WebService Provider trust worthiness in absence of UDDI registry (RESTful webservices or old ones)

Question

I am new to WebServices and RESTful web services.

QUESTION: How can one quickly discover trust worthy web-service providers in absence of UDDI registry? I am asking from a network/systems/soa security-reliability perspective.

Answer 1

Aside from UDDI, there's a few other options for web service discovery. The "trustworthiness" of the search results depends on your definition of the word.

For proving that the search results weren't modified in transit and proof of origin, you can use digital signatures.

• [WS-Discovery] http://specs.xmlsoap.org/ws/2005/04/discovery/ws-discovery.pdf is a UDP multicast based xml/soap solution that can probably be digitally signed.
• [UPnP] is also udp multicast based xml/soap and may be signable
• Multicast DNS
• Roll your own solution

All of these assume you're on the same network, so there's a certain level of "trust" associated with that, assuming a certain level of network boundary security.

Other's have had luck using non http transports for all their transactions, such as OMG DDS, jGroups, or 0MQ. All of which support a certain degree of a peer authentication and/or encryption and are basically mutlicast based solutions (which usually don't go through firewalls). Hope this helps