DataPower Common Use Cases

Transcription

1 DataPower Common Use Cases Bharat Bhushan, Principal Connectivity Architect, IBM UK Christopher Khoury, Worldwide Client Technical Leader, IBM US Arif Siddiqui, Product Manager, IBM US TIS IBM Corporation

2 Please Note IBM s statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM s sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion. Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput or performance that any user will experience will vary depending upon many factors, including considerations such as the amount of multiprogramming in the user s job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve results similar to those stated here IBM Corporation

3 Agenda DataPower Quick Overview Security & Optimization Gateway Mobile Connectivity API Management Integration Mainframe Integration & Enablement B2B IBM Corporation

4 Introduction to DataPower Gateway Appliances IBM DataPower Gateway Appliances are the industry-leading Security & Integration gateways that help provide security, control, integration and optimized access to a full range of Mobile, Web, API, SOA, B2B and Cloud workloads IBM Corporation

5 IBM DataPower Gateway Appliances Security & Integration Gateway Appliances Internet DMZ Trusted Domain Consumer DataPower DataPower Application or Service Consumer Securely expose enterprise data to external consumers/partners, while optimizing delivery of the workload Securely connect apps/services within the enterprise, while optimizing delivery of the workload and providing integration including XML offload, message validation/filtering, message/transport protocol transformation, traffic control/quota enforcement, SOA governance & management, dynamic routing & intelligent load distribution Physical appliance that is purpose-built, tamper-evident with simplified deployment combining superior performance, hardened security, increased ROI and reduced TCO Provides high levels of certified Security assurance e.g. Transport Protocol Security (SSL/TLS), Message Level Security, and Authentication, Authorization, Audit Simplified maintenance model Drop-in appliance form-factor, Secures traffic in minutes, and Push-button flash upgrade process Over a decade of innovation worldwide installations. 10,000+ physical units sold Virtual appliance provides deployment flexibility & reduced cost for development and test environments IBM Corporation

6 DataPower appliances used across a variety of scenarios Internet DMZ Trusted Domain Consumer Application or Service DataPower DataPower System z Consumer Trading partners 1 Security Gateway (Web Services/Apps/APIs) 2 Intelligent Content Routing & Load Distribution 3 B2B Partner Gateway 4 Internal Security Enforcement 5 Integration 6 Runtime SOA Governance 7 Web Service Management 8 Legacy Integration IBM Integration Bus Application Service File IBM Corporation

7 Use appliances to simplify & centralize critical functions Secure, control, integrate & optimize multiple applications without code changes Lower cost and complexity Enable new business with unmatched performance Before DataPower Appliances After DataPower Appliances Secure Control Integrate Route & Optimize Update application servers individually Secure, control, integrate, & optimize all applications instantly No changes to applications IBM Corporation

8 IBM DataPower Gateway Appliance capabilities Security Resilience OAuth, SAML, XACML, WS- Security, LTPA, Kerberos, etc Authentication & authorization Security token translation Message & transport protection Integration Convert payloads (JSON, XML, CSV, Cobol, binary, etc) Bridge transports (HTTP, MQ, FTP, WAS JMS, TIBCO EMS, etc) Database connectivity (DB2, IMS, Oracle, MS SQL, Sybase) Mainframe integration (IMS Connect, IMS Callout, CICS, etc) B2B integration (AS1,AS2,AS3,etc) Operation admission control Failure re-routing XML threat protection JSON threat protection Schema validation Messages filtering Control Service-level agreements Traffic control Message accounting Content-based routing Governance & management Optimization SSL & TLS offload Hardware accelerated crypto ops XSLT & XQuery acceleration JSONiq acceleration Connection pooling, offload Intelligent load distribution Caching: Local & external (XC10) In-the-Clear Request Clients Encrypted and Signed Request Malicious Request IBM Corporation Cobol/MQ Cobol/ MQ Appl Service Providers

9 DataPower Family Service Gateway XG45 Entry-level device, slim footprint (1U) Security gateway (AAA, XML threat, etc) Service level management and monitoring Intelligent load distribution & dynamic routing Lightweight integration functions (optional) Available in Virtual Edition Integration Appliance XI52 High density 2U form, XG45 functionality plus Any-to-Any conversion at wire-speed Bridges multiple transport protocols Mainframe integration & enablement Available in Virtual Edition Integration Blade XI50B/XI50z Functionally equivalent to XI52 Form factor flexibility XI50B: BladeCenter form factor XI50z: zenterprise BladeCenter Extension (zbx) form factor B2B Appliance XB62 High density 2U form, XI52 functionality plus B2B Messaging (AS1/AS2/AS3/ebMS) Trading Partner Profile Management B2B Transaction Viewer IBM Corporation

10 DataPower Appliances Over a decade of innovation & over 2000 worldwide installations Government Agencies and ministries Defense and security organizations Crown corporations Banking Majority of the big US and European banks All of the big 5 Canadian banks Numerous regional banks and credit unions Insurance Used by 95% of top global insurances firms SaaS providers, ASPs, regulators, etc. Many, many, more Healthcare Retailers Utilities, Power, Oil and Gas Telecom Airlines etc IBM Corporation

