© 2015 IBM Corporation IBM DataPower Gateway & V7.1 Overview Ozair Sheikh, Senior Product Manager IBM DataPower Gateways Arif Siddiqui, Principal Product

© 2015 IBM Corporation

IBM DataPower Gateway & V7.1Overview

Ozair Sheikh, Senior Product Manager IBM DataPower Gateways

Arif Siddiqui, Principal Product Manager – Strategic InitiativesIBM DataPower Gateways & API Economy

© 2015 IBM Corporation2

Agenda

DataPower Gateway Overview Recent Releases What’s New in DataPower Gateway & V7.1 Q&A


DataPower Gateways …

3

IBM DataPower Gateways provide a low startup cost,helping clients increase ROI and reduce TCO with

specialized, consumable, dedicated gateway appliances thatcombine superior performance and hardened security in

physical and virtual form factors

INTEGRATE Systems of Engagement with Systems of Record

CONTROL & MANAGE Traffic and Service Level Agreements

SECURE Mobile, API, Web, SOA, B2B and Cloud Workloads

OPTIMIZE Data Delivery and User Experiences

CONSOLIDATE & Simplify Infrastructure Footprint


Gateway for the Multi-channel Enterprise

Single security and integration gateway platform to provide security, integration, control & optimized access to a full range of Mobile, API, Web, SOA, B2B, & Cloud workloads

B2B

Simplify mobile security with single, purpose-built gateway; control mobile traffic and accelerate delivery

WebSimplify web security with single, purpose-built gateway; control traffic and accelerate delivery for intranet and internet web applications

CloudDataPower gateway functionality in a virtual appliance form factor, supports multiple hypervisor & cloud environments

IBM DataPower GatewayAPI

Easily secure, control, publish, monitor & manage your APIs

SOASecure, integrate, control &

manage SOA workloads in the DMZ and Trusted zones

Extend Connectivity & Integration beyond the enterprise with DMZ-ready B2B edge capabilities

Mobile


IBM DataPower Gateway Appliances are the industry-leading Security & Integration gateways that help provide security, integration, control and

optimized access to a full range of Mobile, Web, API, SOA, B2B, & Cloud workloads

Common Use Cases

Internet Trusted Domain

Consumer

Application or Service

DMZ

Trading partners

1 Mobile Gateway

2 API Gateway

3 Web Gateway

4 B2B Partner Gateway

5 SOA & API Gateway

6 ESB / Integration Gateway

7 Internal Security Enforcement

8 Web Services Governance & Management

9 Legacy Integration

Consumer

Middleware

z System

DataPower Gateway DataPower Gateway


IBM API Management: One Integrated Platformdesign, secure, control, publish, monitor & manage APIs

Explore API documentation

Provision application keys

Self-service experience

Developer Portal API Manager Management Console

Define and manage APIs

Explore API usage with analytics

Manage API user communities

Provision system resources

Monitor runtime health

Scale the environment

API Gateway (IBM DataPower)

Enforce runtime policies to control API traffic


Features

Before DataPower Gateway After DataPower Gateway

Control

Integrate

Optimize

SecureConsumer

Consumer

Consumer

Consumer

Simplify, offload & centralize critical functions

IntegrateAny-to-any message

transformation

Transport protocol bridging

Message enrichment

Database connectivity

Mainframe connectivity

B2B trading partner connectivity

Control OptimizeSecureSSL / TLS offload

Hardware accelerated crypto operations

JSON, XML offload

JavaScript, JSONiq, XSLT, XQuery acceleration

Response caching

Intelligent load distribution

Service level management

Quota enforcement, rate limiting

Message accounting

Content-based routing

Failure re-routing

Integration with management & visibility

platforms

Authentication, authorization, auditing

Security token translation

Threat protection

Schema validation

Message filtering & semantics validation

Message digital signature

Message encryption


Deployment options

Purpose-built, DMZ-ready appliances provide physical security

High density 2U rack-mount design 8 x 1 and 2 x 10 GbE ports Cryptographic acceleration card Trusted platform module Customized intrusion detection Optional HSM (FIPS 140-2 Level 3 certified)

