A service-oriented architecture (SOA) is an approach to designing business applications to be more responsive to a changing business environment. In the context of a service-oriented architecture, a business service is a repeatable business task; business applications are in turn created by combining a series of business services. In composing business applications, there can be a business justification for separating the business application logic (and an application developer) from the infrastructure. This approach of isolating business functionality at the application level into services can also influence how we think about infrastructure and management applications.
Business application design implementing this type of separation of concerns should encourage the separation of infrastructure and application. In the context of security infrastructure, this allows a business application to be security unaware. The premise is that any security data or security process is provided outside the application itself and is known to and managed by the infrastructure or middleware. An example of this is to think of security mechanisms (SSL, VPN’s) as an instance of an implementation of a security channel protection service albeit one that is at the protocol layer.
A service oriented architecture provides an opportunity and motivation for taking another look at the security mechanisms currently deployed in a business in support of a set of business services. It can be an opportunity to look at encapsulating or decomposing complex security mechanisms into a set of related security services. To do this, we need to start identifying the points at which security decisions are made and the security control points where these decisions are enforced. If we identify these points, we can then separate out when a security decision can be provided by a security service or when it can be provided by the application code itself. A security decision service can be provided to perform the (repeatable) task of applying the relevant security policy to a service request, so that this functionality does need to be provided by the application code. Likewise, security enforcement, the action taken based on the security decision, can be part of an application design or part of a set of managed infrastructure services.