11 Agenda DataPower Quick Overview Security & Optimization Gateway Mobile Connectivity API Management Integration Mainframe Integration & Enablement B2B IBM Corporation

12 Use Case: Security & Optimization Gateway Securing the Enterprise & providing optimized access IBM Corporation

13 IBM Software Group Enterprise Networking Software DataPower security roles and objectives Secure access to Web and legacy applications Converged security enforcement Rocksolid DataPower platform Leverages enterprise security and policy managers Internet F I R E W A L L DMZ F I R E W A L L Authentication Authorization User Federation Intranet Mission-critical data z/os RACF for User I&A Authorization Cert/keys Protect data and other resources on the appliance and protected servers System availability Protect against unwanted access, denial of service attacks, and other unwanted intrusion attempts from the network Only allow valid messages through Identification and Authentication Verify identity of network users Authorization Protect data and other system Page resources from unauthorized access Protect data in the network using cryptographic security protocols Data End Point Authentication Verify who the secure end point claims to be Data Origin Authentication Verify that data was originated by claimed sender Message Integrity Verify contents were unchanged in transit Data Confidentiality Conceal clear-text using encryption 2010 IBM Corporation

14 Protection of data plus XML & JSON threat protection Use DataPower to help resolve PCI compliance issues Easily sign, verify, encrypt, decrypt any content Configurable XML Encryption and Digital Signatures Message-level, Field-level, Headers Security standards: OAuth, WS-Security, WS-Policy, WS- SecurityPolicy, SAML, XACML, WS-Trust, XML Threat Protection Entity Expansion/Recursion Attacks Public Key DoS XML Flood Resource Hijack Dictionary Attack Replay Attack Message/Data Tampering Message Snooping XPath or SQL Injection XML Encapsulation XML Virus many others JSON Threat Protection Label - Value Pairs Label String Length (characters) Value String Length (characters) Number Length (characters) Threat Protection Maximum nesting depth (levels) Maximum document size (bytes) DataPower security is policy driven Use WS-SecurityPolicy to define security requirements for your web services DataPower natively consumes and enforces WS-SecurityPolicy statements Integrity & Confidentiality, SupportingTokens, Message/Transport Protection Use XACML to define access and authorization policies for your web services DataPower natively consumes and enforces XACML policies Resource-based Authorization PEP, PDP IBM Corporation

15 AAA : Authentication Authorization Auditing HTTP Headers WS-Security Tokens WS-SecureConversation WS-Trust Kerberos X.509/SSL SAML Assertion IP Address LTPA Token HTML Form OAuth Custom Extract Identity LDAP/Active Directory System/z NSS (RACF, SAF) IBM Security Access Manager Kerberos WS-Trust Netegrity SiteMinder RADIUS SAML LTPA Verify Signature Custom Authenticate Map Identity LDAP/ActiveDirectory System/z NSS IBM Security Access Manager Netegrity SiteMinder SAML XACML OAuth Custom Add WS-Security Generate z/os ICRX Token Generate Kerberos Generate Spnego Generate SAML Generate LTPA Map Tivoli Federated Identity input Authorize Audit & Post-Process output Extract Resource Map Resource URL XPath SOAP Operation HTTP Operation Custom External Access Control Server or Onboard Identity Management Store IBM Corporation

16 Security Gateway Browsers Partner Apps SaaS Consumer Outside World HTTP(s) Internet HTML, JSON, XML, SOAP MME, DIME, MTOM XMLDSIG, XMLENC WS-Security WS-Security Policy WS-Trust SAML OAuth 2.0 Connection from client Web Service Request Basic Auth, OAuth 2.0, WS-Security UNT, etc Protocol Firewall Proxying and Enforcement Terminate incoming connection Terminate transport-level security (SSL/TLS offload) Threat protection Enforce Service Level Agreement policies Inspect message content and filter (Schema validate) Enforce security policies on message content (Encrypt/decrypt, Verify/sign digital signatures) Authentication, Authorization, Auditing (AAA) Call out to virus checker Transform content & enrich message Translate security token DMZ Outgoing access control; SAML injection etc Security Gateway Incoming access control; Threat protection Internal Network New connection to target Dynamically route based on content and load balance Web Service Request 16 (Establish a new connection to pass results) SAML, LTPA, 2013 IBM Corporation Cache data on-box or in centralized, shared XC10 grid Kerberos Domain Firewall Internal Consumer HTTP(s) ACL ESB Tivoli (TAM) MS Active Directory Any LDAP, e.g. Oracle CA SiteMinder PDP (XACML, SAML, other) ACL Security Gateway Virus Scanner Internal Security Packaged Apps Proprietary Apps Data Provider

17 Retail Service Provider Securely expose services to consumers Challenge Consistent & secure delivery of online services to partners that could be shared, integrated & flexible to meet specific needs Web services infrastructure needed to support highly secure data routing with daily high volume & sensitive nature of information Solution Implemented WebSphere DataPower to form the Web services backbone Through content-based routing, security policy enforcement & data encryption, DataPower ensures safe & efficient flow of confidential customer data Integrated seamlessly into heterogeneous environment increasing interoperability & promoting reuse Identity Mgmt Benefits Secure SOA on standards-based platform Easily reuse Web services throughout enterprise Boosts productivity of IT staff Substantially shorten time to market for new services 17

