Slide 1

Policy Federation and SOA Governance Slide 2 Proprietary and Confidential Introducing: Miko Matsumura VP of Technology Standards, Infravio VP of Marketing, Infravio Chair of OASIS SOA Adoption Blueprints VP of SOA Product, webMethods Chief Java Evangelist, Sun Microsystems Software R&D at Hotwired Limited Partner, Focus Ventures Advisor, TogetherSoft, Asia Java Fund, Kendara, Dejima M.S. in Neuroscience from Yale University (Neural Networks research)Neural Networks MBA, San Francisco State University Slide 3 Proprietary and Confidential Who is Infravio? Infravio is The SOA Governance Company. Founded in 1999 Headquartered in Cupertino, CA Approx 20 people in the US Development in Chennai, India Approx 50 people in India X-Registry Platform 6 SOA Governance Registry Repository Platform Top rated SOA Governance platform (Infoworld Labs Review) One of the only vendors that looks at SOA lifecycle properly (MWDAdvisors) the state of the art in SOA today. (Loosely Coupled) Infravio is ahead of the competition with X-Registry. (Zapthink) Slide 4 Proprietary and Confidential Current Customers Telecommunications Sprint-Nextel British Telecom SwissCom NTT IONA MCI IPT Level3 SRA Government: Texas HHS Texas Legislative Council State of Minnesota DPS Government of Quebec National Academies Healthcare: Providence Health System Aventis Integris Finance/Insurance Allianz Life Defense Lockheed Martin JFCOM Travel Sabre Manufacturing Alcoa WW Grainger Slide 5 SOA Governance Slide 6 Proprietary and Confidential Interdependent ApplicationsInterdependent DepartmentsReuse Creates InterdependenceInterdependence can destroy agilityInterdependent Companies Virtual Enterprise Suppliers Outsource r Distributor s Big Customers Enterprise Subsidiary Mfg. Plant Sales Branch Data Center HR ERP Shipping Dept. Contact Center Purchasing Consumers Customers Suppliers How can you change anything when everything is tied together!? Slide 7 Proprietary and Confidential When everything is tied together Cant See whats happening in my SOA? Policies are not being enforced! Changing IT Systems is slow and error prone! Cant Manage SOA Policy Enforcement! Cant Find Services to reuse?? Cant Understand how to use these! Services dont work together! Cant Trust Services I dont control! Change Processes are a mess! Slide 8 Federated SOA Governance Slide 9 Proprietary and Confidential What is Service Oriented Architecture? Service Oriented Architecture is a paradigm for organizing and utilizing distributed capabilities that may be under the control of different ownership domains. It provides a uniform means to offer, discover, interact with and use capabilities to produce desired effects consistent with measurable preconditions and expectations. OASIS SOA Reference Model Technical Committee Slide 10 Proprietary and Confidential Why SOA Adoption Might be Good Central IT Benefits Consolidation Reuse Compliance Business Unit Benefits Agility and Flexibility Business Visibility Process Integration Shared Benefits Business/IT alignment Slide 11 Proprietary and Confidential SOA Benefits Statements Strategic Benefits KPI Improvements and/or ROI ROM Estimates Slide 12 Proprietary and Confidential More Groups Adopting Might be More Good Lifecycle Stakeholders Architects Developers Quality Assurance Provisioning and Deployment Administrators IT Operations staff Service Consumers Business Users Centralized vs. Distributed Stakeholders Central IT Business Units External Stakeholders Regulators Customers Suppliers Partners Slide 13 Proprietary and Confidential SOA Adoption Challenges Hoarding Lack of Trust Externally Imposed Rules Loss of Control Assigning Blame Compromises Distribution of Burden Distribution of Incentives Slide 14 Proprietary and Confidential SOA Governance What is Governance? Governance is the art and discipline of producing managed outcomes through structured relationships, procedures, and policies. What is unique about SOA Governance? SOA governance is half human, half machine The relationships, procedures and policies of SOA are defined by organizational processes These policies also in part described, enforced and automated by technology systems. Why is SOA Governance Important? SOA systems are highly interdependent Multiple ownership domains, multiple policy domains Each incident of Reuse creates additional dependencies Slide 15 Proprietary and Confidential Rearchitecting Silos at HMRC These will enable common shared business functions Unified customer identity management, case management and tax / benefit rules administration Common charge management, debt management based upon a single customer account Business process automation that allows work to be processed regardless of location Ready for