OASIS Approves New Web Services Security Standards

Mar 28, 2007

The Organization for the Advancement of Structured Information Systems has approved WS-SecureConversation and WS-Trust as standards.

The Organization for the Advancement of Structured Information Systems has announced that its members have approved WS-SecureConversation version 1.3 and WS-Trust version 1.3 as OASIS Standards.

The specifications were developed by the OASIS WS-SX (Web Services Secure Exchange) Technical Committee and they define policies and extensions to WS-Security that enable the trusted exchange of multiple SOAP (Simple Object Access Protocol) messages.

WS-Trust provides methods for issuing, renewing and validating security tokens as well as establishing, detecting and brokering trust relationships, OASIS officials said. Meanwhile, WS-SecureConversation allows security contexts to be created and key material to be exchanged more efficiently, OASIS said.

Together the standards can improve the performance and security of exchanges.

"In order to secure communication between two parties, both must exchange security credentials," said Anne Thomas Manes, research director with the Burton Group, in a statement.

"Before that can take place though, each party needs to determine if they can 'trust' the asserted credentials of the other. Applications that communicate using the Web services framework (e.g., SOAP and WSDL) can use WS-Trust to obtain and exchange security credentials - either directly or through a trusted third party - and use WS-SecureConversation to establish and maintain an extended secure session."

Kelvin Lawrence of IBM, co-chair of the OASIS WS-SX Technical Committee, said, "WS-Trust builds upon WS-Security by introducing an XML syntax and a protocol that enables the issuance and dissemination of credentials between different trust domains via a security token service."

Meanwhile, Chris Kaler, a Microsoft engineer and co-chair of the WS-SX committee, said, "WS-Security focuses on the security of a single message, which is useful in many situations. WS-SecureConversation adds a security context authentication model that is extremely beneficial for long-running exchanges. When two parties are passing multiple rounds of secured messages back and forth, the added security and efficiency provided by WS-SecureConversation becomes essential."

Among the industry leaders, IBM, Microsoft and Sun Microsystems have verified successful implementations of WS-SecureConversation and WS-Trust in accordance with eligibility requirements for all OASIS Standards.

However, Adobe, AmberPoint, Axway, BEA Systems, BMC Software, CA, EDS, Forum Systems, Fujitsu, HP, IBM, IONA, Microsoft, Neustar, Nokia, Nortel, Novell, Oracle, Progress Software, Red Hat, Ricoh, SAP, SOA Software, Software AG, Sun Microsystems, Tibco Software, VeriSign, and other members of OASIS collaborated to develop WS-SecureConversation and WS-Trust, OASIS officials said.

Copyright 2007 by Ziff Davis Media, Distributed by United Press International

Explore further: Scientists twist radio beams to send data: Transmissions reach speeds of 32 gigabits per second

add to favorites email to friend print save as pdf

Related Stories

China demand to fuel Hong Kong iPhone grey market

13 hours ago

Wealthy mainland Chinese looking to buy the new iPhone 6 next week could expect to pay an eye-watering US$2,500 for the handsets in Hong Kong, following Apple's decision to delay the launch in China.

Netflix sets sights on European screens

13 hours ago

US online streaming giant Netflix will launch the second phase of its European expansion plan on Monday as it sets about seducing French viewers with a "House of Cards"-style drama set in Marseille.

MIT ATLAS robot demo shows advanced moves (w/ Video)

Sep 07, 2014

The bipedal robot ATLAS from MIT is moving on. Reacting to the recent video of "MIT Atlas truckin' with a truss," TechCrunch said, "We've seen the cute little guy walk, toddle, and climb over obstacles but ...

Recommended for you

Cutting congestion on the data network highway

Sep 12, 2014

Perhaps no other consumer-driven technology has made such incredible advances in such a relatively short space of time as the mobile phone. Today's smartphones are used to stream videos, access social media ...

T-Mobile to sell phones that call, text on Wi-Fi (Update)

Sep 10, 2014

T-Mobile will sell more than 100 smartphone models with a built-in feature that taps into Wi-Fi networks to make phone calls and send texts when customers can't connect to the wireless carrier's cellular network.

User comments : 0