IBM SOA

DataPower SOA Appliances

Simplify, Secure, and Accelerate SOA

Nitin Thukral, CISSP

Canadian National Specialist

2007 IBM Corporation

IBM SOA

Agenda
1. New Model Required for SOA and Web Services
2. DataPower SOA Appliances Overview
3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50)
4. DataPower SOA Appliance Usage Scenarios
5. How DataPower SOA Appliances Work with Other IBM Products
6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio

IBM SOA

Agenda
1. New Model Required for SOA and Web Services
2. DataPower SOA Appliances Overview
3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50)
4. DataPower SOA Appliance Usage Scenarios
5. How DataPower SOA Appliances Work with Other IBM Products
6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio

IBM SOA

Business Centric SOA Starts with Your Most Critical

Business Pain and Enables You to Build for Flexibility

Enable human and process
interaction with consistent
levels of service

Deliver trusted information
in business context to
enable innovation

Achieve greater efficiency

and effectiveness with
business model
innovation

IBM SOA

And SOA Lifecycle Is The Key to Successful Projects

Discover

Construct & Test

Compose

Integrate people

Integrate processes

Integrate information

Gather requirements

Model & Simulate

Design

Manage IT resources

Manage services

Monitor business metrics

Sharing and reuse of services

Establish decision rights

Policies, measurement and
control for SOA oversight
5

IBM SOA

SOA Entry Points Help Customers Get Started

Both Business Centric and IT Focused

1
2
3

IBM SOA

IBMs acquisition of DataPower

Software

A SOA Appliance

Creates customer value through

extreme SOA performance and
security

Skills &
Support

Simplifies SOA with specialized devices

Accelerates SOA with faster XML throughput

Secures SOA XML implementations

IBM WebSphere DataPower SOA Appliances redefine the boundaries

of middleware extending the SOA Foundation with specialized,
consumable, dedicated SOA appliances that combine superior
performance and hardened security for SOA implementations
7

IBM SOA

The Extensive Use of XML and Web Services Brings

New Challenges and Requirements

Scalability
- XML is bandwidth, CPU, disk, and memory intensive

Performance
- Especially for XML Schema validation and XML transformation

Security
- SOA implies connecting systems never before connected
- Clear text over HTTP with no inherent security

Standards Proliferation
- Sheer number and versions of standards have grown
- Web Services implementations can vary within the standards

Operations
- Complexity of SOA solutions continues to grow

IBM SOA

Agenda
1. New Model Required for SOA and Web Services
2. DataPower SOA Appliances Overview
3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50)
4. DataPower SOA Appliance Usage Scenarios
5. How DataPower SOA Appliances Work with Other IBM Products
6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio

IBM SOA

DataPower Overview

Extensive Experience in XML Processing Optimization

Eight Years in a Seven Year Old Field

Advantages: First to Market, Great Team, Deep Standards Involvement, Invented and Owns
Core XML Technology, Comprehensive Product Portfolio
DGXT

XG3

XS40

Optimal
Software
Interpreter

Optimized
Hardware
Acceleration

First Wirespeed
XML Security
Gateway

XI50
Integration
Appliance

Unprecedented
Growth

XG4
New
Available
IBM
Hardware

Vertical
Solutions

1999 2000 2001 2002 2003 2004 2005 2006 FEB APR JUN AUG OCT 2007
XSLJIT
Optimized
Software
Compiler

XA35

XG4

World
Worlds First
XML
Accelerator

Gigabit/Sec
OEM HW
Solution

Acquired
by IBM

Global
Expansion

R3.5.1

R3.6
IT CAM for SOA
WSDL Compiler
3rd Party JMS
NFS
ODBC / SQL
Enhanced TAM, TFIM Integration

Post-Acquisition Innovation Continues

150% Staff increase / Core DataPower team intact / Global reach and expansion
New improved hardware platform IBM hardware combined with DataPower technology innovations
New capabilities WS-*, 3rd-party JMS, NFS, ODBC, XG4, WSDL compiler, XACML, etc.
Continued IBM Technology Integration TAM, TFIM, ITCAM for SOA, WebSphere JMS, WebSphere XD, etc.

