We propose a language for formal specification of serviceoriented architectures. The language supports the integrated specification of communication level events, policy level decisions, and the interaction between the two. We show that the reachability problem is decidable for a fragment of service-oriented architectures. The decidable fragment is well suited for specifying, and reasoning about, securitysensitive architectures. In the decidable fragment, the attacker controls the communication media. The policies of services are centered around the trust application and trust delegation rules, and can also express rbac systems with role hierarchy. The fragment is of immediate practical relevance: we have specified and verified a number of security-sensitive architectures stemming from the e-government domain.

Abstract. Communication protocols describe the steps that the communication end-points must take in order to achieve a common goal. In practice, networks often contain mid-points, which can relay, redirect, or filter messages exchanged by the end-points. A mid-point can enforce a communication protocol: it forwards the messages that conform to the protocol, and drops them otherwise. Protocol specifications typically define only the end-points' behavior. Implementing a mid-point that enforces a protocol is nontrivial: the mid-point's behavior depends on the end-point's behavior, and also on the behavior of the communication environment in which the protocol executes. We present a process algebraic framework that takes as input the formal specifications of the protocol and the environment and outputs a specification for a mid-point that enforces the protocol. We prove that the mid-point specifications synthesized by our framework are correct: only messages that could have resulted from correctly executing end-points are forwarded. As an application, we construct a formal model for the mid-point that enforces the TCP three-way handshake protocol.