Analysis of existing authorization models and requirements for design of authorization framework for the Service Oriented Architecture

Although there are several efforts underway to provide security for the Service Oriented Architecture (SOA), there is no specification or standard for authorization. We analyse the currently available authorization models for the Web services and business process layers comprising the SOA and highlight the features that are missing in each of them. Based on our analyst's of existing authorization models, we envisage an authorization framework for the SOA to provide extensions to both the security layers of Web services as well as business processes. We lay out separate design principles for authorization services in each of these layers.