A Flexible Architecture for Enforcing and Composing Policies in a Service-Oriented Environment

Abstract

Abstract. Service Oriented Architectures (SOA's) enable powerful application and end user service composition from independently defined services. The effective deployment of such composed services requires adaptation of and interoperability between services. This challenge can be approached by specifying service composition in policies, and by enforcing these policies in a sophisticated run-time architecture.In this paper, we present an open architecture for enforcing and composing complex policies that can depend on the available services in the environment. Complex polices have typically been studied in the context of policy languages, yet they have never been fully supported in a SOA-based execution environment. We have created a flexible run-time architecture that maximizes interoperability, adaptability and evolution. We have prototyped our architecture on an Enterprise Service Bus and we illustrate how our solution supports realistic and complex policies.

Towards simplified specification of policies in different domains

“…Our policy enforcement architecture -described in more detail in [7] -is used to intercept all communication between the actors and makes sure that policies related to this communication are enforced. Because the SEP uses an Enterprise Service Bus (ESB) to manage the communication between different actors, messages can easily be intercepted and redirected to a policy engine, responsible for actually enforcing the policies, as shown in figure 8.…”

Model-Driven Security Assessment and Verification for Business Services

“…The authorization concepts are refined by Dong Huang in a semantic policy-based security framework for business processes identifying two levels of security for business processes. On the task or activity level, security concerns, such as non-repudiation, confidentiality process level, general compliance rules, such as requir [6].Tom Goovaerts presented an open architecture for enforcing and composing policies that can depend on the available services in the flexible run-time architecture that maximizes interoperability, adaptability, ev prototyped the architecture on an Enterprise Service Bus and illustrate how the solution supports realistic and complex policies [7]. Process for Web Service Security (PWSSec), to a real web servi manner in which security in inter and implemented by applying PWSSec, which combines a risk analysis and management, along with a security architecture and a standard built to provide support to the PWSSec process RBAC model (GB-RBAC) and applied it for authorization management in collaborations by introducing the concept of virtual multi-groups, where all members and perform operations for the collaborative work [9].…”

“…They also present an application to constructing systems models, where we combine a UML language for formalizing access control requirements. From mo they automatically generate security time architecture that maximizes interoperability, adaptability, evolution and prototyped the architecture on an Enterprise Service Bus and illustrate how the solution supports realistic and complex policies [7].Carlos Gutiérrez proposed the application of the Process for Web Service Security (PWSSec), to a real web service-based case study. The manner in which security in inter-organizational information systems can be analyzed, designed implemented by applying PWSSec, which combines a risk analysis and management, along architecture and a standard-based approach.…”