10

IBM SOA

Why Use an Appliance for SOA

Hardened, specialized hardware for helping to
integrate, secure, and accelerate SOA

Many functions integrated into a single device

Commodity Processes Migrate to Hardware

Historical Trend Favours Appliances for XMLAware Networking

Higher levels of security assurance certifications

require hardware
- Example: FIPS 140-2 Level 3 HSM, Common
Criteria

Higher performance with hardware acceleration

- Impact: ability to perform more security checks
without slow downs

Addresses the divergent needs of different

groups
- Example: enterprise architects, network operations,
security operations, identity management, web
services developers

Simplified deployment and ongoing

management
- Impact: Reduces need for in-house SOA skills &
accelerates time to SOA benefits

11

IBM SOA

DataPower SOA Appliance Architecture

12

IBM SOA

Functionality

SOA Message Stack

Payload/Message/
Field-level
Processing

Legacy-XML
Web Services Security
XML
SOAP

URL / FTP /
Session Filtering
IP Packet
Processing

HTTP

Application
Transport (TCP)

Packet Filtering

Network (IP)

Infrastructure
SOA Appliances
XML Proxies

Stateful Inspection
Firewalls/Routers
Application-Level
Firewalls
Layer 4/Circuit
Firewalls
IP Firewalls

Data
Physical
Specialized Processing
Requirements
13

IBM SOA

Agenda
1. New Model Required for SOA and Web Services
2. DataPower SOA Appliances Overview
3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50)
4. DataPower SOA Appliance Usage Scenarios
5. How DataPower SOA Appliances Work with Other IBM Products
6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio

14

IBM SOA

DataPower SOA Appliances Product Portfolio

Problem: WS Application Performance Degradation

Accelerates SOA and Web services deployments
Increases performance throughput
Decreases application latency
Reduces cost and complexity
Lowers overall TCO

Problem: WS Application Security Threats and

Risks
Secures SOA and Web services deployments
Provides comprehensive XML security
Advanced XML firewall and security policy
enforcement point functionality
Compliant with most Web services standards

Problem: WS Application Integration

Integrates SOA and Web services deployments
Transforms between disparate message formats
(binary, legacy, XML, etc.)
Bridges wireline transport-level protocols (HTTP, MQ,
FTP, JMS, Tibco EMS, etc.)

XA35 XML Accelerator

Centralized XSLT Management

Applies Standards Across the Enterprise

XS40 XML Security Gateway

Wirespeed Appliance
PurposePurpose-Built for SOA Security

XI50 Integration Appliance

Legacy Application Integration

Enhanced Protocol Support

15

IBM SOA

XML Accelerator XA35

Centralized XSLT Management
Offload XML Processing

Wirespeed XML/XSLT/XPath processing Accelerates XML processing, increasing

throughput and decreasing latency for XML-based applications by offloading transformation and
other resource-intensive functions

Schema Validation - Performs XML Schema validation to ensure incoming/outgoing XML

documents are legitimate and properly structured

XML Compression, XML Caching Reduces impact of increased XML traffic

Innovative XML Processing Capabilities -- XML Pipeline processing, deployable in

Proxy or co-processor mode, dynamic content generation, data and forms processing, support for
popular XSLT extensions

SSL Termination/Acceleration

Accelerates SSL with industry-leading hardware

further lessening server workload

Easy Configuration & Administration -

Support CLI and WebGUI as well as fully

integrated with industry standard IDEs such as Altova XML Spy and Eclipse allowing developers to
design, debug and deploy against one single XML and XSLT processor, saving valuable cycles in
the progression from pilot to production

16

IBM SOA

XML Security Gateway XS40

Easy to Use Appliance PurposePurpose-Built
for SOA Security

XML/SOAP Firewall - Filter on any content, metadata or network variables

Data Validation - Approve incoming/outgoing XML and SOAP at wirespeed
Field Level Security- WS-Security, encrypt & sign individual fields, non-repudiation
XML Web Services Access Control/AAA - SAML, LDAP, RADIUS, etc.
MultiStep - Sophisticated multi-stage pipeline
Web Services Management - Service Level Management, Service Virtualization, Policy

