SOA PEPs, in contrast, consolidate and parameterize all of these capabilities under a policy that is bound to each individual service.

18.3.6  VPN-Based Solutions

In mid-2009, Amazon introduced its Virtual Private Cloud (VPC) offering as a solution to securely integrate EC2 with on-premise enterprise networks. VPC consists of a standards-based VPN server and an undisclosed mechanism for isolating EC2 instances to a specific customer domain. Other vendors, such as CohesiveFT, have promoted VPN solutions for securing communications to the cloud.

VPN-based solutions have the advantage of providing generalized confidentiality and integrity for all tunneled protocols. This has the distinct advantage of supporting virtually all communication protocols and therefore access to applications that are not service-oriented. But VPNs suffer from a lack of constraint with respect to service entitlements. VPNs secure networks, not applications. In environments with a significant trust imbalance – such as between on-premise IT and a cloud provider – VPNs can potentially offer an open vector for attack if a system hacker compromises a cloud-resident application or operating environment.

SOA PEPs put channel (or message) encryption subordinate to the entire execution context of policy, which can incorporate authentication, authorization, threat detection, optimized content validation, SLA enforcement, load distribution, and audit. Because policy is ultimately bound to individual services, this severely limits the attack surface available to compromised applications.

18.4  Challenges to Deploying PEPs in the Cloud

The NIST definition illustrates that cloud computing is characterized by five essential characteristics, including resource pooling and rapid elasticity. PEPs deployed into IaaS clouds face unique challenges around performance, security, and management because of the underlying architecture that supports these characteristics. The following sections examine these challenges.

18.4.1  Performance Challenges in the Cloud

The commoditization of processing cost in the cloud is attractive, but there are special considerations that go into making effective use of this. For PEPs deployed in IaaS facilities, these include fault tolerance, scalability, clustering, generalized acceleration, and content encoding.

18.4.2  Strategies for Fault Tolerance

SOA PEPs achieve fault tolerance through system redundancy; however, traditional methods for providing independent, high-availability failover may not function in the cloud. Failover techniques that make use of gratuitous ARP – such as Linux-HA – will certainly be restricted because of the risk of IP hijacking by an instance.

A better approach is to load balance incoming HTTP traffic across two or more PEPs using conventional HTTP application delivery controllers. This basic infrastructure is commonly available in cloud installations because it is the basic scaling strategy for conventional Web applications, which at present constitute the majority of cloud provider’s business. Load balancer failover makes more economic use of deployed resources than a running instance in standby as failover occurs with no interruption of service. This also provides the basis for a practical scalability model.

18.4.3  Strategies for Scalability

Elasticity is a basic characteristic of cloud computing, which offers an opportunity to better manage PEPs operating under traffic load that is unpredictable and in a continual state of flux. As load increases, new PEP instances can launch ondemand; as it decreases, underutilized instances can terminate (to use Amazon nomenclature). This offers a distinct advantage over on-premise SOA PEP deployments with fixed capacity.

As with fault tolerance, for HTTP-based transports, the existing HTTP load balancers can distribute traffic across the breadth of the running instances. Vendors such as Citrix have pioneered a model under which the HTTP load distribution system controls application instance launch. This should focus on PEP instances, which in turn control the launch of applications under their policy control, thus creating a cascade pattern of elasticity.

Elasticity, however, does introduce new challenges with provisioning of PEP instances on launch, and the potential for loss of critical state information on termination. Clustering is a strategy that addresses some of these issues.

18.4.4  Clustering

Clustering can overcome some provisioning and operational challenges when deploying multiple PEPs simultaneously. In addition to providing a means for sharing configuration and policy information between nodes, clustering offers a fast channel for synchronization of time-critical information such as shared counters or coordination against replay attacks exploiting the WS-Security model.

However, traditional application clustering technologies may not be deployable in cloud environments. Clustering assumes a locality of deployment to reduce