Web Services Giants Propose Specifications For Security, Policy

By Mitch Wagner

Leading Web services vendors including Microsoft, IBM, and BEA Systems on Wednesday introduced a set of proposed standards for security and policy for Web services.

The companies, also including RSA Security, SAP AG and VeriSign, introduced six new specifications built on SOAP.

WS-Trust describes a framework for managing trust relationships between enterprises. WS-SecureConversation describes technology for setting the context for exchanging multiple messages without having to re-authenticate each time. WS-SecurityPolicy provides standards for setting security policies for services. These standards were authored by IBM, Microsoft, RSA, and VeriSign.

Additionally, WS-Policy sets specifications for senders and receivers of Web service to communicate requirements and capabilities to search for and discover information needed to access the service. WS-PolicyAttachment provides specifications for attaching requirement and capability statements to Web services, and WS-PolicyAssertions describes policies that can be affiliated with a service.

The standards are based on the Web Services Security roadmap that Microsoft and IBM developed last April to help enterprises share information securely.

Important specifications still being developed include WS-Federation, which provides means of describing the trust relationship between organizations, and WS-Privacy, which sets specifications for privacy policies, said Gerry Gebel, analyst with the Burton Group.

Sun Microsystems and Oracle were absent from development of the proposed specification. Gebel said the two vendors' absence will not prove significant in the long run.

"The way the authors are going about it, their plans are to submit to a standards organization where Sun, Oracle, Entrust and everyone who's now out of the picture can work on standardizing the specification in a more open and organized framework," Gebel said.