Management

Transport Layer Flexibility - HTTP, HTTPS, SSL

Easy Configuration & Management - WebGUI, CLI, IDE and Eclipse Configuration to

address broad organizational needs (Architects, Developers, Network Operations, Security)

17

IBM SOA

XML Integration Appliance XI50

Middleware Appliance PurposePurpose-Built for
Application Integration

DataGlue Any-to-Any Transformation Engine

Content-Based Message Routing

Protocol Bridging (HTTP, MQ, FTP, JMS, Tibco EMS, etc)

XML/SOAP Firewall - Filter on any content, metadata or network variables

Data Validation - Approve incoming/outgoing XML and SOAP at wirespeed
Field Level Security- WS-Security, encrypt & sign individual fields, non-repudiation
XML Web Services Access Control/AAA - SAML, LDAP, RADIUS, etc.
MultiStep - Sophisticated multi-stage pipeline
Web Services Management Centralized Service Level Management, Service

Easy Configuration & Management -

Support

for Contivo Analyst, IBM WebSphere Transformation Extender (TX)*

Message Enrichment via ODBC, NFS, etc.

Request-response and sync-async matching

Virtualization, Policy Management

WebGUI, CLI, IDE and Eclipse Configuration to
address broad organizational needs (Architects, Developers, Network Operations, Security)

18

IBM SOA

Content-Based Routing Features

Load balancing

Route based on
-

IP information
SSL parameters
HTTP headers
XPath against any data content
e.g., XML/SOAP envelope

Round-robin
Least requests

SLA/Traffic shaping
-

Throttle requests

Routing Policy

IBM SOA
Appliance

Unclassified
Requests

Service
Providers

19

IBM SOA

AAA Framework Diagram

Authenticate, Authorize, Audit Enforcement

20

10

IBM SOA

Web Services Management:

Service Level Management

Configure and install in minutes

Hierarchical Service Level at WSDL, service, port, operation level
Flexible actions when reaching a threshold: notify/alert, shape, throttle
Threshold for both overall requests and failures
Graphical display

21

IBM SOA

Intuitive WebGUI: Ease of Use

WSDL-based policy creation

Hierarchical policies applied at WSDL, service, port, operation level
Drag & drop policy creation screen allows flexible chaining of operations
Configures and installs in minutes

Ease of Use Example Graphical User Interface providing drag and drop services, in order desired, for
XML filtering, signing, verification, schema validation, encryption, decryption, transformation, routing,
access control, service level monitoring, and advanced operations

22

11

IBM SOA

Simple Appliance Configuration for

Complex Functionality
Fits into your existing environment

Address broad organizational needs

Complete Configuration from GUI or CLI

interface

IDE integration/Eclipse plug-in

XPath / XML config files

SNMP

SOAP management interface

(Architects, Developers, Network Operations,

Security)

23

IBM SOA

SOA Appliances Operations

Logging

Role-based Management

Managing configs & policy Deploying,

backing up, Diff/Undo, App domains: many
virtual devices

Separate, locked audit log

Troubleshooting aids

Security Device security, Key and

Certificate management, HSM option,

Security Audit, Single Image Firmware
Upgrade

24

12

IBM SOA

IBM SOA Appliance Deployment Summary

LDAP Directory / SQL Database

Web Tier
XML
HTML
WML

XML
XSL

XA35
Application Server / Web Server

IP Network

Client
or
Server

Security

Tivoli
Access
Manager
-----------Tivoli
Federated
Identity
Manager

XS40
IP Network

IP Firewall

Application Server

R
EP
LY

Integration & Management Tiers

 LEGACY
REQ
LEGACY
RESP 

 HTTP XML REQ

XI50

HTTP XML RESPONSE


ITCAM for
SOA

Host / Legacy
System

Web Services
Client

25

IBM SOA

Agenda
1. New Model Required for SOA and Web Services
2. DataPower SOA Appliances Overview
3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50)
4. DataPower SOA Appliance Usage Scenarios
5. How DataPower SOA Appliances Work with Other IBM Products
6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio

26

13

IBM SOA

DataPower SOA Appliance Usage Scenarios

1.

