I want a web service framework which is open source & free for commercial use, also security is a main concern too. Please suggest a web service framework for Java using SOA
I'd suggest a JAX-WS implementation: JAX-WS RI (which is part of Metro) or Apache CXF. Both are very close from a runtime perspective but many people find that CXF has a better documentation (might be an important criteria). Both provide integration with Spring if this matters to you (actually, decent frameworks just can't ignore Spring so this is not a surprise).
Spring-WS is another option but is not JAX-WS compliant, supports only a contract-first approach (from XSD) - that's a philosophical choice - and doesn't support many WS-* standards (that you may not need though).
In any case, I'd stay away from Axis 2 and its horrible deployment architecture and packaging hell (the Axis 2 webapp itself is a container for web services which need to be packaged in specific archives). I find it totally counter productive. On top of that, it doesn't even perform really well.