Virtual appliances provide deployment flexibility

Support multiple hypervisors and cloud environments− VMware

− Citrix XenServer

− IBM PureApplication System (x86 nodes)

− IBM PureApplication Service on SoftLayer (x86 nodes)

− IBM SoftLayer bare metal instances using supported hypervisors

VirtualPhysical


Purpose-built hardware provides physical security

• Sealed, tamper-evident case

• No usable USB, VGA, other ports

• Intrusion detection switch

• Trusted Platform Module

• Encrypted flash drive

• FIPS 140-2 level 3 Hardware Security Module (option) for secure storage of private keys

Hardened firmware provides platform security for physical & virtual gateways

• Single signed and encrypted firmware by IBM

• No arbitrary software

• Optimized, embedded operating system

• High assurance, “locked-down” configuration

• Key materials are not exportable from the appliance *

Enterprise grade security requires a secure platform


Virtual Edition DataPower gateway functionality in virtual appliance form

factor to rapidly secure, integrate, control & optimize access to Mobile, API, Web, SOA & B2B workloads in hypervisor & clouds platforms

Use for development, test or production

Supports multiple hypervisor & cloud platforms VMware Citrix XenServer IBM PureApplication System W1500/W2500 IBM PureApplication Service on SoftLayer (x86) IBM SoftLayer bare metal instances on x86 nodes

Seamless configuration migration between physical

and virtual appliances

Utilizes the same industry-proven & purpose-built platform including an embedded, optimized DataPower Operating System, that powers the physical appliances

x86 Server

Delivers purpose-built, highly consumable Security & Integration Gateway functionality in virtual appliance form factor for cloud deployments


Virtual Edition BenefitsDeployment flexibility and elasticity – “Right size” the

deployment, quickly deploy where needed, & rapidly scale

Workload isolation - Projects can use their own instances

Unbounded memory scalability - Memory can be added to instances without additional licensing

Low cost for Dev & Test environments - Developers & Non-Production versions include add-on software modules at no additional charge

Free disaster recovery - Warm or cold backup without additional licenses when licensed for Production

Flexible licensing and entitlement Sub-capacity licensing Monthly licensing option Entitlement to future product versions at no

additional charge with active maintenance (S&S)

x86 Server

Delivers purpose-built, highly consumable Security & Integration Gateway functionality in virtual appliance form factor for cloud deployments


• Used by 95% of top global insurances firms

• SaaS providers, ASPs, regulators, etc.

• Agencies and ministries• Defense and security organizations• Crown corporations

Insurance

Government

Banking

• Healthcare• Retailers• Utilities, Power, Oil and Gas• Telecom• Airlines• Others

Many, many, more

• Majority of the big US and European banks

• All of the big 5 Canadian banks• Numerous regional banks and credit

unions

DataPower GatewaysOver 14 years of innovation & over 2,000 global installations


DataPower’ing IBM Bluemix!!!• Security

• Control• Filtering• Content-Based Routing• Load balancing• Monitoring and Logging

Mobile client

Bluemix Tooling

VM

Application Manager

AppApp

AppApp

ServiceService

ServiceService

Open Stack

External ServiceExternal

Services

Internet

Did you know?DataPower has been trusted to be the exclusive gateway

for Bluemix, IBM’s global Platform as a Service


Agenda



Provides the API gateway functionality for IBM API Management

Quick integration with IBM Worklight to secure mobile web traffic

Improved REST services handling with native JSON support including schema validation & query, extract, filter & transform through JSONiq

New XML data query, extraction & manipulation support with XQuery 1.0

Enhanced security with new OAuth 2.0 capabilities, new support for Kerberos constrained delegation (S4U2Proxy), and TLS 1.1/1.2

Improved WS-MediationPolicy consumption from WSRR & SLAs for non-SOAP traffic

Embedded On-Demand Router functionality for WAS ND environments

Optimized application delivery with response caching on-the-box & seamless integration with elastic caching XC10 appliances

New System z integration capabilities allowing IMS transactions to easily consume external web services & easy consumption of IMS data as a service

Simple ability to create & deploy common DataPower configuration patterns

Highlights of DataPower v6.0ReleasedJune 2013


Adds Application Optimization (optional add-on module) on XB62 Support for self-balancing and intelligent load distribution Eliminate load balancing hops - reducing cost & complexity + improving scalability & performance

