Entrust Secure Transaction Platform

Frequently Asked Questions

1. What is the Secure Transaction Platform?
2. What are Web services?
3. Why do Web services need enhanced security?
4. What are Foundation Security Services?
5. What is the Entrust Identification Service?
6. What is the Entrust Entitlements Service?
7. What is the Entrust Verification Service?
8. What is the Entrust Privacy Service?
9. Is the Entrust Secure Transaction Platform a PKI?
10. What standards does the Secure Transaction Platform conform to?
11. Will the Secure Transaction Platform work with my existing Entrust products?
12. What application servers and platforms does the Entrust Secure Transaction Platform Support?
13. What gateways does the Entrust Secure Transaction Platform support?

---

1. What is the Secure Transaction Platform? (top)

   The Entrust Secure Transaction Platform is a product portfolio that delivers security to enable Web services transactions. The Entrust Secure Transaction Platform consists of a set of Foundation Security Services that provide the building blocks for integrating authentication, authorization, digital signatures, and end-to-end encryption into transactions. These fundamental trust services are provided through Web services interfaces to allow for easy integration and deployment. Like all Entrust products, the Entrust Secure Transaction Platform strives to remove complexity, and achieve consistent and transparent enforcement of security policies across applications, platforms and services.

2. What are Web services? (top)

   The universal acceptance of two key standards — TCP/IP and XML — has created the technical foundation to enable companies to share information and deeply integrate business processes. Building upon these two standards, extensive industry effort has been initiated to develop a framework for interoperability between disparate business processes. This framework is known as Web services.

   Web services are self-contained, modular applications that can be described, published, located and invoked over the Internet. They perform well-defined functions both for applications and other Web services. These functions can be anything from simple calculations to complicated business processes. Through their loose-coupling and dynamic real-time discovery and binding, Web Services insulate applications from the complexity and details of other components, creating systems that are more flexible and adaptable. Security is recognized as a major impediment to wide-spread adoption of Web services.

3. Why do Web services need enhanced security? (top)

   Web services are recognized as the next wave of computing to achieve efficiencies of automation and faster customer service by integrating business processes within the enterprise and with business partners. As organizations provide wider access to their sensitive information, the risk of serious damage due to malicious manipulation becomes a critical challenge.

   By building on widely accepted standards that enable easier connectivity between applications, Web services simplifies the development of business-to-business applications, reducing time-to-market and greatly improving the ability to change these applications over time. At the same time, the security mechanisms required for these applications must be sufficient to protect the sensitive and valuable transactions that will use Web services. Consequently, Web services will require security technologies that go well beyond the basic Secure Sockets Layer (SSL) of the browser-driven Web — Web services require enhanced security, such as that delivered by the Entrust Secure Transaction Platform.

   In addition, a security solution for Web services cannot be considered as a standalone technology issue. Organizations require consistent security implementations that can be used across their enterprise, Web portal and Web services applications. Consequently, organizations need to consider how their security solution for Web services leverages and interoperates with their security solutions for enterprise and Web portal applications.

4. What are Foundation Security Services? (top)

   Foundation Security Services are the building blocks for integrating authentication, authorization, digital signatures, and encryption into transactions. Open and standards-compliant, Foundation Security Services deliver enhanced security capabilities broadly applicable across Web services and other server-based applications. The Entrust Secure Transaction Platform’s Foundation Security Services will include:

   • Identification Service (Authentication)
   • Entitlements Service (Authorization)
   • Verification Service (Digital Signatures)
   • Privacy Service (Encryption)
5. What is the Entrust Identification Service? (top)

   The Entrust Identification Service is part of the Entrust Security Transaction Platform that enables organizations to centrally control which identities are trusted for automated Web services transactions so that each Web services application does not have to manage these issues independently. (more)

   Roaming is also enabled through Entrust TruePass’s ability to support authentication with smart cards. By their very nature, smart cards enable users to travel from one computer to another, gaining access to their digital ID through a PIN that is only known to them. This does require some minimum operating system, browser, and hardware requirements and increased costs to be met, so this may not be an ideal roaming scenario for large-scale deployments of users.

6. What is the Entrust Entitlements Service? (top)

   The purpose of the Entrust Entitlements Service is to confirm that the entity trying to access a Web service (and other types of resources, also) has the right to do so. Like the Identification Service, the Entitlements Service makes it possible for Web services applications to focus on business logic and rely on fundamental security operations occurring centrally in the Foundation Security Services by “outsourcing” the entitlements decision. (more)

7. What is the Entrust Verification Service? (top)

   The Entrust Verification Service is part of the Entrust Secure Transaction Platform designed to deliver integrity and accountability capabilities for Web services transactions through centralized digital signatures and timestamping. (more)

8. What is the Entrust Privacy Service? (top)

   The Privacy Service is part of the Entrust Secure Transaction Platform responsible for encrypting information so that only designated entities can access that information. Rather than each Web services application having to understand how to encrypt information, the Entrust Privacy Service takes care of the complexity of using cryptographic keys to provide data encryption in a centralized service. (more)

9. Is the Entrust Secure Transaction Platform a PKI? (top)

   No, the Entrust Secure Transaction Platform is not a public-key infrastructure (PKI). Like all Entrust products, the Secure Transaction Platform will interoperate and leverage the enhanced security capabilities of Entrust’s industry-leading PKI, Entrust Authority, but the platform is not a PKI. Entrust is employing the existing industry-leading technology, knowledge, and experience used for its PKI product portfolio to create flexible, reliable, and scalable Foundation Security Services for the Entrust Secure Transaction Platform.

10. What standards does the Secure Transaction Platform conform to? (top)

    The Entrust Secure Transaction Platform provides support for major Web services and Internet security standards including SAML, XACML, XML Digital Signatures, XML Encryption, XKMS, WS-Security, X.509v3 digital certificates and CMS formats, RFC 3161 Timestamp protocol, Secure Sockets Layer (SSL) and many others. Entrust is an active participant in the creation and maintenance of many Web services standards.

11. Will the Secure Transaction Platform work with my existing Entrust products? (top)

    Yes. Organizations require consistent security implementations that can be used across their enterprise, Web portal and Web services applications. The Entrust Secure Transaction Platform is designed to leverage and interoperate with existing Entrust security products—Entrust Authority, Entrust Entelligence, Entrust GetAccess and Entrust TruePass—currently in use by governments and businesses for enterprise and Web portal applications.

    To illustrate why this is important, consider an organization that is in the process of deploying Web services-based applications, but which also currently operates a Web portal to protect resources that are accessed by the same user group (this group could include employees, suppliers, citizens, or even other computer applications). To achieve a greater return on investment, it is important to maintain centralized control over the administration of these user identities—using Entrust Authority—so that the security is applied consistently and at the lowest total cost.

12. What application servers and platforms does the Entrust Secure Transaction Platform Support? (top)

    The Entrust Secure Transaction Platform supports leading application servers and platforms such as BEA, IBM and Sun to extend interoperable security services across an enterprise’s existing infrastructure. These services provide organizations with flexible options for integrating security into any Web services environment.

13. What gateways does the Entrust Secure Transaction Platform support? (top)

    The Entrust Secure Transaction Platform integrates with VordelSecure and VordelDirector to provide comprehensive content validation, threat detection and AAA access control for XML and Web services data.