IBM Addresses Web 2.0 Security Concerns With 'SMash'

• By Dian Schaffhauser
• 03/19/08

IBM announced new technology to secure "mashups," Web applications that pull information from multiple sources, such as Web sites, enterprise databases, or e-mails, to create one unified view. Mashups allow users to gain insight on complex situations but, as with all Web-based initiatives, security has been a concern.

IBM researchers have created a new technology, codenamed "SMash," short for secure mashup, that allows information from different sources to talk to each other, but keeps them separate so malicious code can't be introduced into systems.

IBM is contributing the SMash technology to the OpenAjax Alliance, an organization of vendors, open source projects and companies using AJAX, of which it is a part.

"Web 2.0 is fundamentally about empowering people, and has created a societal shift in the way we organize, access, and use information," said Rod Smith, IBM Fellow and vice president. "Security concerns can't be a complete inhibitor, or clients lose out on the immense benefit mashups bring. The same way you wouldn't buy a car and then later decide to have the seatbelts or airbags installed, as an industry we've learned how to build security into business operations from the ground up instead of tacking it on after the fact."

SMash addresses a part of the browser mashup security issue by keeping code and data from each of the sources separated, while allowing controlled sharing of the data through a secure communication channel. IBM said it plans to include SMash technology in WebSphere products and its commercial mashup maker, Lotus Mashups, expected in the summer. Lotus Mashups is IBM's first commercial mashup maker for organizations. It will allow non-technical users to create and share mashups in a secure way.

A detailed description of SMash will appear in the 17th International World Wide Web Conference, to be held in Beijing, China, in April 2008.