18 Centralized Service Governance & Policy Enforcement Use WebSphere Service Registry & Repository (WSRR) to store, publish, and govern your web services DataPower can subscribe or poll web services information from WSRR Automatically expose services and policies in DataPower via WSRR subscription Include WS-Policy, WS-Security Policy statements via WS-PolicyAttachment Retrieve WSDLs by specific version number Dynamically retrieve run-time routing information from WSRR Complete SOA Governance solution WSRR for web service life-cycle policy management DataPower for web service run-time policy enforcement WSRR (Policy Administration Point) ITCAM for SOA (Policy Monitoring Point) Centralized transaction monitoring ITCAM for SOA Support for UDDI v2 and v3 for UDDI registries Message Discover Services & Policy Monitor Services Message 18 Consumer Message DataPower (Policy Enforcement Point) Message Service

19 Service Level Monitor (SLM): Traffic Control / Rate Limiting Service Level Monitoring (SLM) to protect your services and applications from over-utilization and enforce quota Frequency based on concurrency OR based on messages per time period Take action when exceeding a custom threshold: Notify (or log), Shape (or delay), Throttle (or reject) 19

20 Application Optimization Example Public Slow Response (>10s) Enterprise High Load User { "Task" : "AddEntry", "Detail": "Create presentation materials." } WAS Application Scenario JSON REST app to-do list Issues High server load Slow response time Improve Server Load with SSL Offload 1. Client requests are secured via DP SSL concentrator User 1 Public 1 DMZ DataPower Data Center Improved Load 20 WAS Application

21 Application Optimization Example Manage Traffic with Application Fluency 2. DataPower enables application aware traffic management PUT /joe/todos HTTP/1.1 Host: joe.org Content-Type: application/json Content-Length: 69 { "Task" : "AddEntry", "Detail": Waste time." } DataPower Improved Load User WAS Application Distribute Load Intelligently 3. Application Optimization effects load distribution intelligence Leverage dynamic runtime conditions to distribute based on topology & workload User 1 Improved Response Time 1 2 DataPower 3 Improved Load 21 WAS Application

22 Application Optimization Example Cache at the edge(s) 4. Application results are cached at the edge using XC10 caching grid OR locally on-box DataPower 3 Low Load User Fast Response 4 REST WAS Application DataPower XC10 Faster application response time Lower server load Improved system throughput 22

23 Using XC10 As a Side Cache For DataPower 1. Client submits application request. 2. DataPower XI parses request and queries XC10. On a hit, skip to step On a miss, XI forwards request to target Provider. 4. XI adds application response to XC Client receives response from XI. Easily integrates into the existing business process No code changes to the client or back-end application Simply add the side cache mediation Significantly reduces the load on the back-end system by eliminating redundant requests Improve client observed response time User Client 1 Improved Response Time 5 DataPower XI Appliances Large Response Time Provider Improved Load REST 23 DataPower XC10

24 DataPower XI52 + XC10: Travel and Transportation Online Reservations 100x performance improvement Reservations System Before: 3-5 sec response time After: sec response time Caching service requests Improved the average response time of the Global Distribution System requests for Fare Availability and Category Availability 52% caching rate 10 minute cache resulted in 40% reduction in load on the back-end systems Maintained high data integrity. Faster responses were also accurate POC in 3.5 hrs Improved reliability and scalability of reservation channels Reduced traffic to backend systems Deliver high performance & consistent response times Scale with simplicity and lower TCO 24

25 Agenda DataPower Quick Overview Security & Optimization Gateway Mobile Connectivity API Management Integration Mainframe Integration & Enablement B2B IBM Corporation

26 Use Case: Mobile Connectivity Securely & Rapidly connect Mobile Apps with Enterprise Services IBM Corporation

27 Connect Mobile Apps with Enterprise Apps & Services Security, Control, Integration & Optimization of mobile workload Securely expose enterprise data to Mobile Apps while optimizing delivery of the workload Message Oriented, Legacy Apps IBM DataPower Gateway Appliance Worklight, WAS ND e.g. REST (JSON/XML) over HTTPS SSL Offload Threat Protection Rate Limiting Validation, Filtering now with Native JSON Support** Authentication Authorization Security Token Translation Transformation Content-Based Routing Intelligent Load Distribution now with On Demand Router for WAS ND** Response Caching Locally or to XC10 ** e.g. SOAP over HTTPS Web Apps, Services Enhanced form-based authentication support for quick integration with Worklight applications running on mobile devices ** Ready-to-use configuration pattern as reverse proxy & security policy enforcement point in front of Worklight Server** IBM Corporation ** Available in DataPower firmware version 6.0

