IBM unveils industry's first software to provide secure web services

The new software, built on IBM's WebSphere software for managing high-volume business transactions and integrating key business applications, and IBM's Tivoli software, which enables the secure interaction of business applications, will support key industry standards for Web Services security, such as the WS-Security specification, which IBM co-authored.

"Companies in the Middle East no longer need to be confined to Web services inside the firewall, as they will now be able to develop Web Services applications that will facilitate secure transactions with partners in their supply chain, regardless of the Web services or security technologies used by other partners," said Bashar Kilani, Software Group Manager, IBM Middle East, North/West Africa. "Using open standards, we are simplifying business integration across federated company boundaries, allowing businesses to link thousands of their business partners together easily and securely, while reducing custom integration costs."

Specifically, IBM WebSphere Application Server Version 5 will support Web Services - Security in the fourth quarter and in IBM Tivoli Access Manager, early next year. This specification defines a standard set of Simple Object Access Protocol (SOAP) extensions that can be used to provide integrity and confidentiality in Web services applications.

IBM is developing the first comprehensive open-standards based Web services infrastructure that extends enterprise-class security capabilities to Web services deployments running on a variety of platforms. New features across the WebSphere and Tivoli software portfolio can help IBM customers automate the process of extending customer and partner-facing Web services applications to more organizations and users, helping reduce the reliance on proprietary technologies and costly manual integration.

IBM also plans to support new federated identity management capabilities in its WebSphere and Tivoli software to provide a way for Web services and enterprise applications to share identity information across multiple networks, helping businesses extend market reach by securely integrating with suppliers, partners and customers.

IBM Tivoli Access Manager will feature new federated identity management interfaces that enable customers to plug in support for identity standards. This next release, scheduled this month, will initially feature out-of-the box support for the XML Key Management Specification (XKMS). IBM plans to extend this capability to include support for various identity standards such as the Security Assertions Markup Language (SAML), Kerberos, XML Digital Signatures and other security tokens formats as they mature in standards organizations. Additionally, IBM will support secure token management, trust brokering, integrated identity mapping and credential mapping services.

New Web services trust broker software can allow organizations to automate the process of entering into trusted business relationships, regardless of the type of security mechanism used by the other company. IBM's intent is to support the broadest range of brokering methods such as Microsoft TrustBridge, Kerberos tokens, Public Key Infrastructure (PKI) credentials and other means of delegating trust that develop in the future. IBM plans to deliver this software in Tivoli and WebSphere software.

Additionally, IBM plans to provide fine-grained authorization for SOAP transactions in Web services environments. This new feature will allow businesses to control access to Web services applications based on a user's identity, and associated entitlements.