Trading Off Security in a Service Oriented Architecture

Abstract

Abstract. Service oriented architectures provide a simple yet flexible model of a computing system as a graph of services making requests and providing results to each other. In this paper we define a formal model of a service oriented architecture and using it, we define metrics for performance, for availability, and for various security properties. These metrics serve as the basis for expressing the business requirements. To make trade-offs possible we also define a set of cost metrics, denominated in a uniform currency, to measure the cost of not meeting a requirement. The model, the property metrics, and the cost metrics are then used to generate a Constraint Satisfaction Problem where the objective function is set to minimize the aggregate system cost. We have written these constraints and defined realistic requirements in OPL and we have used them to generate system configurations that minimize the overall cost by optimally trading off the business requirements.Computing systems are designed to meet the security, performance availability, and economic requirements of the procurer. Sometimes not all of these requirements are simultaneously attainable to the maximum degree. In order to get as close as possible to meeting the requirements, trade-offs must sometimes be made between the individual requirements. In order to make these trade-offs in a sensible way and to find a system configuration that best meets our overall goals, we need a model of a system which can be evaluated quickly to determine how well the system is meeting its requirements and a uniform cost model that we can use to manage the trade-offs on the different requirements.In this paper we use formal techniques to define a precise model of a service oriented architecture, a flexible yet simple computing model that underlies the Web Service standards so popular in data processing and integration applications. We argue that this model is close enough to the reality of such systems to be interesting. We then formally define various properties of the model that correspond to important properties in real systems. The properties that we define and optimize for are different aspects of data security, server throughput, service availability and network bandwidth. We do not claim that these are the

A method for modeling and analyzing the security attributes of service-oriented software system

“…Services can be primitive, or combined for representing the collaboration with other services. In this subsection, we extend model proposed by Swart et al [16] and define the SOA software system model for security analysis, as shown in Fig. 1.…”

Principles of Secure Network Configuration: Towards a Formal Basis for Self-configuration

“…For example, in practice, the more firewalls/subnets that have to be traversed to directly access a node, then the more 'secure' the node is considered to be. The notion of security distance is defined in [21] as the minimum number of servers and/or firewalls that an attacker on the Internet must compromise to obtain direct access to some protected service. We argue that security distance in this case is equivalent to using a weighted c-semiring with each system having an equal rating of '1'.…”

Multilevel Security and Quality of Protection

“…A soft-constraint encoding of the revised SAN model will also provide access to techniques for exploring and manipulating SAN configurations. This will be especially useful when making tradeoffs of quality of protection against other attributes such as cost and performance [1,31]. Exploring how our soft-constraint framework can facilitate making such tradeoffs is a topic for future research.…”

“…The model that is proposed in this paper forms a part of our ongoing research in using constraint solving techniques as a practical approach for reasoning about security [1,[3][4][5]31]. Building on the results in [4] we demonstrate in this paper that determining whether a particular system configuration meets a quality of protection measure can be described as a constraint satisfaction problem.…”

“…For example, in practice, the more firewalls/subnets that have to be traversed to directly access a system, then the more 'secure' the system is considered to be. The notion of security distance is defined in [31] as the minumum number of servers/firewalls that an attacker on the Internet must compromise to obtain direct access to some protected service. We conjecture that security distance in this case is equivalent to using a weighted c-semiring with each system having an equal rating of '1'.…”