InformationWeek

December 18/25, 2000

http://www.informationweek.com/817/xml.htm

The Language Of E-Business

The young standard spans a variety of industries and has become the universal data interchange language

ML is not a new technology, but for a standard that's only 2-1/2 years old, it's been more durable and had more influence across the business-to-business landscape than any single technology in recent memory. As the basis for universal data interchange among companies, XML has permeated every sector of business, from aviation and accounting to weather and workflow. That puts XML near the top of the list of the year's most important technologies.

XML's advances during 2000 include continued progress on core standards such as XML style sheets and XML Schema. In addition, there was further evolution of the many XML-based languages under development for vertical industries. This year also saw the first of what Microsoft calls Web services, procedures that will help connect the business processes of companies around the world using XML and existing Internet protocols.

If there were any problems with XML, it was that standardization was progressing too slowly and the amount of overlap and confusion among the various proposed and existing standards was high. There are many proposals for XML languages, but relatively few are ready for developers to implement.

"What's frustrating to us is the speed at which such standards are coming out," says Erik Vander Ahe, chief technologist for CheckFree Corp.'s i-Solutions, which enable billers to create electronic billing and payment applications. "We have to wait until an XML standard is a released recommendation before we can use it so that we minimize customer changes."

CheckFree, along with Microsoft and Intuit, authored the Open Financial Exchange standard for financial data exchange in 1997. CheckFree was an early adopter of XML, but has spent the last few years building infrastructure to fill in the gaps that newer XML-based standards are only now addressing. In particular, the XML Schema standard, which replaces the syntactically awkward and limited Document Type Definition specified by the XML 1.0 standard, is only now reaching recommendation status with the World Wide Web Consortium.

DTDs, and the newer XML Schema, are typically files that accompany XML-encoded data and are used to define the semantics of the XML tags. "Quite frankly, I wish XML Schema had been here in 1996," says Vander Ahe. "In a sense, we've almost written our own version of XML Schema. DTDs weren't rich enough--they lack comprehensive data types and data checking--so we wrote something that was similar to XML Schema."

Even when XML standards are defined, however, their adoption still can depend on market forces. CheckFree uses Open Financial Exchange, which is based on the Standard Generalized Markup Language, the predecessor to XML. The company has yet to replace it with Interactive Financial Exchange, the newer, XML-based version. "We've played with IFX, but there's really not much call for it yet, so we haven't gone to market with it," says Vander Ahe.

With the specter of having to substantially retool infrastructure, even if it's XML-based, it's not so unusual that standards committees would want to proceed carefully in building XML-based languages. Still, it's not always the complexity of the technology that bogs down the process.

"It's the politics of the committees themselves that's taking a long time," says Ari Kahn, co-founder and chief technology officer of FatWire Corp., which uses XML in its content-management software, UpdateEngine. "The basic structure of the language, XML 1.0, is already agreed upon. All they have to decide is the major semantic elements. The syntax itself doesn't need to go through the committee," he says.

Multimodal content delivery, as characterized by Web sites that need to deliver content to devices ranging from cell phones to desktop PCs, and from satellite feeds to shopping mall kiosks, is a niche that grew substantially this year, and it's a problem that XML is well suited to solve. By storing raw content encoded in XML, content-management systems can use XML style sheets to format the look and feel of the content for the appropriate device.

To deliver content to desktop PCs, for example, FatWire can use XML style sheets directly, if the user is running Microsoft's Internet Explorer 5.x browser. Or FatWire can use the Apache Xalan XSL processor to render the XML as HTML before delivering it to the user's desktop Web browser. On the back end, FatWire takes data from legacy systems and translates it to its own XML format before storing content in a database. Typically, this means moving data from a message queue system such as IBM's MQSeries, Oracle Advanced Queue, or Tibco.

Content from a legacy system--Goldman Sachs' internal stock-purchasing system, for instance--is translated into Financial Processing XML or Financial Services XML before being placed on the message queue. FatWire uses Java Messaging Service to extract the XML from the message queue and translate it into FatWire's own XML format so it can then be rendered for a Web site or placed in a database.

Most of the corporate plumbing implemented this year had some XML component, whether it was E-commerce sites, back-office systems, or even desktop applications such as Web browsers. With many businesses using XML to tie their legacy systems to front-end Web sites as well as crafting E-commerce servers using XML technologies, it was only a matter of time before some of the actual business processes that use this XML-encoded data could be exposed in a standard way to the Internet.

Microsoft's introduction of the Simple Object Access Protocol, a lightweight XML-based protocol for the exchange of data between applications, in late 1999, and the subsequent release to standards bodies this year, was the technology that gave businesses a way to expose business services directly on the Internet. Although the idea of a remote-procedure-call type of mechanism defined by XML was nothing new, Microsoft's clout and willingness to submit the protocol to standards bodies rallied both developers and vendors behind the technology.

