Model-Driven Approach for End-to-End SOA Security Configurations

Model-Driven Approach for End-to-End SOA Security Configurations

Fumiko Satoh, Yuichi Nakamura, Nirmal K. Mukhi, Michiaki Tatsubori, Kouichi Ono
Copyright: © 2011 |Pages: 31
DOI: 10.4018/978-1-60566-794-2.ch012
OnDemand:
(Individual Chapters)
Available
$37.50
Current Special Offers
No Current Special Offers
TOTAL SAVINGS: $37.50

Abstract

The configuration of non-functional requirements, such as security, has become important for SOA applications, but the configuration process has not been discussed comprehensively. In current development processes, the security requirements are not considered in upstream phases and a developer at a downstream phase is responsible for writing the security configuration. However, configuring security requirements properly is quite difficult for developers because the SOA security is cross-domain and all required information is not available in the downstream phase. To resolve this problem, this chapter clarifies how to configure security in the SOA application development process and defines the developer’s roles in each phase. Additionally, it proposes a supporting technology to generate security configurations: Model-Driven Security. The authors propose a methodology for end-to-end security configuration for SOA applications and tools for generating detailed security configurations from the requirements specified in upstream phases model transformations, making it possible to configure security properly without increasing developers’ workloads.
Chapter Preview
Top

Soa Security Configuration Process

Security Domain Federation

The SOA approach develops applications by assembling computing system components called services which may be located on various platforms. These platforms may support their own security technologies, such as Kerberos or PKI, so the different security technologies should be integrated to secure all of the SOA application. This integration is called a security domain federation.

Web Services Security (WS-Security) (Web Services Security, 2006) is one of the security technologies that is typically used for SOA applications. WS-Security proposes a framework for a security federation (IBM and Microsoft, 2002) in which we can integrate various security technologies. Figure 1 shows a typical security federation framework. To exchange secured messages using WS-Security, a requester and a provider should share a common key as a security token. Suppose the service requester provides a username token that includes its own ID and password, but the service provider requests some another kind of token such as a SAML token. The WS-Security federation framework can exchange these different kinds of security tokens using an intermediary server called a security token service (STS). The requester sends a request for a security token exchange and its username token to the STS, and then the STS authenticates the requester and issues the SAML token for the requester to connect to the provider. Then the requester can send a secured message to the provider by using the issued SAML token.

Figure 1.

Security domain federation by WS-security

978-1-60566-794-2.ch012.f01

The federation model is the simplest one, but other extensible federation models have been proposed. The configuration for a security domain federation can be quite complex, because developers must fully understand the federation platforms including the STS. The difficulties of the security configurations are the focal issues in this chapter, and we clarify these problems in the next section.

Complete Chapter List

Search this Book:
Reset