Layer 7 Unveils Clustered SOA Security

Layer 7 Technologies on Tuesday said it has added the ability to enforce rules across its line of XML security products for service-oriented architectures, a reflection of the industry's move toward more mature security.

The enhancement is included in the 3.5 Security operating system, an upgrade of the OS for Layer 7's SecureSpan family of XML gateways and firewalls. The new version was unveiled Tuesday at the Interop conference in Las Vegas, Nev.

In introducing clustered SOA security, Layer 7 has provided a container for managing rules across multiple firewalls and gateways, rather than setting and maintaining rules for each device, Ron Schmelzer, analyst for ZapThink LLC, said. The feature marks the beginning of a trend toward more mature security features for SOAs, a form of distributed computing that loosely couples systems via technologies based on extensible markup language, or XML.

"It's another indication of the market maturing," Schmelzer said. "Clustered security is pretty advanced."

Whereas vendors in the past have tended to over-hype announcements, they're now starting to deliver on useful products, which means more customers are demanding better technology for their SOAs.

"It's not so much sizzle now. There's more meat," Schmelzer said.

Layer 7's new capabilities are the result of growing acceptance in the marketplace of the WS-Policy framework, which provides a general purpose model and syntax for describing and communicating policies and rules between applications. WS-Policy is an industry specification developed by BEA Systems Inc., IBM, Microsoft Corp., SAP AG, Sonic Software and VeriSign Inc.

"WS-Policy is seen as the accepted container from which you can exchange security policy information," Schmelzer said.

While Layer 7's implementation may not be interoperable with other vendors' products today, the Canadian company has at least provided clustered security across its own product line, Schmelzer said.

Layer 7's 3.5 security also provides traffic and availability monitoring across multiple security devices, automatic failover, configuration change management and PKI management.

PKI, or public key infrastructure, is a framework for securely exchanging information based on public key cryptography.