Security as a Service - A Reference Architecture for SOA Security

Securing service-oriented systems is challenging, because like business services the security services are equally distributed in SOA systems. Enforcing security exclusively at the endpoints creates a significant security burden. Also, every endpoint has to implement the entire security infrastructure, which is an expensive approach. Currently, there is very little work done to separate security from service endpoints. We propose a Security As A Service (SAAS) approach, which shifts major security burden from service endpoints to dedicated and shared security services within a security domain. Security services are composed from components, and integrated based on the Service Component Architecture (SCA) model. In this contribution, we apply the SAAS paradigm to implement security for SECTISSIMO, which is a platform-independent framework for security modeling and implementation [9]. (1)