28 A closer look at some Mobile Connectivity scenarios REST Service Gateway for Mobile Apps SSL offload Enforcement point for centralized security policies Authentication, Authorization, OAuth 2.0, Audit Threat protection for XML and JSON Message validation and filtering REST Centralized management and monitoring point Traffic control / Rate limiting Routing / Intelligent load distribution to Provider RESTful façade to non-rest Provider REST Proxy JSON / XML / SOAP JSON or XML / HTTP(s) Mobile Consumer IBM DataPower Gateway Provider Application Acceleration for Mobile Apps Offload heavy lifting of message transformation from the Provider Transform to a format best suited for the requesting Mobile App JSON for native/hybrid app HTML/XHTML for browser based Cache response data from Provider Locally on the appliance Externally to elastic caching XC10 HTTP(s) GET HTTP(s) GET Mobile Consumer JSON or HTML/XHTML IBM DataPower Gateway XML Provider IBM Corporation

29 IBM Corporation

30 Client examples using DataPower for Mobile use cases Several examples of businesses using DataPower as a Mobile Gateway for their Security & Integration needs Large international bank has mobile banking goes through DataPower Large Mobile company in the UK has traffic from handsets, REST service calls, being secured via DataPower Large global phone company has their RESTful service calls using JSON and XML from Mobile devices and consumer browsers are secured and load balanced using DataPower Large retailer went live recently with DataPower proxying Mobile traffic Retailer secures their provisioning ipad traffic through DataPower A wireless carrier secures mobile traffic to account data through DataPower IBM Corporation

31 Agenda DataPower Quick Overview Security & Optimization Gateway Mobile Connectivity API Management Integration Mainframe Integration & Enablement B2B IBM Corporation

32 Use Case: API Management Securely & Rapidly Create, Socialize & Manage Business APIs to engage with a Developer ecosystem IBM Corporation

33 IBM API Management V2.0 (On-Premise) Secure, control and optimize access to APIs through DataPower Create, Manage, Socialize APIs Dev Ops Dashboard for easy assembly of new APIs and to secure and manage APIs from an IT Ops perspective, API lifecycle mgmt Business Ops Dashboardwith analytics and controls to publish APIs, document APIs, set quotas, manage communities and monitor service levels Application Developer Portal with Self-Service registration and with hooks into social communities On-Premise DMZ-ready API Gateway Rapid on-ramping of APIs API security; SSL termination, Threat protection, Authentication, Authorization with OAuth Quota enforcement / Traffic control; Enforce API consumption policies Monitors API use Caching support for both on-box local and remote caching using XC10 Intelligent routing and load distribution Enterprise Services App Developer Portal DataPower Dev Ops Dashboard Web Apps On Premise Business Ops Dashboard IBM Corporation Mobile

34 Secure Mobile App Integration + API Management Mobile Apps & Web consumers Security & Integration Gateway IBM DataPower Appliance Caching Appliance IBM DataPower XC10 Applications & Services on App Servers (WAS, WAS ND, Worklight or other Provider) API consumers & App Developers Create, Publish, Manage & Socialize APIs IBM API Management** API owners Multi-device development IBM Worklight ** Available in IBM API Management IBM Corporation

35 Agenda DataPower Quick Overview Security & Optimization Gateway Mobile Connectivity API Management Integration Mainframe Integration & Enablement B2B IBM Corporation

36 Use Case: Enterprise Integration Consumable integration solution for securely connecting applications & services while optimizing delivery of workload IBM Corporation

37 Integration Outside World DMZ Internal Network Browsers Partner Apps SaaS Internet Protocol Firewall Enhanced Security DMZ Domain Firewall HTTP(s) FTP(s) SFTP(SSH) WMQ(s) WS JMS TIBCO EMS ACL LDAP DB ODBC HTTP Packaged Apps Proprietary Apps Data DataPower Gateway JMS EMS Packaged Apps Proprietary Apps Data WMQ IMS Connect FTP NFS Packaged Apps Proprietary Apps Data Packaged Apps Proprietary Apps Data Packaged Apps Proprietary Apps Data Content based routing Message enrichment Message transformation Transport protocol translation Integration Scenario AAA, Threat protection Message validation & filtering Traffic control / Rate limiting Intelligent content based routing Intelligent load distribution Local and distributed caching Message Format & Transport Protocol Mediation Example Format & transport bridging SOAP / HTTP(s) Cobol / MQ IBM Corporation Consumer MQ Queue Manager Provider

38 UK Government Agency enables integration capabilities using DataPower Challenge Data held in the back-end systems vital to delivering citizen services, fraud detection across various layers of the Governments across the EU Vulnerable back-end services Security Capacity/ SLA Consistent usability experience for internal or external service consumers Solution DataPower in key network zones within and outside of the department Thorough content-based validation, routing, and security policy enforcement Integrated seamlessly into heterogeneous environment increasing interoperability & promoting reuse Other UK Departments Internal Users Other EU Countries Government network Integration Layer Benefits Ease of integration Security assurance of the architecture Secure SOA on standards-based platform Consistent experience and policy for all users Core Services IBM Corporation Core Data

39 Security & Integration Scenario Financial Firm 39 39

40 Agenda DataPower Quick Overview Security & Optimization Gateway Mobile Connectivity API Management Integration Mainframe Integration & Enablement B2B IBM Corporation