The momentum behind Soap increased with the launch in September of the multivendor Universal Description, Discovery, and Integration specification, an ambitious attempt to describe, integrate, and catalog all Web-enabled business services. The core technology the spec promotes is something Microsoft calls a Web service. Such a service can be almost any kind of business process, from digitally signing a document that closes a real-estate deal to purchasing ball bearings. To make that process a Web service, the business needs to make it available via the Internet using Soap running over HTTP. It also needs to describe the process using the Web Services Description Language, an XML language that lets developers describe how other applications can interact with that process.

Microsoft's November release of the Soap toolkit for Visual Studio 6.0, and the MSXML Parser 3.0, gave a boost to developers working on these types of projects. With Microsoft's backing, both in developer tools and server software, Soap is one of the most accessible XML standards.

However, in the greater community of XML, sifting through the plethora of proposed XML languages can be mind-numbing to those who aren't well-versed in Backus-Naur Form, a cryptic notation for the formal description of programming languages.

To remedy this problem, a few XML standards groups are aggressively releasing better documentation and code. A good example of this is the Information Content and Exchange standard, an XML-based framework used to facilitate managed and reliable content delivery. Applications based on ICE let companies construct syndicated publishing networks, Web superstores, and online reseller channels by establishing site-to-site information networks. ICE is used by companies such as Adobe, Kinecta, National Semiconductor, Reuters, and Vignette to syndicate content to multiple parties or to provide content-management capabilities in a software product.

Version 1.1 of the ICE specification, released in September, brought with it a number of useful tools such as the ICE Cookbook, a free manual designed to help developers implement an ICE-compliant system from the ground up. "People always want to know how to implement a standard," says Linda Burman, VP of standards and evangelism for Kinecta Corp., which provides the infrastructure for managing digital content. "The ICE Cookbook is a series of sequential steps on how to implement ICE from the easiest to the most complicated."

As a follow-up, Adobe and other ICE authoring group members released an open-source Java reference implementation of ICE in December called ICEcubes. With both a reference implementation and decent documentation for developers, ICE is ahead of the curve for XML-based systems.

With XML-based transports for communicating over networks more widespread, security services that are equally XML-aware are needed. As the year comes to a close, security is one area in which vendors and customers alike hope that XML can enhance interoperability and make authentication services more accessible.

When Congress passed the Electronic Signatures in Global and National Commerce Act, or E-Sign Act, in October, it opened the door for legally binding online "signatures." The act paves the way for paperless business-to-business and business-to-consumer transactions, a majority of which will likely involve some level of processing or encoding with XML languages.

In November, VeriSign Inc., with backing from Ariba, Microsoft, and others, disclosed XML Trust Services, a four-component suite of specifications to integrate a broad range of trust services into business-to-business and business-to-consumer applications.

The four services are:

The XML Key Management Specification, which integrates digital signatures and encryption;
The Security Services Markup Language, which enables portable authentication and authorization;
XMLPay, which provides secure E-commerce payment processing; and
The Extensible Provisioning Protocol, which streamlines domain-name registration.

These proposed standards are likely to be used to tie Web services into public key infrastructure and other authentication services. Since no working implementations exist yet, the quality and safety of these standards has yet to be determined. They will in all likelihood evolve slowly and under intense scrutiny by security experts.

XML Trust Services may have the backing of Microsoft, but many other security vendors are behind another proposed XML security standard, called authXML, that competes directly with one of the four XML Trust Services. While authXML mostly complements three of the XML Trust Services, it competes with the Security Services Markup Language. Both allow bridging of user logon sessions and the exchange of some user authorization data between Web sites so these sites can more easily share user logon sessions across the Web.

So, for example, a user or business that's logged on to an auto-parts site could, in the same logon session, seamlessly connect with an auto-insurance claims site without having to start a new session.

AuthXML was unveiled in November, backed by Check Point Software Technologies, Entrust, Novell, Securant Technologies, and others. "AuthXML is trying very much not to do what has already been done," says Eric Olden, chief technology officer of Securant. While Olden acknowledges that authXML and the Security Services Markup Language are competitive, he says reconciliation between the two is inevitable. "We want to see the market bring it all together," he says, "so I think you'll find an agreement with both camps."

XML standards are evolving slower than anyone would like, but no one's arguing that the standardization pro-cess, especially for XML, isn't essential for business to carry on. Indeed, industries across a broad spectrum already have achieved some level of success with XML languages as they are, if only by defining focus groups to hammer out the details.