Secure Local Invocation in Composite Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Service Oriented Architecture (SOA), local invocations within co-located composite applications are not typically performed when Quality of Service features like security and authentication are enabled, as they bypass necessary security checks, potentially leading to security breaches.
Innovation Solution
Implementing secure local invocations by attaching security policies to both the client and server, with attributes indicating whether each policy can be used for direct invocation, and ensuring user authentication is necessary, thus allowing local invocations only if policies are consistent and secure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If local invocations are used within co-located composite applications, then performance is improved by eliminating network overhead, but security is worsened because security checks are bypassed
Solution Approach 1:
The application server acts as an intermediary that mediates between the invoking composite application and the target web service. It receives local invocation requests, validates security policies, checks authentication credentials, and determines whether to allow the local invocation to proceed. This intermediary mechanism enables performance optimization while maintaining security through centralized policy enforcement.
Solution Approach 2:
Security policies are attached in advance to both the invoking composite application and the target web service, along with authentication credentials. The application server performs preliminary security validation before executing the local invocation, checking whether the attached credentials satisfy the security policies. This preliminary action ensures security requirements are met before the performance-critical local invocation occurs.
2Reliability
If security policies are attached to enable quality of service features, then security is improved, but local invocations are prevented from executing, worsening performance
Solution Approach 1:
The system dynamically determines whether local invocations are permitted based on runtime evaluation of security policies and attached credentials. The application server evaluates the security policies attached to the invoking application and target service, checks the credentials, and makes a dynamic decision to either allow or block the local invocation. This dynamic approach enables security enforcement while preserving local invocation capability when security requirements are satisfied.
Solution Approach 2:
The system changes the parameter of invocation mode from strictly network-based to conditionally local based on security policy evaluation. When security policies are attached and credentials are validated, the invocation mode parameter changes to allow local execution. This parameter change enables the system to adapt between security modes and performance modes based on the presence and satisfaction of security requirements.
Data Source
AI summary
In one set of embodiments, methods, systems, and apparatus are provided to enable secure local invocation of a web service in response to receiving a request from a first composite application to invoke a web service operation of a second composite application, where the first application is associated with a reference policy, and the second application is associated with a service policy, then determining, based upon the service policy and the reference policy, whether local invocation is secure, and invoking the operation using the local invocation in response to determining that the local invocation is secure. Attributes associated with the reference and service policies can indicate whether those policies can be used in a local invocation, or if user authentication is needed before performing the invocation with those policies. The local invocation may comprise a procedure call in an application server from the first application to the second application.