End-to-end security in service-oriented architecture