latency, and potentially to allow propagation of broadcast or multicast protocols for synchronization. In on-premise computing, it is common to group PEPs on a single rack and integrate these through a switch allowing physical control over such a distribution. Cloud environments offer no such deployment specification. PEP instances may be geographically isolated, resulting in isolation by router boundaries or at a minimum multiple switch hops that will not propagate this traffic. Amazon, for example, abstracts their operating environment into coarse divisions they call availability zones. These roughly map to distinct data centers within an operating region; however, Amazon does not publically provide deeper architectural details of how these are organized.

PEPs thus need to operate independently and synchronize exclusively off shared persistent storage. Amazon was the first public cloud provider to create a range of persistence mechanisms as services, including Simple Storage Service (S3), SimpleDB, Elastic Block Storage (EBS), and Relational Database Service (RDS). As a continuum, they illustrate the spectrum of tradeoffs between scalability, reliability, availability, trustworthiness, and traditional versus cloud-centric architectural models. Issues to consider for PEPs are unpredictable latencies that may affect time-sensitive operations such as replay detection or policy synchronization. For example, the use of shared underlying infrastructure, such is the case with EBS, may provide highly nondeterministic performance. Similarly, the underlying data propagation realities that account for Amazon’s eventual consistency strategy may prove difficult to reconcile with the PEP need for high-performance access to a persistent store.

18.4.5  Acceleration Strategies

Optimization is always an exercise in balancing tradeoffs. In SOA PEPs, the computationally expensive operations are XML processing and basic cryptographic calculations. Appliance-based SOA PEPs use custom hardware to accelerate these that is not applicable in virtualized environments. An important design tradeoff is therefore to sacrifice low-level optimization for the overall gains realized through elastic scalability in cloud environments.

18.4.5.1  Accelerating Message Processing

Specialized hardware can accelerate low-level XML processing, including XSLT, XML Schema validation, and XPath query into documents [13, 26]. Similarly, regular expression parsing benefits from application in specialized hardware.

However, a new generation of software-based, highly optimized libraries is emerging. These include pure software approaches (Excentric Works), and optimization that utilizes the existing architecture in commodity chips [5].