1. UNCLASSIFIED Service Oriented Architecture, Information Sharing and the FEA DRM 23 January 2006 Bryan Aucoin DNI CIO Chief Architect 703.874.8501 bryanja@odci.gov

2. UNCLASSIFIED 2 Everyone is Building Applications More or Less the Same Way… This varies somewhat among organizations. Provides the user interface Organizes the services available to a user in readily accessible way Manages presentation to the user of services. Implements Business Logic Performs data operations in accordance with data related business Logic Portal Web Server App Server Data Layer Browser

3. UNCLASSIFIED 3 At Each Tier of the Architecture, We Ask a Different Question What services does this person have access to? What functions within this service does this person have access to? Does this person (or service) have access to the requested business function? Is this person allowed to access the data needed by the function? Portal Web Server App Server Data Layer Browser

4. UNCLASSIFIED Web Browser Web Server App Server Directory Database There are multiple right ways to do this… …and therein lies the problem, because… Implementing a Typical Chain of Trust (I’m leaving out the portal for simplicity.)

5. UNCLASSIFIED 5 We’re Building a Web of Trust Web Browser Presentation Service Object Presentation Service Object Application Object Application Object Portal Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Presentation Service Object Database Application Object Application Object Application Object Application Object Application Object Application Object Application Object Application Object Application Object Application Object Application Object Application Object Application Object Application Object Database Directory

6. UNCLASSIFIED 6 Implications of a Web of Trust Standards compliance is necessary, but not sufficient. Objects at any Layer of the Architecture will not be sharable if we do not establish a common framework for management. Examples: –What identity does a Web Service pass to a Application Service? –What identity does a Application Service pass to a Database? –When do we use: Access managed by membership in groups within a Directory? Access managed by applications using attributes in a Directory and “policies”? Access managed by database roles? Java Messaging Protocols or Web Services Protocols?

7. UNCLASSIFIED 7 Today’s World Is built around network enclaves Enclaves contain entire application stack. The Internet is used as transport between enclaves. Enclaves are protected by a DMZ Portals, and an increasing number of services exposed through the enclave DMZs

8. UNCLASSIFIED 8 One Emerging View…... Shared Services Enclave(s) Service enclaves Shared Transport(s) Web & Web Service Interfaces Access managed at the enclave boundary Web & Web Service Interfaces Access managed at the enclave boundary Segregation of Services

9. UNCLASSIFIED 9 Basic Data Sharing Concepts in the FEA DRM: Services provisioned depends on the type of data being exchanged. Data Sharing Services Types: –Data Exchange –Data Access

10. UNCLASSIFIED 10 Basic Data Sharing Concepts: Provision Services for Data Types of Data Exchange Services: –Extract/Transform/Load –Publication –Entity/Relationship Extraction –Document Translation Types of Data Access Services –Context Awareness –Structural Awareness –Transactional Services –Data Query –Content Search and Discovery –Retrieval, Subscription and Notification

11. UNCLASSIFIED 11 Service Interface A Operation 1 Operation 2 Operation 3 …. Interface B Operation 1 Operation 2 Operation 3 …. Service Contract Implementation Business Logic Data Introduction of new data assets or migration of legacy data assets Data Access: Service Enabling Data Assets

12. UNCLASSIFIED 12 Data and Data Services Constructs Transactional DB Services Context Awareness Interface Service Contract Transactional DB Implementation Business Logic Data Structure Awareness Interface Transaction Interface Data Query Interface ETL Interface Publication Interface Context Awareness Interface Service Contract Authoring System Repository Implementation Business Logic Data Structure Awareness Interface Transaction Interface Search & Discovery Interface Retrieval Interface Subscription Interface Notification Interface Authoring System Repository Services ETL Interface Publication Interface Context Awareness Interface Service Contract Document Repository Implementation Business Logic Data Structure Awareness Interface Search & Discovery Interface Retrieval Interface Subscription Interface Notification Interface Document Repository Services E&R Extraction Interface Doc Translation Interface Analytical DB Services Context Awareness Interface Service Contract Analytical DB Implementation Business Logic Data Structure Awareness Interface Transaction Interface ETL Interface E&R Extraction Interface Data Query Interface Publication Interface

13. UNCLASSIFIED 13 Prospects Formalizing Services Definitions around the DRM Framework Vendor migration to “DRM Ready” products and services DRM Network Appliances?

14. UNCLASSIFIED 14 A Higher Level View the Evolution An Hypothesis for the Phases of Concept Adoption: Instantiation: New ideas Implementations Aggregation: Formation of Communities Codification & Reconciliation Establish Rule Sets Form Boundaries Assimilation Transition to Infrastructure No Governance Weak Governance Strong Governance

15. UNCLASSIFIED Questions?