Feeds

MS, IBM propose SOAP security kit for Web services

Flexible, extensible, maybe even sensible?

  • alert
  • submit to reddit

The next step in data security

A team of researchers from Microsoft, IBM and VeriSign have put together a preliminary proposal for securing Web services with SOAP (Simple Object Access Protocol) extensions which will work with a variety of authentication and encryption schemes.

Called WS-Security (Web Services Security Language), the proposed specification is said to be a general-purpose kit for developing security mechanisms tailored to individual needs. (The authors clearly realize that such a kit does not in itself guarantee security, since it may be implemented well or poorly.)

The document provides a fairly solid list of problems along with examples of how they might be addressed with WSS. Some are better than others, and the team is soliciting criticism and suggestions from outside, though there doesn't appear to be a convenient link in the document to a contact person for the project.

The document shows considerable awareness of the technical pitfalls, and makes a decent argument that something along these lines is better than nothing. The goal, obviously, is to make Internet communications confidential, tamper-proof, and reliably authenticated. Insofar as that can be accomplished without making it a compulsory regime, or a de facto compulsory regime by virtue of the colossal marketing and communications might of the three companies involved, we're all in favor of it.

"WS-Security...is designed to be used as the basis for the construction of a wide variety of security models including PKI, Kerberos, and SSL. Specifically, WS-Security provides support for multiple security tokens, multiple trust domains, multiple signature formats, and multiple encryption technologies," the authors say.

That's a claim which needs to be examined closely. It's not difficult to imagine how a trio like this could promote each other's interests to the detriment of competitors with a scheme like WSS. On the other hand, if it really turns out as flexible as is claimed, then I can't really fault it unless it ultimately fails to live up to its technical goals.

One is naturally, and rightly, wary when heavyweight corporations join forces to issue a specification which could affect millions of users. But so long as WSS remains a contribution and not a mandate, and so long as it doesn't inhibit research into alternative approaches, and so long as it doesn't become chiefly a platform for triangular business promotion, there can be no harm in having another set of tools to choose from. It might even develop into something quite good -- you never know. ®

Security for virtualized datacentres

More from The Register

next story
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Mathematica hits the Web
Wolfram embraces the cloud, promies private cloud cut of its number-cruncher
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Mozilla shutters Labs, tells nobody it's been dead for five months
Staffer's blog reveals all as projects languish on GitHub
SUSE Linux owner Attachmate gobbled by Micro Focus for $2.3bn
Merger will lead to mainframe and COBOL powerhouse
iOS 8 Healthkit gets a bug SO Apple KILLS it. That's real healthcare!
Not fit for purpose on day of launch, says Cupertino
Profitless Twitter: We're looking to raise $1.5... yes, billion
We'll spend the dosh on transactions, biz stuff 'n' sh*t
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.