cross-government shared services IT Capabilities Horizontal business capabilities Infrastructure and applications that can support new ways working Automation of Shared functions contact case liability compliance debt SA PAYECBVAT As-IsTo-Be NO MORE SILOS charge Automation per regime contact case liability compliance charge debt SA PAYECBVAT TO NO MORE SILOS Slide 16 Proprietary and Confidential decided Needs deciding Not addressed yet Physical Architecture View (EA) for 2011 - DRAFT Channel Components Identity Components Customer Relationship Management Components Customer Interaction & Orchestration Components Generic Application Components Regime Components BackOffice Components B2B External Portal Paper Telephony Identity Management Identity Management Registration Authentication Authorisation Identification Campaign Management Campaign Management Advisor Workflow Advisor Workflow Customer Contact Management Customer Contact Management Call Centre Application Call Centre Application Navigation, Data Entry&Supply Navigation, Data Entry&Supply Shared Workspace Shared Workspace Operational Reporting Operational Reporting Interactive Guidance Application Interactive Guidance Application Overall Transact. Orchestration Overall Transact. Orchestration Enterprise Content Management Enterprise Content Management Rules & Validation Processing Rules & Validation Processing Integration Change of Circumstances Change of Circumstances Comply In/Out Comply In/Out Contact In/Out Contact In/Out Collaboration Data Provisioning Data Provisioning Integrated Trust Accounting Integrated Trust Accounting Debt Management & Banking Debt Management & Banking Risk, Compliance, MIS, BPM CIS-X SAP MDM Government Gateway SAP Siebel Pega CIS-x Tivoli/CA/etc Government Gateway SAP Siebel Pega CIS-x Tivoli/CA/etc Government Gateway SAP Siebel Pega Internal Portal Front Office PAYE Core NI Core PAYE/NI specific MIS PAYE/NI specific MIS PAYE/NI Work Management PAYE/NI Work Management SA Core Work Management PAYE/NI SA Shared Personal Tax Core PayAsYouEarn / National InsuranceSelf Assessment Tax calculation Maintain Tax/Allow& Deductions Maintain Tax/Allow& Deductions CT Core Middle Office Corporation Tax NIRS Bespoke Application NIRS Bespoke Application Business Objects Back Office PEGA Rules NIRS Bespoke Application NIRS Bespoke Application NIRS Bespoke Application Frontiers VAT National Tax Credits Application Processing Application Processing Entitlements & Awards Calculation Entitlements & Awards Calculation Single Financial Account Single Financial Account Receipts and Payments Receipts and Payments Finance Procurements HR Estates & Others Integration ESB Integration ESB External Gateways External Gateways SAP Internal Integration SAP Internal Integration Netweaver XI Extract Transform Load Extract Transform Load Informatica, Oracle Streams Internal File Transfer Internal File Transfer Transfer Manager Duty Deferment Excise Others Stamp Duty Calculate Duty Calculate Duty Process Return Calculate Penalty/Interest Risk Assessment MIS BPM CT Work- management CT Work- management VAT mainframe VAT mainframe Government Gateway SAP Siebel Pega Slide 17 Proprietary and Confidential Managed Outcomes Step One: Establish top level goals and outcomes Measurable goals Metrics Reporting and Auditing Step Two: Establish policies and contracts Accountability, adjudication, responsibilities Interoperability Standards Service Lifecycle Processes Security Policies Step Three: Build the Foundation Assign ownerships, budgets and responsibilities Develop Organizational Tools (CoE, chargebacks, shared services org) Establish federated systems of record for policies, contracts and services Automate governance processes Slide 18 Proprietary and Confidential SOA Governance Foundation Slide 19 INFRAVIO X-Registry Platform Slide 20 Proprietary and Confidential What is it? Registry and Repository System of Record Federated UDDI and ebXML Cross-Lifecycle Governance Auditing Multi-Tenancy Access Controlled Managed Lifecycle Processes Federated Lifecycle Promotion Portal-based UI for external/internal access Design Time Governance Automated Artifact Validation Robust classification, attributes, service profiles Run Time Governance Interoperability with disparate run time intermediaries BAM and Monitoring Change Time Governance Impact Analysis Change Notification Slide 21 Proprietary and Confidential X-Registry Platform Slide 22 Proprietary and Confidential Metadata Lifecycle Ecosystem ESB/ WSM/ Broker Portal Business Process/ Contracts Source Asset Repository Enterprise System Console UDDI Registry Design TimeRun TimeChange Time Access Control Policies Lifecycle Governance Rules and Processes Security Policies SOA Information