Protecting information through XML messaging and business portals

Protecting information through XML messaging and business portals

We are looking to send an XML message on a B2B basis. We want the client, Mr. X, to send a request for data to Company Y, via business portal Z. Part of the XML request will contain a username and password relating to Company Y. In order for business portal Z to forward the request they will need to decrypt the request. Unfortunately this means that they will be able to view the username and password. Is there a way to protect the username/password so that the business portal Z cannot view it but Company Y can?

    Requires Free Membership to View

    Login

    When you register, you'll begin receiving targeted emails from my team of award-winning writers. Our goal is to keep you informed on the hottest data and information management trends today.

    Hannah Smalltree, Editorial Director

    By submitting your registration information to SearchDataManagement.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchDataManagement.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

In your case, since Client X and Company Y do not have a direct trust relationship established, but that both X & Y trust Z as an independent third party to forward the Data. It would be better if Portal Z can provide a Digital Signature to Both X and Y, which allows them both to authenticate users without a formal agreement between them. This means you do not need to provide any username or passwords in your XML messages as the authentication will be done using Digital Signatures.

Also,since you are already using XML, considering incorporation of SAML (Security Assertion Markup Langauge) would help resolve most of your security issues.SAML allows companies to exchange authentication, authorization, and profile information securely regardless of platform. The idea of using SAML is to provide a common language for security between companies in B2B and B2C business transactions.

For more Information on SAML, you can refer following links.

http://xml.coverpages.org/saml.html

http://www.netegrity.com/products/index.cfm?leveltwo=SAML

http://www.oasis-open.org/committees/security/

This was first published in March 2002