Empowers XB62 to provide API gateway functionality for IBM API Management solution Enables a converged solution for B2B and API management gateways

NIST SP800-131a security standard compliance + FIPS 140-2 Level 1 certified cryptography module Enables U.S. Federal & Public sector customers to meet government mandated security standard Supported on both physical & virtual appliances

Enhanced support for Web, Mobile & REST workloads

Enhanced Configuration Pattern Console Improved error handling and description Adds version support for configuration patterns

Important Note: This firmware is not supported on 9004 appliances, i.e. XS40, XI50 or XB60

Links: Release Notes: http://pic.dhe.ibm.com/infocenter/wsdatap/v6r0m1/index.jsp?topic=%2Fcom.ibm.dp.xi.doc%2FrelnotesXI.html

Highlights of DataPower v6.0.1ReleasedDec 2013

http://pic.dhe.ibm.com/infocenter/wsdatap/v6r0m1/index.jsp?topic=/com.ibm.dp.xi.doc/relnotesXI.html


GatewayScript: A JavaScript runtime that is secured, optimized and tuned for the gateway environment to simplify configuration for developers and provide an easier development paradigm for Mobile, Web, & API

New Virtual Edition for Developers provides a low cost, per user pricing, and easy to use gateway for developers

Support for Citrix XenServer hypervisor provides additional deployment flexibility on-premise & cloud deployments

WebSocket Proxy support enables full-duplex, bi-directional, & low-latency communication for Mobile & Web applications, Internet of Things

Improved security & traffic control functionality in support of IBM API Management offering

Highlights of DataPower v7.0

GatewayScript

ReleasedJune 2014


Agenda



Secure. Integrate. Control. Optimize.

7.1DataPower

IBM Gateway

ReleasedNov 2014

Consolidated productSingle, modular & extensible gateway platform to secure, integrate, control, & optimize full range of workloads

New hardware platformIncrease capacity & throughput while reducing latency with latest generation hardware

Deployment flexibilityUse physical or virtual appliance with seamless configuration migration with on-premise & cloud deployments

B2B moduleCentralize B2B trading partner connectivity & transaction management with high performance secure entry point in the DMZ

Multi-channel gatewayUtilize single gateway with integrated access enforcement from ISAM to secure & optimize delivery of mobile, API, web, SOA, B2B, cloud apps, and integrate with IBM MobileFirst & WebSphere platforms

Enhanced securityEnable additional flexible authentication from internet consumers & Non-Microsoft consumers to Microsoft systems


Highlights of IBM DataPower Gateway & V7.1 Single multi-channel gateway platform to secure & optimize

delivery of mobile, API, web, SOA, B2B, cloud apps, and integrate with IBM MobileFirst & WebSphere platforms

Integrates industry-proven access enforcement capabilities of IBM Security Access Manager into the DataPower platform, available as add-on ISAM Proxy Module

IBM DataPower Gateway is the new name of a consolidated, extensible & modular platform

Converges three existing products, XG45 / XI52 / XB62, into a single modular offering

Physical appliance uses purpose-built latest generation hardware platform to provide increased performance & capacity

Virtual appliance runs on VMware & Citrix XenServer hypervisors and cloud platforms that support them

Easy-to-use & secure B2B integration capabilities, formerly on XB62 appliances only, available as add-on B2B Module

Enable authentication from internet consumers & Non-Microsoft consumers to Microsoft systems with Kerberos S4U2Self support


IBM DataPower Gateway is the new name of a consolidated, extensible & modular platform Converges three existing products, XG45 / XI52 / XB62, into a single modular offering Available in physical and virtual form factor Supports V7.1 and above

Physical Appliance

2U rack mount appliance using latest generation hardware platform Two base editions: Non-HSM and HSM (FIPS 140-2 Level 3 certified)

Each software module is licensed separately

Virtual Edition Three editions: Developer, Non-Production, Production Developer includes all software modules at no additional cost, except TIBCO EMS Non-Production includes all software modules at no additional cost, except TIBCO EMS & ISAM Proxy Production: Each software module is licensed separately

