IBM, VeriSign Forge E-Commerce Security Strategy

"If IBM plans on offering an authentication service with VeriSign's credentials, to me that's news," Gartner analyst Richard Stiennon told the E-Commerce Times.

"It will offer a way for customers of the two to be able to authenticate subscribers to their Web sites or their own employees," Stiennon said.

Online Authentication

Among the services the two companies expect to develop are security systems for messaging, extranets, intranets and e-commerce sites. VeriSign will use its public key infrastructure (PKI) technology, which encrypts data and verifies the identity of online shoppers, and IBM will offer its high-level security software, Tivoli Policy Director.

The first new service developed by the partnership, scheduled for release in mid-2002, will combine online identity authentication, Web single sign-on, digital signatures and online authorization.

Not Going To Happen

While the proposed authentication system will work well for enterprise customers and intranets, Stiennon said he has reservations about whether it will work for consumer e-commerce.

"Authentication for e-commerce can be a really hard nut to crack because you have to get every merchant to integrate with your solutions," Stiennon said. "If anybody had an edge, it would be VeriSign, but it's just not going to happen for a while, if ever."

Even offering single sign-on -- which allows online shoppers to enter a name and password once and then be recognized at every site they visit -- would be a formidable task, according to Stiennon. "It works for the enterprise, but for consumer e-commerce it would be close to impossible to do," he noted.

Name Recognition

Despite challenges on the e-commerce side, the deal is an important one for VeriSign, which will gain access to IBM's vast stable of corporate customers through the Global Services Group. VeriSign also stands to gain name recognition through its association with a product designed to become the standard for Web security.

"As businesses increasingly use the Internet for e-business, consumers are beginning to look for the digital 'signposts' that ensure trusted commerce and communications," said Stratton Sclavos, president and CEO of VeriSign.

So far, developing a clear brand identity has been a challenge for VeriSign because the company is involved in several different types of Web ventures, including security, domain names and online payment systems.

Security Focus

This is just the latest deal VeriSign has forged in an effort to increase its reach in the online security field. In September, along with EBay (Nasdaq: EBAY), Sun Microsystems (Nasdaq: SUNW) and AOL Time Warner (NYSE: AOL), Verisign became a charter member of the Liberty Alliance, a group formed to create an open standard for network identity, including single sign-on.

For its part, having access to VeriSign's technology will enable IBM to expand its security offerings. On November 19th, IBM announced its intention to expand its information security and privacy services and launched a partnership with security company Kroll.