Weekly Review: PKI Infiltrates Application Infrastructure

One of the most vital but least understood technologies in e-business is Public Key Infrastructure (PKI). Forged in the arcane and secretive world of encryption — once the sole preserve of military code-writers and code-breakers — PKI is the technology that allows Internet users to prove who they are and stops others from stealing their private information.

Name Your News

What's been the most significant ASP news in the last week? Make your pitch in the ASPnews Discussion Forum

PKI should be at the heart of any online business system, making it virtually impossible for fraudsters to forge identities or eavesdrop on sensitive commercial transactions. But it's never been an accessible technology, mainly because of cryptography's roots in the deepest mysteries of pure mathematics, ring-fenced by the finest traditions of military secrecy. If everyday reality is a world away from technology geekdom, imagine just how much further away from ordinary human experience must be that special place inhabited by cryptography geeks.

The struggle to infiltrate PKI into the day-to-day routine of Internet users has had some successes. But even when disguised within the more user-friendly concept of digital certificates, it's been difficult to make the use of PKI become second nature for the average individual. What's been needed is some way of integrating its use into the application infrastructure, so that it becomes just another function that developers automatically build into their offerings.

Last week, the answer finally arrived with the submission to the World Wide Web Consortium (W3C) of the XML Key Management Specification (XKMS). Developers who use XKMS can build PKI-based security into their applications without ever having to turn into a PKI geek. Instead, they can simply call on third-party services that already understand how to perform bizarre yet vital functions such as revocation status checking, key authentication, and certification path location and validation.

XKMS is one of the finest examples yet of the power of the web services model, in which applications are simply assembled by bringing together separate specialist services, rather than requiring developers to become experts in a mind-numbing array of different specialist realms. Designed to be implemented as a web service, XKMS is built upon Web Services Description Language (WSDL) and Simple Object Access Protocol (SOAP), two of the cornerstones of the emerging web services architecture.

Coinciding with the submission to W3C came the announcement of a range of XKMS-based services by Verisign, which developed the standard in collaboration with Microsoft and webMethods. Of special interest to ASPs is Access360.net, which is an outsourced service developed by Verisign and Access360 for managing user access rights. The service substantially lowers the cost of entry for implementing a secure, automated user provisioning solution, benefitting from the more than $250 million of investment that Verisign has made in its own PKI and directory services infrastructure.

Pioneers for Sale
Of all the challenges faced by pioneering entrepreneurs, the most difficult to get right is timing. Start too late, and your original idea will be one of many by the time it comes to market. Set out too early, and you may find yourself just that little bit too far ahead of the curve to gather mainstream momentum.

It has been particularly tough for those who were the first to see that the Internet would lead to the creation of an entirely new generation of software-based services. They have had the unenviable task of guessing what those new services were going to look like and deciding on the optimum moment to plan on launching them. Getting it right has been as much a matter of luck as judgement, but today's economic climate is delivering a harsh judgement on those who have erred.

Two innovators that have been listed in the ASPnews industry directory since its earliest days have quietly put themselves up for sale in the past few weeks. Earlier this month, BizTone announced on its website that it has failed to secure a new round of funding and is seeking a trade buyer. BizTone set out to create a complete enterprise resource planning (ERP) suite as an entirely Internet-based service offering. Its ambitious vision was the subject of an ASP News Review feature back in March 1999 — see BizTone.com challenges ERP conventions.

BizTone succeeded in its development efforts, creating what it claims is "the largest and most significant Java application ever built." BizTone Financials is available online, and until the company finds its white knight, it is making the application available free of charge to subscribers. But because the market is not yet quite ready to embrace ERP in a fully web services model, its days as an independent venture are coming to an end.

Last month, Agillion also put up the 'For Sale' sign after failing to close a planned $30 million round of finance. As befits a company co-founded by Texan entrepreneurs, Agillion's errors have been on an altogether grander scale than Biztone's. With a management team presided over by Tivoli founder Frank Moss and backers including Goldman Sachs, Morgan Stanley and Hambrecht & Quist, Agillion raised $40 million in its first round.

It aimed to bring a new style of Internet-based customer service delivery to the small business market. But much of its funding disappeared on premature marketing, including over $2 million spent on a single TV ad during the 2000 Super Bowl. The expenditure was completely mistimed. Small businesses were not yet ready to embrace any type of Internet-based service en masse, let alone an entirely new and unfamiliar method of communicating with their customers.

Tools:

Add aspnews.com to your favorites Add aspnews.com to your browser search box IE 7 | Firefox 2.0 | Firefox 1.5.x

Back to Analyst Columns