Add-on software modules provide additional functionality that can be activated quickly when needed

IBM API Management solution requires base IBM DataPower Gateway as runtime for executing API workloads

Single, modular & extensible platform (1 of 2)


Modules

ISAM Proxy Module User access control, session

management, web SSO enforcement Advanced mobile security: mobile

SSO, context-based access, one-time password, multi-factor authn

Integration with ISAM for Mobile

Application OptimizationModule

Frontend self-balancing Backend intelligent load distribution Session affinity z Sysplex Distributor integration

Integration Module

Any-to-Any message transformation Database connectivity Mainframe IMS connectivity

B2B Module B2B DMZ gateway EDIINT AS1,AS2,AS3,ebXML Partner profile management B2B transaction viewer Any-to-Any message transformation Database connectivity

TIBCO EMSModule

Integrate with TIBCO EMS messaging middleware

Support for queues & topics Load balancing & fault-tolerance

IBM DataPower Gateway (Base)Secure

Authentication, authorization Security token translation Service / API virtualization Threat protection Message validation Message filtering Message digital signature Message encryption AV scanning integration

Integrate Transport protocol bridging Message enrichment Message transformation &

processing using JavaScript, JSONiq, XQuery, XSLT

Mainframe integration & enablement

Flexible pipeline message processing engine

Control & Manage Service level management Quota & rate enforcement Content-based routing Message accounting Integration w/ management &

visibility platforms including IBM API Management & WSRR for policy enforcement

Optimize & Offload SSL / TLS offload Hardware accelerated crypto* JSON, XML offload JavaScript, JSONiq, XSLT,

XQuery acceleration Local response caching Distributed caching with WXS

or XC10 Backend load balancing

2U Physical or Virtual Edition

Single, modular & extensible platform (2 of 2)


Latest Generation Hardware Platform Trusted Platform Module

Customized intrusion detection

Cryptographic Acceleration Card

Hardware Security Module (Optional, FIPS 140-2 Level 3 certified)

Runtime Hardware Diagnostic

Intelligent Platform Management Interface

Supercapacitor Powered Flash-backed RAID Cache

Multiple Replaceable Units– Customer Replaceable Units (CRU)

• Fan, Power Supply, HDD, Network Module– Field Replaceable Units (FRU)

• Appliance, CPU, Memory, Flash Drive, Coin Battery, Supercapacitor for RAID

• Cryptographic Acceleration Card, HSM Card, RAID Card

Purpose-built, high density 2U rack mount design

Increased capacity‒ Higher performance CPU & memory‒ Faster cryptographic acceleration card‒ New RAID controller w/ large write cache

192 GB memory

Two 1.2 TB high speed hard drives

Three management traffic ports 1 RJ45 serial port 2 x 1 GbE ports

Ten application traffic ports‒ 8 x 1 GbE ports‒ 2 x 10 GbE ports

2 10-Gigabit Ethernet NICs

8 1-Gigabit Ethernet NICs

RAID mirroring across two drives


Comparison with older products

IBM WebSphere DataPower Service Gateway XG45

(1U Physical, Virtual Edition)

IBM WebSphere DataPower Integration Appliance XI52


Previously3 Products (XG45/XI52/XB62)

2 Physical appliances (1U & 2U)2 Virtual appliances (XG45/XI52)

Now1 Product

1 Physical appliance (2U only)

1 Virtual appliance

IBM DataPower Gateway Virtual Edition provides the same functionality & modules as physical appliances with the exception of

HSM (that provides FIPS 140-2 Level 3 certification)

Integration & B2B Module are independent & can be purchased separately

IBM DataPower Gateway + Integration Module


IBM WebSphere DataPower B2B Appliance XB62

(2U Physical)

IBM DataPower Gateway


IBM DataPower Gateway + B2B Module


IBM DataPower Gateway 2U rack mount physical appliance is available with optional HSM (FIPS 140-2 Level 3 certified)


Firmware V7.1, Modules & Supported Platforms Firmware V7.1 delivers

ISAM Proxy Module to enable advance access enforcement of mobile & web use cases B2B Module to enable secure B2B integration capabilities, formerly available on XB62 only Integration Module to enable integration functionality including any-to-any message

transformation, database connectivity & mainframe connectivity Kerberos S4U2Self functionality to provide flexible authentication for Microsoft environments Increase in XML Names maximum to allow for large configurations, RAS & other enhancements