Model and Metadata Repository Lifecycle Stage Organization Ecosystem Component Metadata Governance Mechanisms Slide 23 Proprietary and Confidential Access Control Policies Lifecycle Governance Rules and Processes Security Policies SOA Information Model and Metadata Repository Multiple Groups, Same SOA Data Slide 24 Proprietary and Confidential Federated Multi-Organization View Slide 25 Proprietary and Confidential Governance Lifecycle Slide 26 Proprietary and Confidential Design Time Governance Service Developer Role Service Discovery Features Service Description Profiles Browse by taxonomy Advanced attribute-based search Supports Vertical Taxonomies (e.g. eTOM, etc.) Service Publishing Process Wizard-based publishing process Content Validation (e.g. UDDI, WS-I conformance) IDE integrated UDDI publish option Workflow-driven approval/notification Platform Extensibility Governance API JAXR Java API for XML Registries UDDI version 3 ebXML version 2 JSR Compliant Governance Rules Engine Custom content validation callout Slide 27 Proprietary and Confidential Run Time Governance IT Operations Role Service Provisioning and Access Service Level Agreements Approvals and Rejections Limited access to services w/o approval Service request lists Consumer data collection Runtime Contract/Policy Enforcement SLA Management Service Delivery Contracts Consumer Authentication Run Time Version Management Security Management (WS-Sec, etc) Request/Response Routing Management Failover/LoadBalancing Routing Management Logging and Monitoring Management Slide 28 Proprietary and Confidential Change Time Governance Business User Role Business Activity Monitoring Report Generation Capabilities Performance metrics integrated with repository Runtime metrics warehousing SLA Performance measurement Email Performance/SLA Alerts Service Change Governance Service Change Subscription (expression of interest) Service Binding Subscription Service Metadata Subscription Email Change Notification SOAP Notification Synchronous/Asynchronous Notification Service relationship and dependency management Impact Analysis Change Time version management (deprecation, migration, expiry, etc.) Slide 29 Proprietary and Confidential X-Registry Policy Enforcement X-Registry X-Broker or External PolicyAuthoring PolicyEnforcement Slide 30 Proprietary and Confidential Infravio Service Delivery Contract Contract Terms: Security Terms (e.g. Authentication, Authorization, Encryption ) Operational Terms (e.g. Logging, Monitoring, SLA, Alerting, Reporting, Routing) Routing Terms (e.g. Load Balancing, Fail-over, content based routing) Lifecycle Terms (e.g. Versioning, Deprecation Rules) Business Terms (e.g. Billing and Metering, Business Activity Monitoring) Data terms (e.g Transformations, Caching) Reliable Delivery Terms (e.g. Messaging, Transport Protocol, Transactions Integrity) Custom Terms (i.e. user defined terms) Contract A Delivery Security Transformation Transaction Versioning Transport Routing Operations SLA Alerts Notifications Contract B Operations Delivery Contract C Delivery Operations Provider System Services Bank of America Comcast American Airlines Slide 31 Proprietary and Confidential Federation Example: Promotion of a service from a staging instance to production Technical Synchronization Governance Automation Access Control Delegated Authority Models Business Distributed Policy Authoring Policy Reconciliation Slide 32 Proprietary and Confidential Award Winning INFRAVIO X-Registry Platform 5 Slide 33 SOA Maturity and Governance Slide 34 Proprietary and Confidential SOA Scope vs Governance Where are you now? Business Objectives Architecture & Technologies Governance & with IT Process What do you want to be? Vision How will you get there? Pragmatic Plan for Evolution SOA Scope & Benefits Governance & Maturity Slide 35 Proprietary and Confidential Adopting Service-Oriented Architecture: Business and IT Drivers Call center integration Single face to clients, suppliers, employees Process integration Real-time B2B "Doing more with less" Business/IT alignment Data consistency/quality Time to deployment "Top Down" Enterprise Drivers "Bottom Up" Business Unit Drivers "Perennial" IT Challenges SOA M&A/divestitures Multichannel sales/support Time to market Continuous innovation Process flexibility Process visibility Slide 36 Proprietary and Confidential SOA Adoption: Benefits and Implications Incremental Deployment Gradual migration Cost "spreading" across projects Reduced maintenance cost Sharing (Reuse) of Services: Faster time to deployment Lower development cost Greater adaptability Architectural Partitioning Diverse life-cycle "speeds" Synergy of different technologies Optimal tech skills allocation Processes visibility