41 Use Case: Mainframe integration & enablement Offload processing for reduced MIPS Web Services Enablement for IMS, CICS, DB IBM Corporation

42 An Irish Bank Enabling retail banking Challenge Retail application contained 7000 screens; slow response times over dedicated proprietary network. Cost of processing XML on the mainframe. Message transformation needed before the core banking platform could process requests. Solution DataPower in trusted network exposed services for XML/ HTTP(S) and protocol bridging to WebSphere MQ Message validation and transformation using WebSphere Transformation Extender (WTX) Benefits Retail application acceleration through transformations and caching Optimized platform for handling, parsing and processing payloads Branch Application (web based) Branch Network DataPower Q Q Q Q Q Core banking platform on Z IBM Corporation

43 High Street Clothing and Fashion Accessories Retailer Increase customer interaction and loyalty Challenge Highly competitive industry; first mover advantage Weak customer loyalty Multi channel customer experience Complex supply chain and service providers Solution DataPower acted as a reverse proxy for: Outbound messages via a service provider Inbound customer updates/ delivery notifications Transform SOAP/ XML payload to COBOL copybook messages for CICS application Benefits Create customer interaction and value through innovative business strategy. Integrate various suppliers using standards based interfaces securely. Graphical configuration driven appliance; short learning curve Q Open Internet DataPower Q Customer & Product related application and systems on Z IBM Corporation

44 Broad integration with System z Connect to existing applications over WebSphere MQ Transform XML to/from COBOL Copybook for legacy needs Integrate with RACF security from DataPower AAA Dynamic crypto material retrieval & caching, or offload crypto ops to z Connect to IMS Via IMS Connect client Via Web Services Via WebSphere MQ Connect to CICS Via WebSphere MQ Via Web Service Connect to DB2 Via Web Service As direct ODBC call with ODBC Client option DataPower XI50z Additional benefits with integrated DataPower XI50z blade form factor Fast secure network between DataPower blade and target servers Virtual Network Provisioning Dynamic Load Balancing (via Sysplex Distributor) HMC Console Integration Blade Hardware Management Energy Monitoring and Management of DP Blades DP Firmware Load and Update Monitoring and Reporting IMS SOAP Gateway Client SOAP/HTTP DataPower SOAP/HTTP CCB / MQ WAS+IMS connector MQ Server MQ Brdg IMS O T M A IMS Application DRDA DB IBM Corporation

45 Enhanced value for System z & IMS New integration capabilities between DataPower and IMS IMS Callout feature allows IMS transactions to easily consume external web services via DataPower, with minimal application updates required IMS Callout Service Provider SOAP / REST DataPower TCP/IP IMS Connect IMS O T M A App1 App2 IMS DB feature supports DataPower integration with IMS database through SQL interface Enrich messages with database content Expose data as a service to remote applications Service Consumer SOAP / REST DRDA Client DataPower IBM Corporation

46 Agenda DataPower Quick Overview Security & Optimization Gateway Mobile Connectivity API Management Integration Mainframe Integration & Enablement B2B IBM Corporation

47 Use Case: B2B integration Extend integration beyond the enterprise to partner community IBM Corporation

48 DataPower B2B Functionality Extend beyond the enterprise to integrate with partners B2B Gateway Service AS1, AS2, AS3 and ebms v2.0 Plaintext support EDI, XML and Binary Payload routing Front Side Protocol Handlers Hard Drive Archive/Purge policy CPA and Partner Profile Associations MQ File Transfer Edition integration Trading Partner Profiles Two Types Internal and External ebxml CPPA v2.0 Multiple Business IDs Multiple Destinations (URL Openers) Certificate Management (S/MIME Security) Multi-step processing policy B2B Viewer B2B transaction viewing MQ FTE transaction viewing Transaction resend capabilities Transaction and Acknowledgement correlation Role based access Persistent Storage AES Encrypted B2B document storage Option for Off-Box Storage (NFS or iscsi) Transaction Store B2B metadata storage B2B state management DataPower B2B Gateway Service Partner Connection Front Side Handlers Internal Partner Destinations External Partner Integration Destinations Front Side Handlers Metadata Store (DB) Partner Profiles B2B Viewer Document Store (HDD) IBM Corporation

49 UK Logistics and Distribution Challenge AS2, File and Web Services based interfaces to 100s of B2B customers. Messages are exchanged at least once a day Secure proxy solution in the DMZ Complex incumbent supplier chain Benefits Create customer interaction and value through innovative business strategy. Integrate various suppliers using standards based interfaces securely. Graphical configuration driven appliance; short learning curve 49

50 UK Logistics and Distribution External Systems Internal Systems External Systems Internal System Internal System Internal Systems 50

51 DataPower Appliances Benefits Reduce Complexity: Replace software servers functionality with DataPower Appliances, reduce infrastructure footprint, and off-load systems intensive processes. Lower TCO: DataPower Appliances have demonstrated reducing operational costs by as much as 50% Reduce Time to Market: DataPower Appliances dramatically decrease the testing time and amount of development required to upgrade your environment, most policy are configuration driven as opposed to development driven Reduce Risk: DataPower Appliances provide the communication layer without requiring application modification, and deliver improved security and audit Flexibility & Security: DataPower Appliances shield business applications from security requirements, protocol changes and service versioning - no application modifications needed 51