V7.1 supports the following IBM DataPower Gateway (Physical and Virtual Edition) XG45 (Physical and Virtual Edition) XI52 (Physical and Virtual Edition), XI50B (2426 & 4195 models) XB62 (Physical)

ISAM Proxy module requires V7.1 and is available on the following IBM DataPower Gateway (Physical and Virtual Edition) XG45 (Physical, and Virtual Edition) XI52 (Physical, and Virtual Edition) XB62 (Physical)

B2B module requires V7.1 and is available on the following IBM DataPower Gateway (Physical and Virtual Edition) XG45 (Physical, and Virtual Edition) XI52 (Physical, and Virtual Edition)

Integration module requires V7.1 and is available on the following IBM DataPower Gateway (Physical and Virtual Edition)


Applications and Systems

Silos of security & control are impeding business agility

DEVELOPERSPARTNERS CONSUMERS

EMPLOYEES

WEBMOBILEB2B SOA APIS

PARTNERS

DEVELOPERS

API GATEWAY

B2BGATEWAY

SOAGATEWAY

WEB ACCESS PROXY

MOBILE GATEWAY

Business Channels

Users

Security & Control

Solutions

CLOUD

ALL

CLOUD GATEWAY

CONSUMERS

EMPLOYEES

z SystemMiddleware

ESBApplication Service


Applications and Systems

DEVELOPERSPARTNERS CONSUMERS

EMPLOYEES

WEBMOBILEB2B SOA APIS

PARTNERS

DEVELOPERS

Business Channels

Users

Security & Control

Solutions

CLOUD

ALLCONSUMERS

EMPLOYEES

Reduce cost + improve security & control with a single gateway

z SystemMiddleware

ESBApplication Service

Virtual appliance Physical appliance

DataPower Gateway


IBM Multi-channel gateway

ISAM for DataPower module provides the reverse proxy component that provides enforcement for Centralized user authentication & coarse-grained authorization Session management, & web SSO Context based access & mobile SSO Strong authentication including one-time password and multi-factor authentication

Leverage the combined capabilities of IBM DataPower Gateway and IBM Security Access Manager in a single, converged security and integration gateway

New in V7.1


Web Browsers and Portals

MobileWeb

Web 2.0 (AJAX)

NativeMobile

B2B HybridMobile

APISOA (Web Services)

App, Service & APIsecurity


ISAM Module

User access security

Traffic control & optimization

Connectivity &transformation


What is ISAM for DataPower Module?

ISAM for DataPower module provides the reverse proxy component that is available on ISAM for Web and ISAM for Mobile appliances

ISAM Module

DataPower

Base Appliance• Reverse Proxy

IBM SecurityAccess Managerfor Mobile• Context

based Access (CBA)

• One-time Password (OTP) / Multi-factor Authentication (MFA)

• Advanced Security

IBM SecurityAccess Managerfor Web• Load

Balancer• Protocol

Analysis Module (PAM)

ISAM for Web was formerly known as Tivoli Access Manager for E-Business (TAMeb)


SSL OffloadThreat Protection

Rate Limiting / SLA EnforcementValidation, Filtering

AuthenticationAuthorization

Context-based AccessMobile SS0

Security Token TranslationMessage TransformationContent-Based Routing

Intelligent Load DistributionResponse Caching

Middleware / ESB, Legacy Apps

Apps, Services

Rapidly Connect Mobile Apps with Enterprise ServicesSecurely expose enterprise data & APIs to Mobile Apps while optimizing delivery


ISAM Module

/apimanagement

Native, Hybrid, Mobile Web


DataPower appliance with ISAM module for security enforcement, traffic control & management, application acceleration, transport bridging & message transformation

ISAM for Mobile as decision point for context based access (CBA), mobile SSO, strong authentication including one-time password (OTP) & multi-factor authentication (MFA)

Mobile Gateway solution for on-premise and cloud

ISAM for Mobile

Rapidly deliver secure integration & optimized access for enterprise mobile applications

