Subject: [NEXTEL-1] Web security standards no easy task

From: Marcel <[email-masked]>
Date: Wed, 12 Mar 2003 03:35:29 -0500

Web security standards no easy task

BY Paul Korzeniowski
March 10, 2003

Computing technology has moved in waves, starting with
mainframes, moving to PCs and client/server models and then to
the Web. With each of these transitions came a need to rewrite
underlying security protocols so they can operate in new
environments.

With Extensible Markup Language serving as the foundation for the next wave — collectively

referred to as Web services — there comes the requirement to add security functions to the

markup language. Because this new computing paradigm focuses on the complex interplay of
hardware, software and networking, a number of standards groups are involved in the
process,
including the Internet Engineering Task Force (IETF), the World Wide Web Consortium
(W3C) and the Organization for the Advancement of Structured Information Standards
(OASIS).

These groups have devised more than a dozen security protocols that will play a role in
delivering Web services. Here are brief descriptions of the specifications, the roles they
will play
in electronic transactions and the groups responsible for them.

From OASIS:

* Security Assertion Markup Language helps users and computers authenticate and authorize
information exchanges.

* Extensible Access Control Markup Language is a specification for expressing policies for

information access.

* Service Provisioning Markup Language defines how to exchange user, resource and service
provisioning information.

* Web Services Security adds XML security protocols to Simple Object Access Protocol.

* Extensible Rights Markup Language manages copyrights for digital content.

* XML Common Biometric Format defines an XML version of the Common Biometric
Exchange File Format.

From W3C:

* XML Digital Signature provides integrity, signature assurance and nonrepudiation of
various
transactions.

* XML Encryption encrypts and decrypts digital content.

* XML Key Management Specification provides a method for obtaining cryptographic keys.

From IETF:

* Transport Layer Security builds on Secure Sockets Layer to secure Internet traffic
between
two points.

* Simple Authentication and Security Layer adds authentication to connection-based
protocols.

* Kerberos provides tickets for authenticating users.

* Blocks Extensible Exchange Protocol helps establish quality of service over the
Internet.

--
"NEXTEL-1 IT'S NOT JUST NEXTEL"
Note The New address
Subscribe to Nextel-1: http://www.groups.yahoo.com/subscribe/NEXTEL-1

"NEXTEL2 FOR iDEN SOFTWARE DEVELOPERS"
Subscribe to Nextel2: http://www.groups.yahoo.com/subscribe/NEXTEL2

"WIRELESS FORUM HOMELAND SECURITY GROUP"
The Complete Resource for Wireless Homeland Security.
Subscribe to WFHSG:  http://www.groups.yahoo.com/subscribe/WFHSG

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/