Schläger, Christian and Nowey, Thomas and Montenegro, Jose A. (2006) A Reference Model for Authentication and Authorisation Infrastructures Respecting Privacy and Flexibility in b2c eCommerce. In: Proc. First International Conference on Availability, Reliability and Security (ARES 2006). IEEE Computer Society Conference Publishing Services, Los Alamitos, pp. 709-716.
Authentication and Authorisation Infrastructures (AAIs) are gaining momentum throughout the Internet. Solutions have been proposed for various scenarios among them academia, GRID computing, company networks, and above all eCommerce applications. Products and concepts vary in architecture, security features, target group, and usability containing different strengths and weaknesses. In addition security needs have changed in communication and business processes. Security on the internet is no longer defined as only security measures for an eCommerce provider against an untrustworthy customer but also vice versa. Consequently, privacy, data canniness, and security are demands in this area.
The authors define criteria for an eCommerce provider federation using an AAI with a maximum of privacy and flexibility. The criteria is derived concentrating on b2c eCommerce applications fulfilling the demands. In addition to best practices found, XACML policies and an attribute infrastructure are deployed. Among the evaluated AAIs are Shibboleth, Microsoft Passport, the Liberty Alliance Framework, and PERMIS.
|Item Type:||Book Section|
|Institutions:||Business, Economics and Information Systems > Institut für Wirtschaftsinformatik > Retired Professors > Lehrstuhl für Wirtschaftsinformatik IV - Management der Informationssicherheit (Prof. Dr.-Ing. Hannes Federrath)|
|Keywords:||Security in general (overviews/surveys)|
|Subjects:||300 Social sciences > 330 Economics|
|Refereed:||Yes, this version has been refereed|
|Created at the University of Regensburg:||Yes|
|Deposited On:||07 Aug 2006|
|Last Modified:||20 Jul 2011 20:48|