Abstract
The problem of evaluating software architecture is an important problem of software engineering.
The purpose of the architecture evaluation of a software system is to analyze the architecture to identify potential risks and to verify that the quality requirements have been addressed in the design. Different techniques have been developed to evaluate a software architecture. Most common among these techniques are model based approaches, metric based methods and scenario based analysis. Service-Oriented Architecture (SOA) is an architectural
approach (or style) for constructing complex software-intensive systems from a set of
universally interconnected and interdependent building blocks, called services. Services used
in composite applications may be brand new service implementations, they may be fragments
of old applications that were adapted and wrapped, or they may be combinations of the above. The emergence of SOA as an approach for integrating applications presents many new challenges to organizations resulting in significant risks to their business. Particularly important among those risks are failures to effectively address quality attribute requirements such as performance, availability, security, and modifiability. Hence, it becomes necessary to
evaluate a service oriented architecture based application in the context of quality attributes.
In this dissertation, our aim is to investigate the limitations of using scenario based software
architecture evaluation approaches in SOA paradigms. We investigate that most of the
current approaches in the literature of software architecture, do not consider the factors that
are more specific in SOA based applications. For example, to the best of our knowledge, current evaluation approaches do not address the quality issues that arises due to a SOA governance lifecycle. There must be a mechanism to investigate how governance policies are impacting the quality attributes (positively or negatively). We show that a governance lifecycle is a critical element of any SOA based application and must be analyzed in the context of quality attributes. Current software architecture evaluation methodologies also have not been studied and used in the areas of modern cloud based services. In brief, we look at the problem from following different angles: (1) evaluating a SOA governance model;
(2) analyzing data security risks in cloud based service environments; and (3) evaluating the
attack surface and root cause of an attack in an SOA based enterprise application. Security is considered as the most prominent quality attribute in software applications. Therefore, throughout our work, we primarily focus on security analysis, out of all the quality attributes.
The impact of SOA governance mechanism on the organization’s quality attributes is largely not studied or evaluated in a structured manner. To overcome this problem, we propose SAGE (Service Oriented Architecture Governance Evaluation) as a quantitative approach, to evaluate the impact of SOA governance policies on prominent quality attributes. Our approach facilitates an exhaustive quantitative impact analysis to evaluate the effectiveness of SOA governance policies. This can be further used to estimate the current maturity level of any SOA based enterprise.
To evaluate the data security risks in cloud based services, we did a survey of prominent security issues in current cloud computing environments. Based on these issues, we propose a risk analysis approach for analyzing the data security risks. This approach can be used by any potential service user, before putting his confidential data into a cloud computing environment.
As a solution to the security analysis in SOA based enterprise applications, we present an approach to compute the attack surface in a SOA based enterprise application. We also discuss that how we can map an attack surface from a service layer to a business process layer. Further, we present an approach to investigate the root cause of an attack. This approach can be used directly by any SOA based enterprise to evaluate the security and
therefore a possible reduction in security attacks.
In our work, we attempt to answer the following questions: (1) Are the existing software architecture evaluation approaches sufficient in service oriented paradigms? (2) If no, what are the areas that remain unexplored? (3) How to address these unexplored areas? Our study brings out some interesting results. We show that evaluation of a SOA governance lifecycle is necessary to estimate the quality and dynamic behavior of the composed application. Our work also unveils various security issues in cloud based service environments. The presented work is an initial attempt to make the SOA evaluation and management more structured and effective.