May 2002. SAML Service - Sun ONE Identity Server Customization and API Guide, section 8.1.