DataPower Gateway(Security Enforcement Point)

ISAM Module

Apps, Services, Middleware,

(Security Decision Point)

z System


Multi-Channel Gateway for MobileFirst & WebSphere Products


REST

1

5

3

2 4? +Client

Provider

Improve Response

Time

Imp

rove

d L

oad

DataPowerLarge Response Time

WebSphere Extreme Scale (WXS)

http://www-01.ibm.com/support/docview.wss?uid=swg21697033

1. Client submits application request.

2. DataPower parses request and queries WXS. On a hit, skip to step 5.

3. On a miss, DataPower forwards request to target Provider.

4. DataPower adds application response to WXS.

5. Client receives response from DataPower.

Response Caching Integration with WXSIn addition to support for XC10

http://www-01.ibm.com/support/docview.wss?uid=swg21697033


Enhance security intelligence and compliance through integration with QRadar security information and event management (SIEM) platform

Coming soon: Device Support Module (DSM) for DataPower Gateways to parse event information

Integration with QRadar Security Intelligence Platform

QRadar SIEM

User

ClientProvider

DataPower


DataPower on GitHub Repository of DataPower related tools & collateral

Open source Community driven: Use, collaborate, contribute http://ibm-datapower.github.io/

DataPower Configuration Manager Tool for DataPower configuration management & migration Standalone command line or IBM UrbanCode Deploy plugin https://github.com/ibm-datapower/datapower-configuration-manager https://github.com/ibm-datapower/datapower-configuration-manager/wiki/Easy-On-Ramp

DPXMLSH Bash script / shell library for working with DataPower’s XML Management interface Interactive & scripted use https://github.com/ibm-datapower/datapower-xml-shell

http://ibm-datapower.github.io/

https://github.com/ibm-datapower/datapower-configuration-manager

https://github.com/ibm-datapower/datapower-configuration-manager/wiki/Easy-On-Ramp

https://github.com/ibm-datapower/datapower-xml-shell


Secure. Integrate. Control. Optimize.

7.1DataPower

IBM Gateway

ReleasedNov 2014

Consolidated productSingle, modular & extensible gateway platform to secure, integrate, control, & optimize full range of workloads

New hardware platformIncrease capacity & throughput while reducing latency with latest generation hardware

Deployment flexibilityUse physical or virtual appliance with seamless configuration migration with on-premise & cloud deployments

B2B moduleCentralize B2B trading partner connectivity & transaction management with high performance secure entry point in the DMZ

Multi-channel gatewayUtilize single gateway with integrated access enforcement from ISAM to secure & optimize delivery of mobile, API, web, SOA, B2B, cloud apps, and integrate with IBM MobileFirst & WebSphere platforms

Enhanced securityEnable additional flexible authentication from internet consumers & Non-Microsoft consumers to Microsoft systems


Agenda



Getting Social with IBM DataPower Gateways

DataPower on Slideshare LinkedInIBM DataPower Gateway Group

developerWorks BlogYouTubeIBM DataPower Gateway Channel

Twitter@IBMGateways

Online User Forum

• YouTube Channel: IBM DataPower Gateways• Slideshare: IBM DataPower Gateway• Twitter: @IBMGateways• LinkedIn Group: IBM DataPower Gateway • developerWorks blog: IBM DataPower Gateway• GitHub: IBM DataPower Gateway• Online User Forum• Product page on ibm.com• Product documentation

https://www.youtube.com/channel/UCV2_-gdea5LM58S-E3WCqew/feed

http://www.slideshare.net/ibmdatapower

https://twitter.com/IBMGateways

https://www.linkedin.com/groups?home=&gid=4820454&trk=anet_ug_hm

https://www.ibm.com/developerworks/community/blogs/ozairs/entry/the_business_value_of_datapower_gateway_appliances?lang=en

https://www.ibm.com/developerworks/community/blogs/ozairs/entry/the_business_value_of_datapower_gateway_appliances?lang=en

https://github.com/ibm-datapower/

https://www.ibm.com/developerworks/community/forums/html/forum?id=11111111-0000-0000-0000-000000001198

http://www-03.ibm.com/software/products/en/datapower

http://www-01.ibm.com/software/integration/datapower/library/documentation


Available Now: DataPower Handbook, Second Edition, Volume 1

Known as the ‘bible’ of DataPower planning, implementation, and usage.

New content to cover previous six years of new products/features, including 9006/7.1!

Volume 1 consists of Chap 1 DataPower Intro, Chap 2 Setup Guide, new Preface and two invaluable new appendices for physical and virtual appliances.

Available in softcover and e-book formats


BACKUP


Simple Architecture: Purpose-built firmware + hardware Complete gateway platform delivered as firmware

Guiding philosophy is to centralize common security, integration, control, traffic management, acceleration functions and optimize them in a security-hardened gateway appliance

Simple and Secure Architecture

Display Ports

database

configApp

Server

config

Apache HTTPD

config

JVM

config

Proprietary Software

config

Linux Daemons

configJSP

Engineglibclibxml

Full Linux OS(including shells and user accounts)

config

Bootable CDROM

Drive

Bootable USB Ports

Hardware

Commodity Gateways

config

Hardware

DataPower Gateway PlatformDigitally Signed and Encrypted

Firmware

FlashMemory

Crypto Acceleratio

n

IBM Optimized Embedded Operating Environment

Purpose-built Gateways


Configuration-driven approach speeds time to market

• Enforce security standards with zero coding• Uses intuitive pipeline message processing• Import/export configurations between

environments• Transaction probe shows message content

between actions for debugging

42



ISAM Proxy

Module

Integration Module

B2B Module

AO Module

TIBCO EMS

Module

IBM DataPower Gateway is the new name of a consolidated, extensible & modular platform Converges three existing products, XG45 / XI52 / XB62, into a single modular offering Available in physical and virtual form factor

Physical Appliance

2U rack mount appliance using latest generation hardware platform Two base editions: Non-HSM and HSM (FIPS 140-2 Level 3 certified)

Each software module is licensed separately

Virtual Edition Three editions: Developer, Non-Production, Production Developer includes all software modules at no additional cost, except TIBCO EMS Non-Production includes all software modules at no additional cost, except TIBCO EMS & ISAM Proxy Production: Each software module is licensed separately

Supports V7.1 & above

All software modules are field upgradeable

Single, modular & extensible platform


CapabilitiesRapidly deliver secure integration & optimized access for a full range of workloads

• Secure & protect your back-end systems from harmful workloads and unauthorized users & apps

• Convert payloads, bridge transports and connect to existing services at wire-speed

• Limit & shape traffic based on service level agreements, and route based on message content

• Improve response times, reduce load on backend systems and intelligently distribute load

Secure

Control

Integrate

Optimize

Before DataPower Gateway After DataPower Gateway

Control

Integrate

Optimize

SecureConsumer

Consumer

Consumer

Consumer


SSL OffloadThreat Protection

Rate Limiting / SLA EnforcementValidation, Filtering

Authentication, AuthorizationContext-based Access, Mobile SS0

Security Token TranslationMessage TransformationContent-Based Routing

Intelligent Load DistributionResponse Caching

Connect Mobile Apps with Enterprise ServicesSecurely expose enterprise systems & APIs to Mobile Apps while optimizing delivery


• Data format & language– JavaScript‒ JSON ‒ JSON Schema ‒ JSONiq ‒ REST ‒ SOAP 1.1, 1.2 ‒ WSDL 1.1 ‒ XML 1.0 ‒ XML Schema 1.0 ‒ XPath 1.0 ‒ XPath 2.0 (XQuery only) ‒ XSLT 1.0 ‒ XQuery 1.0

• Security policy enforcement‒ OAuth 2.0 ‒ SAML 1.0, 1.1 and 2.0, SAML Token

Profile, SAML queries ‒ XACML 2.0 ‒ Kerberos (including S4U2Self, S4U2Proxy)‒ SPNEGO ‒ RADIUS‒ RSA SecurID OTP using RADIUS ‒ LDAP versions 2 and 3 ‒ Lightweight Third-Party Authentication‒ Microsoft Active Directory ‒ FIPS 140-2 Level 3 (w/ optional HSM)‒ FIPS 140-2 Level 1 (w/ certified crypto module) ‒ SAF & IBM RACF® integration with z/OS ‒ Internet Content Adaptation Protocol‒ W3C XML Encryption ‒ W3C XML Signature ‒ S/MIME encryption and digital signature ‒ WS-Security 1.0, 1.1 ‒ WS-I Basic Security Profile 1.0, 1.1 ‒ WS-SecurityPolicy ‒ WS-SecureConversation 1.3

