MS, IBM, Verisign team on Web services security

Microsoft Corp., IBM Corp. and Verisign Inc. have devised a way to add integrity- and confidentiality-checking capabilities to upcoming Web-services applications, a first step in a broader joint effort to secure Web services, the companies said Thursday.

The jointly developed specification, dubbed WS-Security, defines a set of SOAP (Simple Object Access Protocol) extensions and describes how to exchange secure and signed messages in a Web-services environment, providing a foundation for Web-services security, Microsoft, IBM and Verisign said in a joint statement.

Web services are software applications or components linked together over the Internet using a standards-based approach. SOAP, itself based on XML (Extensible Markup Language), is one of the protocols enabling this. Web services as part of business-software applications could, for example, allow a PC vendor to link its order-entry application to a supplier's system.

Microsoft, of Redmond, Washington, IBM, of Armonk, New York, and Verisign, of Mountain View, California, said the WS-Security specification will be submitted to a standards body. No submission plan or date was provided.

Security is important for Web services to gain credibility, and the three vendors driving the initiative form the right group size, said Rob Hailstone, research director with analyst firm IDC.

"(Security) is a very obvious next step needed for Web services to get credibility. The fact that the standards are being created by three vendors working in collaboration, vendors that have competitive stances in some markets, is good," he said. "The next bid is to see whether the proposed standards are acceptable or not."

In addition to the WS-Security specification, Microsoft and IBM said they plan to develop a range of security specifications for Web services together with key customers, partners and standards organizations such as the World Wide Web Consortium (W3C) and the Internet Engineering Task Force.

Six of the other proposed specifications are WS-Policy, WS-Trust, WS-Privacy, WS-Secure Conversation, WS-Federation and WS-Authorization. These proposed specifications can be grouped in two categories, with the first three dealing with defining security policies, establishing trust relationships and implementing privacy policies, and the last three handling the sending and receiving of messages sent between Web services.

Microsoft, IBM and Verisign, after gaining an official stamp from a standards body, expect implementations from multiple vendors. The Web-services security model should enable businesses to develop secure and interoperable Web services, the three companies said.

Businesses don't need to wait for the new specifications to become standards before starting to use Web services, according to Charles Homs, a senior analyst with Forrester Research BV.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine