SOA
DataPower IBM SOA Appliances
Simplify, Secure, and Accelerate SOA
Nitin Thukral, CISSP
Canadian National Specialist
2007 IBM Corporation
IBM SOA
Agenda
1. New Model Required for SOA and Web Services 2. DataPower SOA Appliances Overview 3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50) 4. DataPower SOA Appliance Usage Scenarios 5. How DataPower SOA Appliances Work with Other IBM Products 6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio
2
1
IBM SOA
Agenda
1. New Model Required for SOA and Web Services 2. DataPower SOA Appliances Overview 3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50) 4. DataPower SOA Appliance Usage Scenarios 5. How DataPower SOA Appliances Work with Other IBM Products 6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio
3
IBM SOA
Business Centric SOA Starts with Your Most Critical Business Pain and Enables You to Build for Flexibility
Enable human and process interaction with consistent levels of service Deliver trusted information in business context to enable innovation
Achieve greater efficiency and effectiveness with business model innovation
4
2
IBM SOA
And SOA Lifecycle Is The Key to Successful Projects
Discover Construct & Test Compose Integrate people Integrate processes Integrate information
Gather requirements Model & Simulate Design
Sharing and reuse of services Establish decision rights Policies, measurement and control for SOA oversight
5
Manage IT resources Manage services Monitor business metrics
IBM SOA
SOA Entry Points Help Customers Get Started
Both Business Centric and IT Focused
1 2 3
4
6
5
3
IBM SOA
IBMs acquisition of DataPower
Software
A SOA Appliance
Creates customer value through extreme SOA performance and security
Simplifies SOA with specialized devices Accelerates SOA with faster XML throughput Secures SOA XML implementations
Skills & Support
IBM WebSphere DataPower SOA Appliances redefine the boundaries of middleware extending the SOA Foundation with specialized, consumable, dedicated SOA appliances that combine superior performance and hardened security for SOA implementations
7
IBM SOA
The Extensive Use of XML and Web Services Brings New Challenges and Requirements
Scalability
XML is bandwidth, CPU, disk, and memory intensive Especially for XML Schema validation and XML transformation SOA implies connecting systems never before connected Clear text over HTTP with no inherent security Sheer number and versions of standards have grown Web Services implementations can vary within the standards Complexity of SOA solutions continues to grow
Performance Security
-
Standards Proliferation
Operations
8
-
4
IBM SOA
Agenda
1. New Model Required for SOA and Web Services 2. DataPower SOA Appliances Overview 3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50) 4. DataPower SOA Appliance Usage Scenarios 5. How DataPower SOA Appliances Work with Other IBM Products 6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio
9
IBM SOA
DataPower Overview
Extensive Experience in XML Processing Optimization Eight Years in a Seven Year Old Field Advantages: First to Market, Great Team, Deep Standards Involvement, Invented and Owns Core XML Technology, Comprehensive Product Portfolio DGXT
Optimal Software Interpreter
XG3
Optimized Hardware Acceleration
XS40
First Wirespeed XML Security Gateway
XI50
Integration Appliance
Unprecedented Growth
XG4 New Available IBM Hardware
Vertical Solutions
1999 2000 2001 2002 2003 2004 2005 2006 FEB APR JUN AUG OCT 2007
XSLJIT
Optimized Software Compiler
XA35
Worlds First World XML Accelerator
XG4
Gigabit/Sec OEM HW Solution
Acquired by IBM
Global Expansion
R3.6 IT CAM for SOA WSDL Compiler 3rd Party JMS NFS ODBC / SQL Enhanced TAM, TFIM Integration
R3.5.1
Post-Acquisition Innovation Continues
150% Staff increase / Core DataPower team intact / Global reach and expansion New improved hardware platform IBM hardware combined with DataPower technology innovations New capabilities WS-*, 3rd-party JMS, NFS, ODBC, XG4, WSDL compiler, XACML, etc. Continued IBM Technology Integration TAM, TFIM, ITCAM for SOA, WebSphere JMS, WebSphere XD, etc.
10
5
IBM SOA
Why Use an Appliance for SOA
Hardened, specialized hardware for helping to integrate, secure, and accelerate SOA Many functions integrated into a single device Higher levels of security assurance certifications require hardware
Example: FIPS 140-2 Level 3 HSM, Common Criteria Impact: ability to perform more security checks without slow downs
Commodity Processes Migrate to Hardware Historical Trend Favours Appliances for XMLAware Networking
Higher performance with hardware acceleration
-
Addresses the divergent needs of different groups
Example: enterprise architects, network operations, security operations, identity management, web services developers
Simplified deployment and ongoing management
Impact: Reduces need for in-house SOA skills & accelerates time to SOA benefits
11
DataPower SOA Appliance Architecture
12
-
IBM SOA
6
IBM SOA
Functionality Payload/Message/ Field-level Processing
SOA Message Stack Legacy-XML Web Services Security XML SOAP HTTP
Infrastructure SOA Appliances XML Proxies
URL / FTP / Session Filtering IP Packet Processing Packet Filtering
Stateful Inspection Firewalls/Routers Application-Level Firewalls Layer 4/Circuit Firewalls IP Firewalls
Application Transport (TCP) Network (IP) Data Physical Specialized Processing Requirements
13
IBM SOA
Agenda
1. New Model Required for SOA and Web Services 2. DataPower SOA Appliances Overview 3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50) 4. DataPower SOA Appliance Usage Scenarios 5. How DataPower SOA Appliances Work with Other IBM Products 6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio
14
7
IBM SOA
DataPower SOA Appliances Product Portfolio
Problem: WS Application Performance Degradation Accelerates SOA and Web services deployments Increases performance throughput Decreases application latency Reduces cost and complexity Lowers overall TCO
XA35 XML Accelerator
Centralized XSLT Management Applies Standards Across the Enterprise
Problem: WS Application Security Threats and Risks Secures SOA and Web services deployments Provides comprehensive XML security Advanced XML firewall and security policy enforcement point functionality Compliant with most Web services standards Problem: WS Application Integration Integrates SOA and Web services deployments Transforms between disparate message formats (binary, legacy, XML, etc.) Bridges wireline transport-level protocols (HTTP, MQ, FTP, JMS, Tibco EMS, etc.)
15
XS40 XML Security Gateway
Wirespeed Appliance Purpose-Built for SOA Security Purpose-
XI50 Integration Appliance
Legacy Application Integration Enhanced Protocol Support
IBM SOA
XML Accelerator XA35
Centralized XSLT Management Offload XML Processing
Wirespeed XML/XSLT/XPath processing Accelerates XML processing, increasing
throughput and decreasing latency for XML-based applications by offloading transformation and other resource-intensive functions
Schema Validation - Performs XML Schema validation to ensure incoming/outgoing XML documents are legitimate and properly structured XML Compression, XML Caching Reduces impact of increased XML traffic Innovative XML Processing Capabilities -- XML Pipeline processing, deployable in Proxy or co-processor mode, dynamic content generation, data and forms processing, support for popular XSLT extensions SSL Termination/Acceleration
further lessening server workload Accelerates SSL with industry-leading hardware
Easy Configuration & Administration -
Support CLI and WebGUI as well as fully integrated with industry standard IDEs such as Altova XML Spy and Eclipse allowing developers to design, debug and deploy against one single XML and XSLT processor, saving valuable cycles in the progression from pilot to production
16
8
IBM SOA
XML Security Gateway XS40
Easy to Use Appliance Purpose-Built Purposefor SOA Security
XML/SOAP Firewall - Filter on any content, metadata or network variables Data Validation - Approve incoming/outgoing XML and SOAP at wirespeed Field Level Security- WS-Security, encrypt & sign individual fields, non-repudiation XML Web Services Access Control/AAA - SAML, LDAP, RADIUS, etc. MultiStep - Sophisticated multi-stage pipeline Web Services Management - Service Level Management, Service Virtualization, Policy
Management
Transport Layer Flexibility - HTTP, HTTPS, SSL Easy Configuration & Management - WebGUI, CLI, IDE and Eclipse Configuration to
address broad organizational needs (Architects, Developers, Network Operations, Security)
17
IBM SOA
XML Integration Appliance XI50
Middleware Appliance Purpose-Built for PurposeApplication Integration
DataGlue Any-to-Any Transformation Engine
Support for Contivo Analyst, IBM WebSphere Transformation Extender (TX)*
Content-Based Message Routing
Message Enrichment via ODBC, NFS, etc.
Protocol Bridging (HTTP, MQ, FTP, JMS, Tibco EMS, etc)
Request-response and sync-async matching
XML/SOAP Firewall - Filter on any content, metadata or network variables Data Validation - Approve incoming/outgoing XML and SOAP at wirespeed Field Level Security- WS-Security, encrypt & sign individual fields, non-repudiation XML Web Services Access Control/AAA - SAML, LDAP, RADIUS, etc. MultiStep - Sophisticated multi-stage pipeline Web Services Management Centralized Service Level Management, Service
Virtualization, Policy Management WebGUI, CLI, IDE and Eclipse Configuration to address broad organizational needs (Architects, Developers, Network Operations, Security)
Easy Configuration & Management -
18
9
IBM SOA
Content-Based Routing Features
Route based on
IP information SSL parameters HTTP headers XPath against any data content e.g., XML/SOAP envelope
Load balancing
Round-robin Least requests
SLA/Traffic shaping
Throttle requests
Routing Policy
IBM SOA Appliance
Unclassified Requests
19
IBM SOA
AAA Framework Diagram
Authenticate, Authorize, Audit Enforcement
20
-
-
Service Providers
10
IBM SOA
Web Services Management:
Service Level Management
Configure and install in minutes Hierarchical Service Level at WSDL, service, port, operation level Flexible actions when reaching a threshold: notify/alert, shape, throttle Threshold for both overall requests and failures Graphical display
21
IBM SOA
Intuitive WebGUI: Ease of Use
WSDL-based policy creation Hierarchical policies applied at WSDL, service, port, operation level Drag & drop policy creation screen allows flexible chaining of operations Configures and installs in minutes
Ease of Use Example Graphical User Interface providing drag and drop services, in order desired, for XML filtering, signing, verification, schema validation, encryption, decryption, transformation, routing, access control, service level monitoring, and advanced operations
22
11
IBM SOA
Simple Appliance Configuration for Complex Functionality
Fits into your existing environment
Address broad organizational needs
(Architects, Developers, Network Operations, Security)
Complete Configuration from GUI or CLI interface IDE integration/Eclipse plug-in XPath / XML config files SNMP SOAP management interface
23
IBM SOA
SOA Appliances Operations
Logging Role-based Management Managing configs & policy Deploying, backing up, Diff/Undo, App domains: many virtual devices Separate, locked audit log Troubleshooting aids Security Device security, Key and
Certificate management, HSM option, Security Audit, Single Image Firmware Upgrade
24
12
IBM SOA
IBM SOA Appliance Deployment Summary
LDAP Directory / SQL Database
Web Tier
XML XSL XML HTML WML
XA35 Application Server / Web Server IP Network
Client or Server
Security
XS40 IP Network IP Firewall Application Server
Tivoli Access Manager -----------Tivoli Federated Identity Manager
Integration & Management Tiers
LEGACY REQ LEGACY RESP HTTP XML REQ HTTP XML RESPONSE XI50
ITCAM for SOA
R EP LY
Q
Host / Legacy System 25
Web Services Client
IBM SOA
Agenda
1. New Model Required for SOA and Web Services 2. DataPower SOA Appliances Overview 3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50) 4. DataPower SOA Usage Appliance Scenarios 5. How DataPower SOA Appliances Work with Other IBM Products 6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio
26
13
IBM SOA
DataPower SOA Appliance Usage Scenarios
1. Securing Web Services
Securely enabling access to back-end system of record for partners and customers Protecting against XML-borne threats
-
2.
Legacy Integration
Connecting mainframe or legacy application to Web services/SOA XML-enabling mainframe and legacy systems
-
3.
Hub Mediation
Efficiently transforming, routing, logging messages among applications and Web services
-
4.
Enterprise Service Bus (ESB) Deployments
Provide on- and off-ramps to ESBs, manage Web services easily through service-level management, security management, enterprise management console
-
5.
Web Portal Acceleration
Speed up rendering for dynamic content generation
-
27
IBM SOA
Use Case 1: Securing Web Services Protect Against XML-Borne Threats
XS40 provides first line of XML defense and enforces access policy stored in an Identity Management Solution (e.g. IBM Tivoli Access Manager, CA Netegrity SiteMinder, EMC RSA ClearTrust / Access Manager, LDAP, Microsoft Active Directory, etc.)
XML Messages
Identity Management Solution
Internet Web Services Requestor IP Firewall
XS40 XML Security Gateway
Web Services Application Server
28
14
IBM SOA
Use Case 2: Legacy Integration Facilitate Mainframe Modernisation
XI50 connects to the mainframe via MQ or other connection mechanism, converts mainframe data (e.g. COBOL Copy Book from VSAM or ISAM) to XML data, validates it, and sends it to a destination via web services protocol (SOAP/HTTP).
