IBM Supports WS-Security Spec In Products

By Richard Karpinski, INW
iApplianceWeb
(09/26/02, 01:30:50 AM EDT)

San Jose, Ca. --- IBM Corp. has revealed more about how it will begin supporting the recently announced WS-Security specification -- which it helped co-author -- in products including its WebSphere application server and Tivoli management platform.

WS-Security provides a framework for securing Web services, from how to apply encryption and authentication technologies to how to ensure the integrity of Web services messages. The spec defines a series of SOAP extensions that add security features to the Web services protocol stack.

IBM's move represents one of the first implementations of this important new spec, which just recently was placed on a standards track at the OASIS group.

"IBM is liberating customers so they are no longer confined to Web services inside the firewall," said Arvind Krishna, vice president of security products, Tivoli Software.

Security concerns are often cited as one of the biggest barriers to Web services adoption. The core Web services protocols, such as SOAP, do not have built-in security mechanisms, so enterprises need a way to secure SOAP messages they'll be sending over open networks like the Internet. Only until security issues are settled will Web services move beyond corporate firewalls.

IBM said version 5 of its WebSphere application server will support WS-Security in the fourth quarter; Tivoli Access Manager will add support early next year.

In addition to basic Web services security, IBM will add features to enable federated identity management capabilities to its software products, which will make it possible for users to more flexibly consume Web services.

To that end, the next Tivoli release will include support for they XML Key Management Specification, or XKMS, as well as identity standards such as Security Assertions Markup Language, or SAML.

For more information, go to www.ibm.com.