Supercharging SOA

Computerworld - Anyone who lingers long enough in computing begins to develop an overwhelming feeling of deja vu. Technology may march on, but it does so with echoes of past insights and prior successes. Certainly, this makes it easier to master new technologies, but savvy IT professionals also recognize that they can often predict how a technology will evolve by searching for its parallels in the past.

Service-oriented architectures (SOA) and Web services are ripe for such technical augury. They are built with the understanding that the Web is the most scalable and flexible distributed application ever devised. We can reuse what worked well -- loose coupling, transparent protocols, server infrastructure -- in the broader world of application-oriented networking. But a more subtle analysis will uncover patterns in how Web infrastructure evolved that should inform the architecture of modern application networks.

Performance was the big challenge during the early days of the Web. Web sites appeared, traffic volumes spiked and Web sites crashed. Although this is not much of a problem today, there will always be database bottlenecks and badly designed applications. But we have the technology and experience to address them.

History repeats, and performance is now a challenge for SOA. Today's issues are more complex, but the Web offers lessons in how we might approach these problems.

Performance bottlenecks in Web services arise from message processing. The act of marshaling and unmarshaling between verbose XML messages and object space is certainly a factor. But more significant is the overhead caused by document navigation and transformation. This is at its worst when security is involved -- a challenge that's the bane of streaming parsers everywhere. Sometimes it seems that the Web services security standards are designed expressly to degrade performance, much like the story of the QWERTY keyboard layout serving to limit typing speed so the type bars wouldn't jam (a story that is, by the way, apocryphal).

SOA performance will continue to degrade as new standards arise that add complexity to the already arcane discipline of message processing. The extensible header model that defines Simple Object Access Protocol (SOAP) is great, but it may also be its undoing -- message standards trend to disorder, never to unity and simplicity.

One such emerging trouble area is schema validation. This is critical for threat detection; however, most developers disable it on application servers because of the computational expense. But schema validation doesn't disappear -- it just moves down the stack. There is always implicit validation as messages are interpreted. It just delays recognition of a problem to the point where errors become much more costly.