I want a web service framework which is open source & free for commercial use, also security is a main concern too. Please suggest a web service framework for Java using SOA
I agree with the Spring-WS option. I've used it at various times and it quickly become my web service choice unless there are other factors that specifically rule it out.
Although this is slightly off topic, if you're in the planning stage I'd make the following recommendations.
Choose a topdown approach. Spring-WS definately supports this (it is the preferred method). That way if you make changes to the underlying code you won't need to worry about accidentally updating your WSDL. Also at design time you can consider the WSDL the interface point and not go through other elaborate documents as much.
Use JAXB to generate your request/response objects. This is much easier in the long run and definately helps to make sure that you are coding as required by your WSDL (quite a few times I looked at generated objects and saw that they didn't look right only to find out that I had modified the WSDL incorrectly).
Use annotations in your endpoints.
Those are the main points. Good luck :-).