Securing Web Services

-

2.

Legacy Integration
-

3.

Efficiently transforming, routing, logging messages among applications and Web services

Enterprise Service Bus (ESB) Deployments

-

5.

Connecting mainframe or legacy application to Web services/SOA

XML-enabling mainframe and legacy systems

Hub Mediation
-

4.

Securely enabling access to back-end system of record for partners and customers
Protecting against XML-borne threats

Provide on- and off-ramps to ESBs, manage Web services easily through service-level
management, security management, enterprise management console

Web Portal Acceleration

-

Speed up rendering for dynamic content generation

27

IBM SOA

Use Case 1: Securing Web Services

Protect Against XML-Borne Threats
XS40 provides first line of XML defense and enforces access policy stored in an Identity
Management Solution (e.g. IBM Tivoli Access Manager, CA Netegrity SiteMinder, EMC RSA
ClearTrust / Access Manager, LDAP, Microsoft Active Directory, etc.)

Identity
Management
Solution

XML
Messages

XS40 XML Security Gateway

Internet
Web Services
Requestor

IP Firewall

Web Services
Application Server

28

14

IBM SOA

Use Case 2: Legacy Integration

Facilitate Mainframe Modernisation
XI50 connects to the mainframe via MQ or other connection mechanism, converts mainframe
data (e.g. COBOL Copy Book from VSAM or ISAM) to XML data, validates it, and sends it to a
destination via web services protocol (SOAP/HTTP).

Mainframe

XML Schema
repository &
COBOL
Copybook
definitions

EBCDIC
encoded
Messages

SOAP/HTTP
MQMQ

XI50 Integration Appliance

Messages
converted to
XML (ASCII)

Web Services
Application Server

29

IBM SOA

Use Case 3: Hub Mediation

Centralise Policies and Routing
XI50 acts as the central hub for all XML/Web Services. Based on the origin, and destination of the
message, different policies are applied and the XML is normalized.
XS40 for
external
security
functions

External
Business/Organization

Application D

Application A

Application E

Application B

IP
IP Firewall
Firewall

Application F

Application C

IP
IP Firewall
Firewall

HTTP/HTTPS

MQ

HTTP/HTTPS
or MQ

XI50 for
transformation,
protocol bridging,
validations, and other
internal security
functions

Identity
Identity Store
Store
(e.g.
(e.g. Tivoli)
Tivoli)
Service
Service Registry
Registry
(UDDI)
(UDDI)
Policy
Policy Manager
Manager
SLA/Alert
SLA/Alert Manager
Manager
Infrastructure
Infrastructure
Manager
Manager
(e.g.
(e.g. Tivoli)
Tivoli)

Authentication &
Authorization functions

Process
Integrator

Backend Services
(Web Services and Legacy Services)

30

15

IBM SOA

Use Case 4: ESB Deployments

Provide On- and Off-Ramp Functionality for ESBs
XI50 acts as the on and off ramp to the ESB, offloading expensive transformations from the ESB, and
bridging different protocols (e.g. HTTP, MQ, FTP, WebSphere JMS, Tibco EMS, etc).

Applications

AS/400
Applications

Authentication &
Authorization functions

Client
XML
Format A

SOAP

HTTPS

XML
Format B

Identity
Management
Solution

XI50

Enterprise Service Bus

(Multi Protocol Gateway)

FTP/SMTP

Databases
Legacy Systems

.NET
Server

XML
Format C

HTTP

J2EE
Server

MQ

Binary
non-XML
Format

Mainframe/
Legacy
Applications

31

IBM SOA

Use Case 5: Web Portal Acceleration

Optimise Dynamic Content Generation
XA35 fields all requests but processes only XML requests. XML messages are validated against
a schema and then transformed from format A to format B using an XSL stylesheet.