XML Schema repository & COBOL Copybook definitions
Mainframe
EBCDIC encoded Messages MQ MQ
SOAP/HTTP
XI50 Integration Appliance
Messages converted to XML (ASCII)
Web Services Application Server
29
IBM SOA
Use Case 3: Hub Mediation Centralise Policies and Routing
XI50 acts as the central hub for all XML/Web Services. Based on the origin, and destination of the message, different policies are applied and the XML is normalized. XS40 for external security functions
External Business/Organization
Application A Application B Application C
Application D Application E Application F
IP Firewall IP Firewall
IP Firewall IP Firewall
HTTP/HTTPS or MQ
HTTP/HTTPS
MQ
Identity Store Identity Store (e.g. Tivoli) (e.g. Tivoli) Service Registry Service Registry (UDDI) (UDDI) Policy Manager Policy Manager SLA/Alert Manager SLA/Alert Manager Infrastructure Infrastructure Manager Manager (e.g. Tivoli) (e.g. Tivoli)
30
Authentication & Authorization functions
XI50 for transformation, protocol bridging, validations, and other internal security functions
Process Integrator
Backend Services
(Web Services and Legacy Services)
15
IBM SOA
Use Case 4: ESB Deployments Provide On- and Off-Ramp Functionality for ESBs
XI50 acts as the on and off ramp to the ESB, offloading expensive transformations from the ESB, and bridging different protocols (e.g. HTTP, MQ, FTP, WebSphere JMS, Tibco EMS, etc).
Applications
AS/400
Applications
Client SOAP XML Format A
XI50
-
Authentication & Authorization functions
HTTPS
XML Format B
Enterprise Service Bus
FTP/SMTP
(Multi Protocol Gateway)
Identity Management Solution
XML Format C
HTTP
MQ
Binary non-XML Format
Databases Legacy Systems
.NET Server
J2EE Server
Mainframe/ Legacy Applications
31
IBM SOA
Use Case 5: Web Portal Acceleration Optimise Dynamic Content Generation
XA35 fields all requests but processes only XML requests. XML messages are validated against a schema and then transformed from format A to format B using an XSL stylesheet.
XML Messages in format A
XSL & Schema repository
Internet Web Services Requestor
XA35 XML Accelerator
IP Firewall
XML Messages in format b
Web Services Application Server
32
16
IBM SOA
Agenda
1. New Model Required for SOA and Web Services 2. DataPower SOA Appliances Overview 3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50) 4. DataPower SOA Appliance Usage Scenarios 5. How DataPower SOA Appliances Work with Other IBM Products 6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio
33
IBM SOA
Integration Across IBM
XI50 ships with WebSphere MQ Support XS40 and XI50 embed TAM RTE / remote client Auto-configure XML firewall by importing WebSphere service descriptors Tivoli Ready
Fine-grained access control with Tivoli Access Manager (TAM) - Certified Tivoli Federated Identity Manager (FIM) Certified (SAML, WS-Trust) - Certified Monitoring of XML traffic flows with Tivoli NetView End-to-end SOA Management with ITCAM SE for DP and ITCAM for SOA
34
IBM Autonomic integration - Certified RAD / Eclipse integration
Rich console allows creation of policies and monitoring of multiple appliances from within IDE Integrated SOA tooling across the portfolio Continued investment in 3rd-party (competitive middleware) integration and interoperability
-
Futures
-
-
17
IBM SOA
DataPower and IBM Integration Roadmap
At Acquisition (October 2005) WebSphere MQ support RAD/Eclipse support XML FireWall service autoconfiguration Near-Term (2006, early 2007) Fully integrated administration, management and deployment WebSphere ESB integration WSRR integration Web Services Management proxy (ITCAM for SOA) Auto-configure with IBM TAM policy Future (2007+) Enhance integration with WebSpheres mediation capabilities Standardise development tooling
TAMeb certification Tivoli FIM certification Tivoli NetView support IBM Autonomic certification
Comprehensive SOA management and security Dynamic deployment of SOA mediation
IBM Systems and Technology Group partnership IBM BladeCenter integration
Explore IBM Blade Explore Power and technology Cell processor DataPower XG4 XML hardware IBM DB2 Viper XML Optimization
35
IBM SOA
Agenda
1. New Model Required for SOA and Web Services 2. DataPower SOA Appliances Overview 3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50) 4. DataPower SOA Appliance Usage Scenarios 5. How DataPower SOA Appliances Work with Other IBM Products 6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio
36
18
IBM SOA
SOA Reference Architecture: ESB Positioning
Business Innovation & Optimization Services
Facilitates better decision-making with real-time business information
Development Services
Enables collaboration between people, processes & information
Orchestrate and automate business processes
Manages diverse data and content in a unified manner
Connect with trading partners
Build on a robust, scaleable, and secure services environment
Facilitates interactions with existing information and application assets
Infrastructure Services
Optimizes throughput, availability and performance
37
IBM SOA
DataPower Adds New Capabilities to the IBM ESB Portfolio
Innovative hardware appliance deployment option
Consumable form factor Straightforward configuration
-
Reduced total cost of ownership (TCO) for ESB solutions Hardened security and rich gateway functions
Delivers well-respected XML firewall, access control enforcement, Web services security Provides gateway functions, including service level management, monitoring and audit Does not require deploying separate SOAP firewall / web services security product Ensures secure DMZ deployment Optimized processing without ...