IBM, Microsoft and VeriSign today published a Web services security specification they hope will fill what has become the most glaring hole in the nascent technology.
Making the announcement at Microsoft's annual Tech Ed conference, the three companies said the specification called WS-Security outlines how to integrate disparate security systems such as Kerberos or Public Key Infrastructure using a set of extensions to the Simple Object Access Protocol (SOAP). The initial specification includes two base extensions and the trio plans to develop six others.
In essence, WS-Security will allow Web services to pass secure and signed messages, a process that today requires a patchwork of proprietary technology.
Web services are a collection of standard protocols based on XML that can be used to integrate disparate applications and back-end systems.
"What SOAP did for Web services two years ago is the same thing this specification will do for Web services security," says Bob Sutor, director for e-business standards strategy at IBM. SOAP, a standard for transporting XML documents, has become a cornerstone of Web services protocols.
"This goes a long way toward solving security. It's a set of components so you can build the level of security that you need."
This is the third time a security specification for Web services has been proposed. In January of 2001 IBM and Microsoft submitted for discussion a recommendation called SOAP Security to the World Wide Web consortium. In October, Microsoft as part of an effort called Global XML Web Services Architecture (GXA), announced it was working on four XML protocols, including one called WS-Security.
This most current work is the culmination of the previous efforts, according to Microsoft officials.
This time the specification, jointly authored by the trio of vendors, will be formally submitted to a yet-to-be-determined standards body following a public review period of up to four months. WS-Security is made up of two base extensions - encryption and message integrity, which can flag a SOAP message that has been altered during transport.
The trio also proposed a roadmap for the evolution of Web services security, called "Security in a Web Services World" that details six other security extensions built on the WS-Security foundation for such functions as expressing security policies, trust relationships, federation and authorization.
All three companies, which published the specification on their Web sites today, say WS-Security is the missing link that will let companies securely use Web services outside a firewall. Security has become the Achilles' heel to adoption of Web services for use in business-to-business electronic commerce.
But security isn't the only issue to be solved. Standards also are needed for reliable and asynchronous messaging, business-process workflow, and transactional integrity.
But security is the first step in delivering the other standards, the companies say.
The publication of the security specification follows on the heels of IBM and Microsoft's recent creation of the Web Services Interoperability Organization (WS-I), which is charged with promoting interoperable implementations of Web services protocols. The group is scheduled to hold its first meeting next week.
"We will try to get the WS-I to add WS-Security to its agenda," says Steven VanRoekel, director of Web services marketing for Microsoft.
The trio also hopes to garner support from other leading vendors, including Sun Microsystems, Oracle and BEA Systems. Those vendors along with IBM, Microsoft and VeriSign are already partners in VeriSign's Digital Trust Services Framework for building trust Web services, which was announced in February.
"Hopefully this will be the first real specification to plug into that framework," says Marcie Verdin, director of enterprise marketing for VeriSign.
Verdin hopes the six extensions proposed in the Web services roadmap also will fit under that umbrella.
Those extensions are:
"The entire program of extensions will take 12 to 18 months to get standardized specs," says IBM's Sutor. "We will start to roll our drafts of those specifications over the next couple of months. IBM plans to support WS-Security in its Web Services Toolkit that will go up on its AlphaWorks Web site this week. Microsoft is adding support into the Web services tools it makes available on its Microsoft Developer Network, and VeriSign plans to add WS-Security tools to its XML TrustCenter Web site.
RELATED LINKS
Contact Senior Editor John Fontana
Other recent articles by Fontana
Error 404--Not Found |
From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:10.4.5 404 Not FoundThe server has not found anything matching the Request-URI. No indication is given of whether the condition is temporary or permanent. If the server does not wish to make this information available to the client, the status code 403 (Forbidden) can be used instead. The 410 (Gone) status code SHOULD be used if the server knows, through some internally configurable mechanism, that an old resource is permanently unavailable and has no forwarding address. |
Apply for your free subscription to Network World. Click here. Or get Network World delivered in PDF each week.
Request a reprint or permission to use this article.