XML Messages
in format A

XSL & Schema

repository

XA35 XML Accelerator

Internet
Web Services

IP Firewall

XML Messages
in format b
Web Services

Requestor
Application Server

32

16

IBM SOA

Agenda
1. New Model Required for SOA and Web Services
2. DataPower SOA Appliances Overview
3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50)
4. DataPower SOA Appliance Usage Scenarios
5. How DataPower SOA Appliances Work with Other IBM Products
6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio

33

IBM SOA

Integration Across IBM

XI50 ships with WebSphere MQ Support

XS40 and XI50 embed TAM RTE / remote client
Auto-configure XML firewall by importing WebSphere service descriptors
Tivoli Ready
-

Fine-grained access control with Tivoli Access Manager (TAM) - Certified

Tivoli Federated Identity Manager (FIM) Certified (SAML, WS-Trust) - Certified

Monitoring of XML traffic flows with Tivoli NetView
End-to-end SOA Management with ITCAM SE for DP and ITCAM for SOA

IBM Autonomic integration - Certified

RAD / Eclipse integration

-

Rich console allows creation of policies and monitoring of multiple appliances from
within IDE

Futures
-

Integrated SOA tooling across the portfolio

Continued investment in 3rd-party (competitive middleware) integration and

interoperability

34

17

IBM SOA

DataPower and IBM Integration Roadmap

At Acquisition
(October 2005)

Near-Term
(2006, early 2007)

Future
(2007+)

WebSphere MQ support
RAD/Eclipse support
XML FireWall service autoconfiguration

Fully integrated
administration,
management and
deployment
WebSphere ESB
integration
WSRR integration

Enhance integration
with WebSpheres
mediation capabilities
Standardise
development tooling

TAMeb certification
Tivoli FIM certification
Tivoli NetView support
IBM Autonomic certification

Web Services
Management proxy
(ITCAM for SOA)
Auto-configure with
IBM TAM policy

Comprehensive SOA
management and
security
Dynamic deployment
of SOA mediation

IBM Systems and

Technology Group
partnership
IBM BladeCenter
integration

Explore IBM Blade

Explore Power and
technology
Cell processor
DataPower XG4 XML
hardware
IBM DB2 Viper XML
Optimization

35

IBM SOA

Agenda
1. New Model Required for SOA and Web Services
2. DataPower SOA Appliances Overview
3. DataPower SOA Appliances Product Portfolio (XA35, XS40, XI50)
4. DataPower SOA Appliance Usage Scenarios
5. How DataPower SOA Appliances Work with Other IBM Products
6. Positioning DataPower SOA Appliances within the IBM ESB Portfolio

36

18

IBM SOA

SOA Reference Architecture: ESB Positioning

Business Innovation & Optimization Services

Process Services

Information Services

Enables collaboration
between people,
processes & information

Orchestrate and
automate business
processes

Manages diverse
data and content in a
unified manner

Integrated
environment
for design
and creation
of solution
assets

Facilitates communication

ESB

IT Service
Management

Interaction Services

between services

Partner Services

Business App Services

Access Services

Connect with trading

partners

Build on a robust,
scaleable, and secure
services environment

Facilitates interactions
with existing information
and application assets

Apps &
Info Assets

Development
Services

Facilitates better decision-making

with real-time business information

Manage
and secure
services,
applications
&
resources

Infrastructure Services
Optimizes throughput,
availability and performance

37

IBM SOA

DataPower Adds New Capabilities to the IBM ESB Portfolio

Innovative hardware appliance deployment option
- Consumable form factor
- Straightforward configuration

Reduced total cost of ownership (TCO) for ESB solutions

Hardened security and rich gateway functions

- Delivers well-respected XML firewall, access control enforcement, Web

services security
- Provides gateway functions, including service level management, monitoring
and audit
- Does not require deploying separate SOAP firewall / web services security
product
- Ensures secure DMZ deployment

Enables wire speed, lower latency and higher throughput

- Optimized processing without significant additional resources

38

19

IBM SOA

IBM Delivers a World-Class ESB Portfolio

ESB:

Advanced ESB:

WebSphere ESB provides Web

Services connectivity and data
transformation

WebSphere Message Broker

provides universal connectivity
and data transformation

ESB

Advanced ESB

DataPower SOA Appliance

SOA Appliances:
WebSphere DataPower provides simplified
connectivity and wirespeed data transformation
with enhanced security

