Silicon Valley Web Guild

The Challenges and Future of Web ServicesMarch 12, 2003

What Are Web Services?

• Technical Definition: XML/SOAP Over HTTP for Application to Application Communication.

• Very Few People Work off the Technical Definition.

• Reality: Web Services Are Anything Over HTTP(s) E.G. ERP With a Web Interface Can Equal Web Service

Result:Web Services Give Us A World Without Boundaries.

Who Are the Players?

IDC Predicts Market Will Grow From $1.6 B in 2004 to $34 B by 2007.

SunONE / IPlanet

BEA Weblogic

Oracle 9iApplication

Server

Java 2Platform

EnterpriseEdition(J2EE)

IBMWebsphere

Microsoft.Net

22%

33%28%

7%6%

4%

Access to Information and Services by User ID … Not IP/URL Address.

Current Remote Access Technologies (VPN) Are Inadequate

Requires Full Proxy To Intercept All Requests and Analysis All Responses

Requires Comprehensive HTTP, HTML & XML Content Analysis

Requires Fully Integrated Content Networking

Requires Very High SSL Acceleration Performance

The Emerging Enterprise

Benefits of Web Services

• Location Is No Longer an Issue: Anywhere/Anytime Access.

• All Transactions Are Authenticated/Authorized.

• User of a Browser Instead of a Heavy-Weight Application on the Desktop.

Browser Based Applications Are No Longer the Domain of .Com “Toys”

The Challenges of Web Services

• Security and Performance

• Every Transaction Must Be Authenticated and Authorized.

• Every Transaction Must Be SSL Encrypted.

• Every Transaction Must Be Fast Enough for Interactive Use.

• Every Transaction Must Be “NATTED”.

What Then Is The Role Of The Firewall?

Firewalls Aren’t Going To Cut It

• Firewalls Are Primarily Network Level Only.

• Firewalls Do Not Provide Application Networking Security.

• Firewalls Cannot “NAT” Application Content.

• Application Content Can Allow Others To Map Your Network.

Firewalls Are No Longer Enough.

Where Are The Bad Guys?

A New Paradigm

• Proxies Will Be Crucial

• Proxies Must Be Well Positioned So All Application Access Can Be

Centrally Authenticated and Authorized.

• Proxies Must Handle SSL Traffic on Behalf of the Server.

• Proxies Must Provide Some Kind of HTTP Level NAT for Both HTML and Javascript.

Centralized AAA

ExtranetExtranet

Internet

Intranet

Handling SSL For The Server

Cipher TextTo TheClient

Clear TextTo TheServer

• The Server Is Your Revenue.

• SSL Is A Requirement To Do Business, But Not A Strategic Advantage.

• Proxies That Handle SSL On Your Server’s Behalf Keep The The Servers Focused On Making Money.

HTTP Level NAT

Application Data From Server Can Reveal Private Information

e.g. http://server.company.com/application/erp.asp?login=cxo&acct=12345&value=important

Proxies Should Protect The Server From Revealing Private Data

e.g. http://proxy.company.com/708790f9d1c84a1d2640e5af2515a699

The Future of Web Services

• SOAP/XML Will Be the Enabling Technology to Let Us “Webify” Applications.

• Web Browsers Will Become the De-facto Platform for Enterprise Applications.

• Homogeneous Application Networking Can Be Accomplished.

Web Services Will Succeed Not Because It Is “Cool”, But Because It Saves Money.