52 DataPower resources IBM DataPower Web Page (support, technotes, doc) developerworks DataPower Discussion Area Vast library of published articles: (Also search for DataPower within WebSphere, SOA/Web Services and XML ) (Search DataPower ) IBM Redbooks: IBM WebSphere DataPower SOA Appliance Handbook YouTube: DataPower Podcasts: IBM Corporation

53 We love your Feedback! Don t forget to submit your Impact session and speaker feedback! Your feedback is very important to us we use it to improve next year s conference Go to the Impact 2013 SmartSite ( Use the session ID number to locate the session Click the Take Survey link Submit your feedback IBM Corporation

54 IBM Corporation

55 Legal Disclaimer IBM Corporation All Rights Reserved. The information contained in this publication is provided for informational purposes only. While efforts were made to verify the completeness and accuracy of the information contained in this publication, it is provided AS IS without warranty of any kind, express or implied. In addition, this information is based on IBM s current product plans and strategy, which are subject to change by IBM without notice. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, this publication or any other materials. Nothing contained in this publication is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in this presentation to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in this presentation may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. Nothing contained in these materials is intended to, nor shall have the effect of, stating or implying that any activities undertaken by you will result in any specific sales, revenue growth or other results. If the text contains performance statistics or references to benchmarks, insert the following language; otherwise delete: Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput or performance that any user will experience will vary depending upon many factors, including considerations such as the amount of multiprogramming in the user's job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve results similar to those stated here. If the text includes any customer examples, please confirm we have prior written approval from such customer and insert the following language; otherwise delete: All customer examples described are presented as illustrations of how those customers have used IBM products and the results they may have achieved. Actual environmental costs and performance characteristics may vary by customer. Please review text for proper trademark attribution of IBM products. At first use, each product name must be the full name and include appropriate trademark symbols (e.g., IBM Lotus Sametime Unyte ). Subsequent references can drop IBM but should include the proper branding (e.g., Lotus Sametime Gateway, or WebSphere Application Server). Please refer to for guidance on which trademarks require the or symbol. Do not use abbreviations for IBM product names in your presentation. All product names must be used as adjectives rather than nouns. Please list all of the trademarks that you use in your presentation as follows; delete any not included in your presentation. IBM, the IBM logo, Lotus, Lotus Notes, Notes, Domino, Quickr, Sametime, WebSphere, UC2, PartnerWorld and Lotusphere are trademarks of International Business Machines Corporation in the United States, other countries, or both. Unyte is a trademark of WebDialogs, Inc., in the United States, other countries, or both. If you reference Adobe in the text, please mark the first use and include the following; otherwise delete: Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries. If you reference Java in the text, please mark the first use and include the following; otherwise delete: Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. If you reference Microsoft and/or Windows in the text, please mark the first use and include the following, as applicable; otherwise delete: Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both. If you reference Intel and/or any of the following Intel products in the text, please mark the first use and include those that you use as follows; otherwise delete: Intel, Intel Centrino, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. If you reference UNIX in the text, please mark the first use and include the following; otherwise delete: UNIX is a registered trademark of The Open Group in the United States and other countries. If you reference Linux in your presentation, please mark the first use and include the following; otherwise delete: Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. Other company, product, or service names may be trademarks or service marks of others. If the text/graphics include screenshots, no actual IBM employee names may be used (even your own), if your screenshots include fictitious company names (e.g., Renovations, Zeta Bank, Acme) please update and insert the following; otherwise delete: All references to [insert fictitious company name] refer to a fictitious company and are used for illustration purposes only IBM Corporation

56 BACKUP Material IBM Corporation

57 Health Insurance Provider Industry Pains: HIPAA Security requirements for transporting data over the Internet HL7 v3.0 XML threat protection Complexity of B2B for healthcare Smarter Business Outcomes: Reliable and secure routing of customer sensitive data Easy to use and maintain; no additional skill needed XML Messages with attachments are authenticated, authorized, and virus scanned Value of DataPower B2B Appliances for Extending Connectivity? Secure appliance form factor providing secure connections to trading partners, advanced threat protection and reliable file delivery of confidential medical information IBM Corporation

58 EDIINT Flow: Simple AS2 transaction flow with Transform Partner A Partner B 1 Application EDI B2B Hub AS2 Process 2 AS2 (EDI) Internet AS2 (MDN) 4 XB62 B2B Gateway Service Data Store 3a 3b XML Application Transaction Viewer 5 Browser Note: This flow works the same for any AS protocol as well as for ebms B2B messages. 58

59 Agenda DataPower Quick Overview Security & Optimization Gateway Mobile Connectivity API Management Integration Mainframe Integration & Enablement B2B IBM Corporation