DataPower Gateway: Supported standards & protocols• Transport & connectivity

– HTTP, HTTPS, WebSocket Proxy– FTP, FTPS, SFTP – WebSphere MQ– WebSphere MQ File Transfer Edition – TIBCO EMS – WebSphere Java Message Service– IBM IMS Connect, & IMS Callout– NFS – AS1, AS2, AS3, ebMS 2.0, CPPA 2.0,

POP, SMTP (XB62) – DB2, Microsoft SQL Server, Oracle,

Sybase, IMS

• Transport Layer Security ‒ TLS versions 1.0, 1.1, and 1.2‒ SSL versions 2 and 3

• Public key infrastructure (PKI)‒ RSA, 3DES, DES, AES, SHA, X.509,

CRLs, OCSP ‒ PKCS#1, PKCS#5, PKCS#7, PKCS#8,

PKCS#10, PKCS#12‒ XKMS for integration with Tivoli Security

Policy Manager (TSPM)

• Management‒ Simple Network Management Protocol‒ SYSLOG ‒ IPv4, IPv6

• Open File Formats‒ Distributed Management Task Force

(DMTF) Open Virtualization Format (OVF)

‒ Virtual Machine Disk Format (VMDK)‒ Virtual Hard Disk (VHD)

Link to Product Documentation

• Web services– WS-I Basic Profile 1.0, 1.1 – WS-I Simple SOAP Basic Profile – WS-Policy Framework – WS-Policy 1.2, 1.5 – WS-Trust 1.3 – WS-Addressing – WS-Enumeration – WS-Eventing – WS-Notification – Web Services Distributed Management– WS-Management – WS-I Attachments Profile – SOAP Attachment Feature 1.2 – SOAP with Attachments (SwA) – Direct Internet Message Encapsulation– Multipurpose Internet Mail Extensions– XML-binary Optimized Packaging (XOP) – Message Transmission Optimization

Mechanism (MTOM) – WS-MediationPolicy (IBM standard) – Universal Description, Discovery, and

Integration (UDDI versions 2 and 3), UDDI version 3 subscription

– WebSphere Service Registry and Repository (WSRR)

http://www-01.ibm.com/software/integration/datapower/library/documentation


2000

20012002

20032004

20052006

20072008

20092010

2011

Gigabit/SecHW Solution

Acquisition

ITCAM for SOA(Transaction Monitoring)

Model 9235(aka 9004)

Model 7993(aka 9003)

WebSphereTransformation Extender

XA35

XS40

XI50

XB60

2012

XG45,XI52 & XB62

XI50B Blade

WebSphere Appliance Management Center

Optimized Interpreter and

Compiler

OptimizedHardware

Acceleration

20132014

Application Optimization(Self-Balancing & Intelligent

Load Distribution)

XI50z Blade

Virtual Edition(VMware)

Virtual Edition(PureApplication System)

Virtual Edition(for Developers + XenServer)

Optimized & secure JavaScriptMulti-channel Gateway

Consolidated Gateway PlatformISAM Proxy Module

Over 14 years of innovation & 2000+ global installations

IBM DataPowerGateway


The adoption of cloud, analytics, mobile, and social computing is forcing organizations to open IT assets to new business channels

…and challenging them to rethink the way they have traditionally approached security & control

Between 2005 and 2020, the

amount of data in the world will

grow 300X, from 130 to

40,000 exabytes.

81% of adults use personally owned mobile

devices for conducting business

70% of employees are

engaged in social

activities both internally and

externally

73% of organizations

discovered cloud usage outside of IT or security

policies

Documents

© 2015 IBM Corporation IBM DataPower Gateway & V7.1 Overview Ozair Sheikh, Senior Product Manager IBM DataPower Gateways Arif Siddiqui, Principal Product