Greater maintainability Easier outsourcing/"offshoring" Benefits More Distributed Infrastructure Extensive use of middleware Transaction management Debugging/troubleshooting End-to-end management More granular security Metering/logging Tighter Management/Governance Ownership/accountability Cost allocation Prioritization/conflict resolution Higher Upfront Costs Cultural change Infrastructure (SOA backplane) More formal methodology Longer design time for services Testing (unit/end-to-end) Implication Slide 37 Proprietary and Confidential Stages of SOA Adoption Stage 1 Introduction Stage 2 Spreading Stage 3 Exploitation Stage 4 Plateau IT Goals Proof of Concept Establish Technology Platform Leverage Services Sharing Enterprise SOA Infrastructure Business Goals Address Specific Pain (e.g., Customer Portal) Process Integration (e.g., B2B) Process Flexibility (e.g., Time to Market) Continuous Adaptation & Evolution Single Application Multiple Applications (Single BU) Multiple Applications (Cross BUs) Virtual Enterprise Scope 500 50 1,000,000 100 # of Published Services* # of Service Consumers* Total Service Calls/Day* # of Service Developers* Enabling Technology (cumulative) Application Server, Portal, Adapters ESB, WSM Integr. Suite, B2B SOA Reg/Rep BPM Policy Mgmt Enterprise SOA Backplane * =These figures represent typical scenarios, but they may vary considerably depending on the specific organizations requirements. Slide 38 Proprietary and Confidential SOA Adoption: Required Management Buy-In per Stage Stage 1 Introduction Stage 2 Spreading Stage 3 Exploitation Stage 4 Plateau Head of Development or Head of Integration CTO/Head of Architecture Head of IT Operations CIO/Business Units = Imperative = Recommended CEO Slide 39 Proprietary and Confidential SOA Adoption: Required Technology Skills per Stage Stage 1 Introduction Stage 2 Spreading Stage 3 Exploitation Stage 4 Plateau Basic Middleware Web Services Integration Middleware Business Process Management Service Oriented Development of Applications (SODA) = Imperative = Recommended SOA Operations Management Slide 40 Proprietary and Confidential SOA Adoption: Required Capabilities per Stage Stage 1 Introduction Stage 2 Spreading Stage 3 Exploitation Stage 4 Plateau SOA Center of Execellence Services Life Cycle Mangement Service Design Methodology Planning Control and Quality Management Service Reuse Methodology = Imperative = Recommended Domains Cost Allocation Schema Consistent Enterprise-wide Governance Processes Enterprise-wide SOA Backplane Operation Management Slide 41 Trusted Operations Fabric Slide 42 Proprietary and Confidential INFRAVIO X-Registry Platform Burton Group SOA Reference Architecture Policy Repositories Metadata Repositories Service registry Service platform Service platform Service Middleware Web Services Framework Standards Service management AccelerationRoutingTransformSecurityOther Service mediation systems SOA Link INFRAVIO X-Registry X-Broker and SOA Link Partners Slide 43 Proprietary and Confidential Intermediary Can Load Balance Service B Consumer CConsumer BConsumer DConsumer AConsumer E Service AService C Intermediary Consumers and Services are now loosely coupled Slide 44 Proprietary and Confidential Customize Service Delivery Service B Consumer CConsumer BConsumer DConsumer AConsumer E Service A Service C Intermediary Based on Capabilities, Limitations and Preferences of Consumers !? $ * + Contract Slide 45 Proprietary and Confidential Feed Operational Consoles Service B Consumer CConsumer BConsumer DConsumer AConsumer E Service AService C Intermediary Slide 46 Proprietary and Confidential Assure Service Level Agreements Service B Consumer CConsumer BConsumer DConsumer AConsumer E Service AService C Intermediary Higher priority Consumers get preferred access Slide 47 Proprietary and Confidential Enforce Security Terms Service B Consumer CConsumer BConsumer DConsumer AConsumer E Service AService C Intermediary Intermediary can enforce security and compliance Slide 48 Proprietary and Confidential Policies Enforced by Intermediary Sprint Trouble Ticket Service Intermediary Contract A Delivery Security Transformation Transaction Versioning Transport Routing Operations SLA Alerts Notifications Bank of America Comcast American Airlines Authenticate Engage Contract Access Service Slide 49 Proprietary and Confidential Security & Access Control Who Controls Metadata Controls SOA. The Registry Repository allows the fastest changing elements of IT infrastructure to be externalized as metadata Contract AContract Delivery Security Transformation Transaction Versioning Transport Routing Operations SLA Alerts Notifications Contracts (Operational Configurations) Process Flows Governance Rules Slide 50 Case Study: Sprint Nextel Slide 51 Proprietary and Confidential Sprints Problems Managing Services No organized Web Services offering point for internal / external consumers No Library / Catalog of deployed web services Not easily discoverable No Description Information available No Governance or Compliancy measures No Utilization or Activity measurements No Deployment Control No End-to-End view of integrated services How do we respond to employee / customer demands for self-service access? On-ramping new consumers takes WAY too long; they need information NOW No way to Version services How can we have the business be connected to our end consumer and services? Slide 52 Proprietary and Confidential Slide 53 Telecom Web Services Summary List of Repair Tickets Summary List of Bills Summary List of Invoices View Contract Information List of Available Local Services List of Local Services on an Account Long Distance Telephone Info on a Line List of Directory Listings for an Account Unified Customer View Matching Service Switched Toll Free Order / Maintenance Install Customer & Maintenance List of Associated Telephone Numbers on an Account Validated Account Code Toll Free Reservation Data User and Account Security Etc. etc. etc. Cellular Services Long Distance Ordering Local Services Report Order View Billing Report Pay View Account Maintenance Report Update View Service Assurance (Repair) Report Enter ticket View Dispatch Report Dispatch View Slide 54 Proprietary and Confidential Transition from EDI to Portal to SOA SOA project initiated by portal group Slide 55 Proprietary and Confidential eBonding Customer Demand (24 Retail Customers polled in January 2005 regarding significance of web service integrations / ebonding) Slide 56 Proprietary and Confidential eBonding Problem: 3000+ Hour Customer Integrations Sprint Customer I would like our new sales employees to automatically get a calling card. I need an SLA of 600msec and X.509 certification. Sprint Manager Please hold on, I have to write a business plan to justify this integration project to submit to Finance. Sprint Finance I need to build an ROI model so I can rationalize spending development resources on this integration. Sprint Developer Thanks for the requirements document. I need to write a specification for this implementation. Sprint Architecture Please wait while we validate your specification according to the Sprint architecture Sprint Quality Assurance Before you write a line of code, we will need to build a test plan to verify your code. Sprint IT Operations Since we dont know whos using the service, we need to provision a separate bank of servers for each customer. Slide 57 Proprietary and Confidential Contract B Operations Delivery Contract B Operations Delivery Service Delivery Contract Enforced by X-Broker Sprint Trouble Ticket Service X-Broker Contract A Delivery Security Transformation Transaction Versioning Transport Routing Operations SLA Alerts Notifications Bank of America Comcast American Airlines One service, many customers, many contracts. Each set of consumption preferences gets a separate contract. Slide 58 Proprietary and Confidential Contract Manager Configuration of Consumption Policies and Patterns Contract Terms: Security Terms (e.g. Authentication, Authorization, Encryption ) Operational Terms (e.g. Logging, Monitoring, SLA, Alerting, Reporting, Routing) Routing Terms (e.g. Load Balancing, Fail-over, content based routing) Lifecycle Terms (e.g. Versioning, Deprecation Rules) Business Terms (e.g. Billing and Metering, Costs, Business Activity Monitoring) Data terms (e.g Transformations, Caching) Reliable Delivery Terms (e.g. Messaging, Transport Protocol, Transactions Integrity) Custom Terms (i.e. user defined terms) Contract A Delivery Security A Transform A Transaction A Version A Transport A Routing A Operations SLA A Alerts A Notification A Contract BContract C Sprint Trouble Ticket Service Bank of America Comcast American Airlines Sprint Manager Delivery Security B Transform B Transaction B Version B Transport B Routing B Operations SLA B Alerts B Notification B Delivery Security C Transform C Transaction C Version C Transport C Routing C Operations SLA C Alerts C Notification C Slide 59 Proprietary and Confidential After Infravio: 160 Hour Integrations 95% Cost Reduction to Onramping Up to 20x faster Customized service delivery Integration can take as little as 45 min Sprint Customer Explanation Sprint Manager Configuration Slide 60 Proprietary and Confidential 95% Reduction in Cost Over Portal Based Integration ~20x improvement in speed of Customer On-ramping Payback within 6 months After 2 successful customer integrations Benefits Slide 61 Proprietary and Confidential Conclusion, Q&A