In-Depth

Mapping Security to Services-Oriented Architecture

What security hurdles can you overcome when using XML to develop against a services layer? A whiteboard diagram of security requirements mappings in an SOA shows you the way.

Architects developing against a services layer using XML, rather than directly against an ERP/legacy layer, face three security challenges: 1) persisting a "security context" from the end user or client to the business systems; 2) ensuring that an unauthorized user sending malicious XML is blocked from the Web service; and 3) blocking rogue XML messages that bypass the XML gateway.

To understand how security requirements are mapped to a typical services-oriented architecture, the diagram shows Web services deployed at the consumer and access layers (through Web portals where end users interface indirectly with Web services and in application-to-application communication where no end user is involved), and at the services layer (across an XML message bus or other type of orchestration engine). At the systems layer, business applications have security profiles that must be mapped to the end users or Web service, client applications.

To avoid losing the client/user security context between the access layer (where the identity of the client or user is authenticated) and the services layer (where applications authorize and tailor responses to the end user or client), security tokens (such as a SAML assertion or WS-Security UsernameToken) are inserted into XML messages.

With wireless LANs, VPNs, and distributed networks, passing XML traffic to the services layer through the XML gateway cannot always be guaranteed. Therefore, security must be "deperimeterized" by enforcing security rules at the services layer, close to the end point.

To pass security context with XML messages sent to and within a services layer, architectures should reuse existing directories with user or policy information rather than establishing a new silo just for Web services. An XML security server, containing links to existing security architecture, is used to for this purpose.

Remember that availability and administration are aspects of security, too. Existing network management tools can be reused to aggregate alerts and quality-of-service indicators generated at the services layer.

About the Author

Mark O'Neill is chief technology officer at Vordel, a provider of XML security technology. He is the author of Web Services Security (McGraw-Hill Osborne Media, 2003). Contact Mark at [email protected].

comments powered by Disqus

Featured

  • GitHub Previews Agentic AI in VS Code Copilot

    GitHub announced a raft of improvements to its Copilot AI in the Visual Studio Code editor, including a new "agent mode" in preview that lets developers use the AI technology to write code faster and more accurately.

  • Copilot Engineering in the Cloud with Azure and GitHub

    Who better to lead a full-day deep dive into this tech than two experts from GitHub, which introduced the original "AI pair programmer" and spawned the ubiquitous Copilot moniker?

  • Uno Platform Wants Microsoft to Improve .NET WebAssembly in Two Ways

    Uno Platform, a third-party dev tooling specialist that caters to .NET developers, published a report on the state of WebAssembly, addressing some shortcomings in the .NET implementation it would like to see Microsoft address.

  • Random Neighborhoods Regression Using C#

    Dr. James McCaffrey from Microsoft Research presents a complete end-to-end demonstration of the random neighborhoods regression technique, where the goal is to predict a single numeric value. Compared to other ML regression techniques, advantages are that it can handle both large and small datasets, and the results are highly interpretable.

  • As Some Orgs Restrict DeepSeek AI Usage, Microsoft Offers Models and Dev Guidance

    While some organizations are restricting employee usage of the new open source DeepSeek AI from a Chinese company due to data collection concerns, Microsoft has taken a different approach.

Subscribe on YouTube

Upcoming Training Events