
	Home > Ask the SOA Experts > Questions & Answers > How will WS-Security impact Web services deployments?

Ask The SOA Expert: Questions & Answers

EMAIL THIS

How will WS-Security impact Web services deployments?

EXPERT RESPONSE FROM: Kerry Champion

		Pose a Question

		Other SOA Categories

		Meet all SOA Experts
		Become an Expert for this site

Digg This!

StumbleUpon

Del.icio.us

QUESTION POSED ON: 14 January 2004
How will WS-Security impact Web services deployments?

WS-Security is the base security standard for Web services. It will have several major impacts:

1) Interoperability.

It will improve interoperability as it resolves some of the looseness found in SAML, XML Encryption and XML Signature by standardizing practices that previously had to be coordinated as conventions. However, it is far from a "solution" to the security interoperability challenges. WS-Security supports multiple authentication methods, it was four different styles of digital signature, and so on. It is very easy to end up with multiple endpoints all of whom are WS-Security compliant but which still do not interoperate.

The best way to address that challenge is to implement some middleware (an XML Firewall or security focused WSM product) that can bridge between endpoints that are using different security mechanisms. WS-Security will make it easier to implement and manage that sort of middleware but it won't remove the need for it.

2) Message oriented security

WS-Security is a big step in the general move away from pipe and perimeter oriented security (such as SSL and IP firewalls) and towards message oriented security.

Message oriented security is an approach that ensures the confidentiality and reliability of messages, even when neither endpoint fully controls the path the message will take or the intermediaries it will pass through. This is achieved through encryption and signature of the message itself, instead of simply encrypting and authenticating the transport pipe.

The move to a Web services world is driving the creation of sophisticated application level networks that have messages passing through multiple nodes with each node doing some specialized processing. Message oriented security is a key enabler of such application networks. Therefore any middleware infrastructure that supports such networks must support WS-Security to be effective long term.

Message oriented security also continues to add value even when the message is "at rest". Stored messages can have select fields encrypted and signed for protection and audibility.

3) Digital signature

WS-Security will drive much broader use of digital signatures. This has significant implications on the middleware used to build your Web services application network. It is not enough that you have infrastructure that can sign messages and validate signatures. You need infrastructure that addresses the two major challenges that have bedeviled cryptographic deployments. First it has to have excellent performance under heavy load. Second it must address the key management problem, how are the needed keys distributed, stored and updated.

Digg This!

StumbleUpon

Del.icio.us

RELATED CONTENT

	WS-Security (Web services security standards)
	The technology of Web Service Security
	Web 2.0 at the old ballgame
	SOA complicated by ESB proliferation
	BPEL4People and WS-HumanTask get reference implementation
	Liberty offers Web 2.0 open source security
	The case against WS-Security
	SOA governance, security concerns drive XACML interop
	New BizTalk Services rolling out
	Will acquisitions stifle SOA innovation?
	Burton: WS-* specs good, but SOA security needs more

Web services development

Java-based Abdera open source tools implement Atom services

Layer 7 secures Oracle ESB, protects SOA applications

Gomez adds new features through platform-wide upgrade

PowerBuilder 12 beta available

RAD Studio 2010 hits the shelves

Oracle brings Fusion Middleware into the modern age

Oracle Fusion Middleware 11g supports SCA, JavaServer Faces development

Investment site turns to Xignite, Amazon cloud computing to power portfolio tracker

SimpleDB shows promise

Yahoo says no deal

RELATED GLOSSARY TERMS

Terms from Whatis.com − the technology online dictionary

Web Services Trust Language (SearchSOA.com)

WS-Security (SearchSOA.com)

RELATED RESOURCES

2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems

Search Bitpipe.com for the latest white papers and business webcasts

Whatis.com, the online computer dictionary

Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.

Browse our Expert Advice
Operating Systems IT Management Networking Database	Security Servers and Storage Applications and Development Career Center

SOA Governance White Papers - BPM, EDA, IT Governance

SEARCH

TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.


TechTarget Corporate Web Site \| Media Kits \| Site Map All Rights Reserved, Copyright 2001 - 2009, TechTarget \| Read our Privacy Policy