- From: Fletcher, Tony <Tony.Fletcher@choreology.com>
- Date: Wed, 19 Nov 2003 21:55:02 -0000
- To: "Ugo Corda" <UCorda@SeeBeyond.com>, <public-ws-chor@w3.org>
- Message-ID: <221369570DEDF346AE42821041345E893A97ED@exchange1.corp.choreology.com>
PS to previous reply: If the WSDL says that certain security is always applied then that will happen even if the Choreography description does not mention it. If the Choreography description contains conflicting requirements that the engine can not resolve then there will be an error. If the WSDL allows certain security as an option then whether it is actually applied or not can depend on the Choreography description. Also my previous message was actually only about the requirements not about how those requirements are met. It may well be that we agree that certain requirements on Choreography description abilities are met in other ways than CDL features. Best Regards, Tony <http://www.choreology.com/> Tony Fletcher Technical Advisor Choreology Ltd. 68, Lombard Street, London EC3V 9L J UK Phone: +44 (0) 870 7390076 Mobile: +44 (0) 7801 948219 Fax: +44 (0) 870 7390077 Web: <http://www.choreology.com/> www.choreology.com Cohesions(tm) Business transaction management software for application coordination Work: tony.fletcher@choreology.com Home: amfletcher@iee.org -----Original Message----- From: Ugo Corda [mailto:UCorda@SeeBeyond.com] Sent: 19 November 2003 21:37 To: Fletcher, Tony; public-ws-chor@w3.org Subject: RE: Security requirements Hi Tony, Assuming that our final CDL will be based on WSDL (which might be an incorrect assumption, given the fact that we currently have no stable spec), it's very likely that WSDL 2.0 will contain policy assertions including security-related ones. Would it still make sense, under that scenario, to replicate those security policies at the CDL level? Ugo -----Original Message----- From: public-ws-chor-request@w3.org [mailto:public-ws-chor-request@w3.org]On Behalf Of Fletcher, Tony Sent: Wednesday, November 19, 2003 1:14 PM To: public-ws-chor@w3.org Subject: Security requirements Dear Colleagues, On the teleconference last night I kind of agreed to kick the ball into play on drafting some security requirements. So here goes. It seems to me that the CDL can be declarative with regard to security. In other words it should support notation for flagging that certain security requirements have to be met at this point but can then rely on the 'stack' below the Choreography language layer to 'make it so'. It should be possible to flag that a certain policy applies from this point in the choreography until the choreography ends or another flag is encountered. Should be able to refer out to standard policy sets or state specific requirements explicitly. These should include ability to require: authentication of the partner and or the message content source that a secure audit log is made that a message is protected from change (integrity) that the contents of a message are hidden (confidentiality) that the sending of a message is non-repudiable that the receipt of a message is non-repudiable that the message or message exchange is protected against replay that the time of sending of a message is recorded that the time of receiving of a message is recorded that a time (/date) stamp is attached to a message when sent. I am sure I have missed various things, but I hope that will encourage others to add / correct / rephrase. Best Regards, Tony <http://www.choreology.com/> Tony Fletcher Technical Advisor Choreology Ltd. 68, Lombard Street, London EC3V 9L J UK Phone: +44 (0) 870 7390076 Mobile: +44 (0) 7801 948219 Fax: +44 (0) 870 7390077 Web: <http://www.choreology.com/> www.choreology.com Cohesions(tm) Business transaction management software for application coordination Work: tony.fletcher@choreology.com Home: amfletcher@iee.org
Attachments
- image/gif attachment: image002.gif
- image/gif attachment: 02-image002.gif
Received on Wednesday, 19 November 2003 16:55:05 UTC