Attribute based infrastructures for authentication and authorisation

More about the book

In 2006, customers in Germany spent over $23.9 billion online, highlighting the growth of e-commerce alongside increasing threats for users and providers. To address these challenges, a robust security and information infrastructure is essential to meet the needs of both customers and service providers. This work introduces an attribute-based Authentication and Authorisation Infrastructure (AAI) for business-to-consumer e-commerce, designed to balance security and user demands in electronic transactions. Private users seek ease of use through centralized account management and Single Sign-On, along with privacy and trust. Service providers require security via dynamic, fine-grained access control and outsourcing capabilities. By employing attribute-based Access Control and open communication standards, a mediating infrastructure is established, involving Identity Providers, Service Providers in a federation, and a central Policy Decision Point. The architecture aims to ensure security while maintaining usability and pseudonymity. The analysis includes the motivations of involved parties, security fundamentals in authentication, authorisation, access control, and privacy technologies. A review of existing AAIs reveals their limitations, leading to the proposal of a new attribute-based AAI, complete with a reference protocol, architecture, allocation strategy, Security Pattern System, and prototypical implementations. An evaluat