InformationWeek.com

Welcome Guest. | Log In| Register | Membership Benefits

January 18, 1999

TechView:
PKEnable: A Pitch For E-Security

wo million, seven hundred thousand dollars. For a baseball. And it could have just as easily been an electronic bid as one made over the phone.

I'm talking, of course, about the auction sale of the ball that Mark McGwire hit for his 70th home run. During the Guernsey's Baseballs of 1998 auction in New York last week, bids were accepted from eBay, the online auction Web site.

Transactions like that don't happen every day--at least not yet. But even more mundane types of high-value electronic commerce can't happen without one key technology issue being resolved: making it as easy to identify buyer and seller as it is in the real world. Before you can make your $2.7 million purchase on the Web, you're going to have to show some ID, please.

Sure, public key infrastructure and certificates provide the ID. Baltimore Technologies, Entrust, VeriSign, and others are out there lined up to provide PKI-based certificates. The problem is integrating those certificates with the security models used by the applications that make the rest of business-to-business E-commerce and supply-chain management possible--such as enterprise resource planning applications and document-management systems.

Building your own software to take care of the handshake is, well, nuts. How many programmers do you have on staff that are proficient enough to write both SAP R/3 Business API code and Entrust API code? How many programmers do you have that know either? And how much do you suppose you'll have to pay a consultant to do the work?

The need for some sort of middleware to handle the interface between these applications and PKI-based Web applications was obvious enough to some followers of the security business that they got together and started a company to do just that. Shym Technology (www.shym.com), a startup in Needham, Mass., just introduced PKEnable--technology that connects digital certificate services to both off-the-shelf and custom applications.

PKEnable can work with multiple types of certificates, which means that you can integrate partners' certificate systems into your security model without having to standardize on a single PKI product. Considering the variations in the way products like Entrust and VeriSign work, that's no small matter. And in the first iteration of the product, due in April, PKEnable will have modules that support SAP R/3, Lotus Notes, PeopleSoft, and Documentum out of the box.

That takes a lot of the pain and suffering out of integrating PKI into business-to-business applications--not to mention many internal corporate apps. Now all you need is a baseball to sell...