39

IBM SOA

A Typical SOA/ESB Design Pattern

Partner
Zone

Demilitarized
Zone

InterEnterprise
Zone

Domain Firewall

Protocol Firewall

Network
Infrastructure

Enterprise Secure Zone

Message
Broker

Enterprise
Service
Bus

ESB

40

20

IBM SOA

Applying DataPower to the SOA/ESB Design Pattern

Partner
Zone

Demilitarized
Zone

InterEnterprise
Zone

XML Firewall
and Web
Services
Gateway

Domain Firewall

Protocol Firewall

Network
Infrastructure

Enterprise Secure Zone

Message
Broker

XML
Accelerator

Enterprise
Service
Bus
Back-End
Resource
Gateway

XA35

XS40
ESB

XI50

41

IBM SOA

What Does DataPower Add to WebSphere Message

Broker and WebSphere ESB environments?

WebSphere DataPower adds:

- Enhanced throughput, reduced latency for XML processing and security

processing
- XML firewall & XML threat protection (eligible for DMZ deployment)
- A higher level of security assurance including DoS protection
- Additional administrative capabilities (CLI, signed and encrypted logging, etc.)
- Service Level Management capabilities

WebSphere DataPower brings to WebSphere Message Broker:

- Enhanced WS-* (in particular WS-Security support)
- Web services gateway functionality (eligible for DMZ deployment)
- Wirespeed any-to-any transformation

WebSphere DataPower brings to WebSphere ESB:

-

Enhanced WS-* support

Wirespeed any-to-any data transformation
TIBCO EMS connectivity
Advanced Web services gateway functions

42

21

IBM SOA

What Does WebSphere DataPower add to non-IBM ESB

Software Solutions?

For competitively installed (and happy) customers looking to extend their
ESB
- Add value to a competitive environment

For customers where IBM software-based solutions do not meet customer

requirements
- Appliance-based ESB solution

There are scenarios where an ESB appliance will be all that a customer
requires

43

IBM SOA

What Does WebSphere ESB Add to a DataPower Scenario?

Persistent JMS messaging server

General purpose programming environment, and support for
arbitrary integration logic
- Java
- J2EE programming environment (with the full capabilities of
WebSphere Application Server)

Full transaction support

- XA transaction coordination
- XA transaction participation

Wide range of application and technology adapters including

robust support for IBM transaction processing environments

44

22

IBM SOA

What Does WebSphere Message Broker Add to a

DataPower Scenario?

Persistent messaging server

General purpose programming environment, and support for arbitrary integration
logic
- Java, C, ESQL

Advanced message and event processing

- Complex message flow implementations
- Complex event processing

Full transaction support

- XA transaction coordination, XA transaction participation
- Multiple transactions within a message flow

Tight integration with IBM transaction processing systems, including CICS and IMS

Adapter and protocol support
- Support for multiple transport protocols
- Any third party JMS 1.1 provider - including transaction management across 3rd-party JMS
providers
- Wide range of application and technology adapters
45

IBM SOA

DataPower in the WebSphere ESB Ecosystem

46

23

IBM SOA

Only WebSphere Delivers the Most Comprehensive ESB

Solutions to Power Your SOA
1. WebSphere continues to offer two robust ESB Software components
-

WebSphere ESB, delivering an ESB

Connect using SOA standards and enjoy a full general programming environment

WebSphere Message Broker, delivering an advanced ESB

Universal connectivity with SOA standards and non-SOA standards with the richest set of broker
functionality

2. WebSphere now offers an innovative appliance deployment option

-

WebSphere DataPower, proven SOA Appliances to power your ESB

Connect with increased security, improved gateway functions and increased performance

3. WebSphere offers the broadest range of ESB capabilities on the market

today
-

Most powerful solutions combine WebSphere DataPower with WebSphere Message Broker to
deliver an Advanced ESB or WebSphere ESB for a standards-focused ESB

47

IBM SOA

Questions

Nitin Thukral
+1 (905) 824-8720
[email protected]
Nitin Thukral/Ontario/IBM
48

24