60 Why use an Appliance for connectivity? Many functions incorporated in a single device Service level management Dynamic routing and load distribution Transport and message level security Policy enforcement Transport and message transformation Simplified maintenance model Drop-in appliance form-factor Secures traffic in minutes Push-button flash upgrade process Integrates with existing operations Provides high levels of certified security assurance Transport Protocol Security (SSL/TLS) Message Level Security Authentication, Authorization, Audit (AAA) FIPS Level 3 Purpose-built, fine-tuned consumable platform Achieves fast performance with multiple layers of specialized acceleration IBM Corporation

61 Agenda DataPower Quick Overview Security & Optimization Gateway Mobile Connectivity API Management Integration Mainframe Integration & Enablement B2B IBM Corporation

62 DataPower & Tivoli Offerings DataPower integrates with Tivoli offerings to provide authentication and authorization policy enforcement point solution Tivoli Security Policy manager (TSPM) Allows authoring of XACML policy to be enforced by DataPower. [PAP] TSPM can also act as PDP to make Authorization decisions [PDP] DataPower will enforce the decision. [PEP] Locally cached TAM policy database reduces network latency and traffic congestion Tivoli Access Manager (TAM) Provides a single point of decision making for Authentication and Authorization. [PDP] Tivoli Federated Identity Manager (TFIM) Provides federated identity management and a single IdP enterprise solution [Federation] PAP: Policy Authoring Point PDP: Policy Decision Point PEP: Policy Enforcement Point 62

63 Application Optimization Application Optimization (AO) is about leveraging application knowledge in the network to better optimize application behavior, conformance, and performance Internet DMZ Trusted Domain Application Optimization - Application Intelligence - Application Security - SSL Acceleration System z Consumer Application Consumer SOA Optimization - XML Intelligence - XML Security - Routing, Transformation, Mediation Application 63

64 Application Optimization Self Balancing: Self balance across a cluster of appliances Replace front-end IP load balancer New support (introduced in firmware version 4.0.2) enables connections to be preserved, without loss, during failover scenario Dynamic and Intelligent Load Distribution to backend systems Replace backend load balancer Front-end IP load balancers not needed Self balancing (IP spraying) 64

65 Application Optimization Provides application-aware Intelligent Load Distribution Auto-discovers application targets and distributes load using dynamic feedback mechanism Topology learning for WAS ND and VE Uses intelligent weighted distribution algorithms based on current server load Weighted Least Connection load balancing algorithm Provides several options for enabling Session Affinity 65 DataPower performs dynamic backside routing and load distribution (leveraging dynamic information from back-ends) Failure of target appliances are masked by appropriate weighted distribution

66 Agenda DataPower Quick Overview Security & Optimization Gateway Mobile Connectivity API Management Integration Mainframe Integration & Enablement B2B IBM Corporation

67 Integration Content-Based Routing Dynamically route based on any message content Attributes such as the originating IP, requested URL, protocol headers, etc. Data within the message such as SOAP Headers, XML, Non-XML content, etc. Query a repository for routing information WebSphere Service Registry & Repository, XML files, Databases, Web Servers Unclassified Requests Any-To-Any Message Transformation Transform the message format with ultimate flexibility Leverage WebSphere Transformation Extender for data mapping Service Providers Input Message Output Message?? 67 <XML/> TEXT binary WebSphere TX Design Studio <XML/> TEXT binary

68 Integration Transport Protocol Translation Integrate disparate transport protocols with extreme ease No dependencies between inbound front-side and outbound back-side Examples: HTTP(s), WebSphere MQ, WebSphere MQ FTE, WebSphere JMS, Tibco EMS, SFTP, FTP(s), NFS, IMS, Database (DB2, Oracle, Sybase, SQL Server) Support synchronous, asynchronous, pub-sub, assured-delivery, once-and-only once message patterns HTTP(s) WebSphere JMS WebSphere MQ, MQ FTE TIBCO EMS FTP(s) SFTP IMS NFS Database DB2, SQL Server, Oracle, Sybase, 68

69 Agenda DataPower Quick Overview Security & Optimization Gateway Mobile Connectivity API Management Integration Mainframe Integration & Enablement B2B IBM Corporation

70 IMS Integration Web Services Security and Management for IMS Web Services Content-based Message Routing Protocol Bridging (HTTP, MQ, JMS, FTP, etc.) XML/SOAP Firewall Data Validation Field Level Security XML Web Services Access Control/AAA Web Services Management Client SOAP/HTTP DataPower SOAP/HTTP IMS SOAP Gateway WAS+IMS connector 70

71 IMS Integration Web Services Enablement for IMS-based Services DataPower provides WS-enablement to IMS applications User codes schema-dependent WTX data map to perform request/response mapping Requires WebSphere MQ for z/os MQ bridge to access IMS MQ connectivity is embedded in DataPower Client SOAP/HTTP DataPower CCB / MQ MQ Server MQ Brdg IMS O T M A IMS Application 71

