Feeds

Vendors, users team to create secure XML

Spectre of proprietary MS rival casts shadow

  • alert
  • submit to reddit

Website security in corporate America

A group of 45 IT companies and enterprises has formed a group that aims to create a standard way to secure internet-based transactions that use XML (eXtensible Markup Language).

The AuthXML Working Group will develop a specification covering authentication and authorising information in XML which it will then submit to the World Wide Web Consortium (W3C).

The group includes security firms such at Check Point Software; networking vendors, such as Novell; consultancies like PricewaterhouseCoopers and end-users such as the Royal Bank of Scotland. However, the group is more interesting for who it does not include - most noticeably Microsoft, which has formed a group to develop a complementary technology.

The purpose of the AuthXML standard, which is built on XML and digital signature technology, is to provide an open framework that will allow applications and Web sites to trust security domains. However, the specification will make no provision for negotiation about trust between domains and realms or the inclusion of optional data, which will be handled separately.

The latter falls into an area which Microsoft and its partners WebMethods and VeriSign are working on through the XML key management specification (XKMS).
This is intended to make it easier for programmers to include digital signatures and encrypt data in e-commerce applications. So AuthXML will allow applications to trust domains and XKMS will embed the mechanism to do this in applications. Hmmmm.

We don't have particularly great expectations that these two technologies will dovetail neatly together. Open standards, particularly in the security arena, and Microsoft are unlikely bedfellows. Assurances that XKMS, which is already in use, "will be submitted to the appropriate Web standards bodies for consideration as an open internet standard" don't cut much ice in the face Microsoft's past history - particularly the way Redmond added proprietary extensions to Kerberos, an open standard for security originally developed by MIT.

XML can be expected to be the basis of data transmission amongst applications, and indeed services, over the Internet over the future so it's important a full, and fully open specification, comes out in the end. If Microsoft's assurances of openness don't pan out, and that remains an open question, the technology, as well as secure messages, could end up coming out scrambled. ®

Related Link

AuthXML home page

Choosing a cloud hosting partner with confidence

More from The Register

next story
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
Not appy with your Chromebook? Well now it can run Android apps
Google offers beta of tricky OS-inside-OS tech
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
NHS grows a NoSQL backbone and rips out its Oracle Spine
Open source? In the government? Ha ha! What, wait ...?
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Intel: Hey, enterprises, drop everything and DO HADOOP
Big Data analytics projected to run on more servers than any other app
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.