A reference model for Authentication and Authorisation Infrastructures respecting privacy and flexibility in b2c eCommerce

Abstract

Authentication and Authorisation Infrastructures (AAIs) are gaining momentum throughout the Internet. Solutions have been proposed for various scenarios among them academia, GRID computing, company networks, and above all eCommerce applications. Products and concepts vary in architecture, security features, target group, and usability containing different strengths and weaknesses. In addition security needs have changed in communication and business processes. Security on the internet is no longer defined as only security measures for an eCommerce provider against an untrustworthy customer but also vice versa. Consequently, privacy, data canniness, and security are demands in this area.The authors define criteria for an eCommerce provider federation using an AAI with a maximum of privacy and flexibility. The criteria is derived concentrating on b2c eCommerce applications fulfilling the demands. In addition to best practices found, XACML policies and an attribute infrastructure are deployed. Among the evaluated AAIs are Shibboleth, Microsoft Passport, the Liberty Alliance Framework, and PERMIS.

Effects of Architectural Decisions in Authentication and Authorisation Infrastructures

“…Comparative surveys on existing AAIs can be found in [10] and [17]. Schläger and Nowey [15] provide an AAI perspective focusing on risk assessment and risk identification.…”

“…Through the integration of an attribute infrastructure and attribute-based access control (ABAC) additional functionalities are gained (see [15] and [18]). With XACML -the eXtensible Access Control Markup Language [12] -an open standard has been proposed that is able to express access policies [2].…”

Patterns for Authentication and Authorisation Infrastructures

“…Different architectures, research projects, and products have been analysed and motivation for the stakeholders in such infrastructures has been given. In 2006 [5] defined a process chain of security sub services an AAI is able to perform ( Figure 1). This was followed by [6] and existing AAIs were evaluated according to the chain in [5].…”

“…In 2006 [5] defined a process chain of security sub services an AAI is able to perform ( Figure 1). This was followed by [6] and existing AAIs were evaluated according to the chain in [5]. The results were a classification and a complete assessment of best practices as well as lessons learned.…”

“…Building on [1,4,5] a reference architecture was developed in [6]. Four main design guidelines were realised: a distributed infrastructure, SSO functionalities, attribute-based access control, and open standards.…”