72 IMS Integration Web Services Enablement for IMS-based Services (cont d) DataPower provides WS-enablement to IMS applications User codes schema-dependent WTX data map to perform request/response mapping IMS Connect Client (back-side handler) natively connects to IMS Connect using its custom request/response protocol Client SOAP/HTTP DataPower CCB / TCP IMS Connect User exit (e.g.. HWSSM PL0) IMS O T M A IMS O T M A Appl1 Appl2 Appl3 Appl4 Appl5 Appl6 72

73 IMS Integration IMS Connect Reverse Proxy Bring DataPower value add to standard IMS connect usage patterns Provide an IMS Connect Client on DataPower that natively connects to IMS Connect Provide an IMS Connect Server on DataPower that accepts IMS Connect client connections and provides an intermediation framework that leverages DataPower Enables authentication checks, authorization, logging, SLM, transformation, route, DB look-up, SSL offload, etc. Client IMS Connect TCP DataPower CCB / TCP IMS Connect User exit (e.g.. HWSSM PL0) IMS O T M A IMS O T M A Appl1 Appl2 Appl3 Appl4 Appl5 Appl6 73

74 DB2 Integration Information as a Service DataPower provides a standard WS façade to DB/2 Common tool (IBM Data Studio 1.2+) to generate WSDL and data mapping in both Data Web Services runtime and DataPower SOAP call is mapped to an ODBC (DRDA) invocation Exposes database content (information) as a service Leverages extensive Web Services security and management capabilities of DataPower to more securely expose critical data to the enterprise Client SOAP/HTTP DataPower DRDA DB2 74

75 CICS Integration Web Services Security and Management for CICS Web Services Content-based Message Routing Protocol Bridging (HTTP, MQ, JMS, FTP, etc.) XML/SOAP Firewall Data Validation Field Level Security XML Web Services Access Control/AAA Web Services Management Support CICS ID propagation SOAP/HTTP DataPower SOAP/HTTP CICS Web Services WAS+CICS connector Client 75

76 CICS Integration Web Services Enablement for CICS Applications DataPower provides WS-enablement to CICS applications User codes schema-dependent WTX data map to perform request/response mapping Requires WebSphere MQ for z/os MQ bridge to access CICS MQ connectivity is embedded in DataPower Client SOAP/HTTP DataPower CCB / MQ MQ Server CICS Brdg CICS CICS Application 76

77 Agenda DataPower Quick Overview Security & Optimization Gateway Mobile Connectivity API Management Integration Mainframe Integration & Enablement B2B IBM Corporation

78 Web Services bridged to AS2 File Transfer Pattern Partner A Partner B B2B Hub XB62 1 Flat Pre-Process B2B Gateway Service 5 Flat WS Client SOAP Web Service Process 2 Internet AS2 Web Service Proxy Data Store Transaction Viewer 7 Browser 78 Note: A Multi-Protocol Gateway Service can also be used to support this flow as well as receiving and sending data over any of the 16 supported protocol handlers. When Services are tied together in front of or behind a B2B Gateway Service they are handled like pre and post processes.

79 MQ FTE Integration Pattern Inbound File to Message Enterprise Browser (Admin) Trading Partner 1 Internet 3 XB62 B2B Gateway Service Profile Mgmt 2a Data Store 2 Queue Manager MQFTE Network Queue Manager Queue Manager Queue Manager 4 5 Server Source Agent Target Agent Data Store 6 XB60 Transaction Viewer DB (DB2 or Oracle) Logger MQ Explorer Applications Browser (Partner view) Browser (LOB User) 79

80 ebxml with CPPA Pattern Public Network DMZ WebSphere DataPower B2B Appliance Secured Network B2B Gateway Service External Partners ebms (ebxml)) 1 Internet ebms (Ack) 4 2 Collaboration Partner Agreement Collaboration Entries Protocol Collaboration Agreement Entry Partner CPAId Agreement / Collaboration Entries CPAId / Collaboration Internal CPAId Collaboration / Collaboration Internal Partner Collaboration Profile Internal Partner Collaboration Profile External Collaboration Partner Profile External Partner Collaboration Profile External Partner Collaboration Profile Partner Profile 3 ebxml Applications 5 Transaction Viewer Browser 80

81 Health Level 7 3.x to 2.x Transform Pattern Partner A Regional Healthcare Center Partner B Hospital B2B Appliance B2B Hub AS2 Process Any Transport HL7 V3.x 1 AS2 (HL7 V3) AS2/MDN Internet 5 HL7 V3 3 2 B2B Gateway Service Profiles External Profile Hospital Internal Profile Regional Center 4 Any Transport HL7 V2.x Healthcare Applications Validate XML and Transform to any V.2.x format Healthcare Applications Transaction Viewer 6 81

82 Securing HL7 over the Internet with Integration to the WebSphere Healthcare Connectivity Pack Healthcare Provider Trading Partner 1 Internet AS2 (MDN)) AS2 (HL7)) 3 XB62 B2B Gateway Service Profile Mgmt 2a Data Store 2 HL7/MQ 4 WebSphere MQ Browser (Admin) WebSphere Healthcare Connectivity Pack HL7/MLLP 5 XML/HTTP Clinical Trials System Billing System HL7/MLLP Browser (Partner view) Transaction Viewer HL7/MLLP Pharmacy Patient Administration System 82