1. © Synergetics 2007

2. 3Portfolio Security Aspecten

3. © Synergetics 2007 Basic System Requirements Dependable, robust and reliable –Cf. Trustworthiness Architecture –Cost-effective –Service oriented –Suitable to manage employability portfolios –Open and interoperable with other systems Balance between security and usability –User-centric management of personal profiles

4. © Synergetics 2007 3 Distinct Issues Information protection –Integrity of the information Is the information that I receive the information that was sent by the sender I think it comes from? –Authenticity of the information Does the information I receive come from a genuine source? –Confidentiality of the information Was the information revealed to a third party during its transmission? Authorization –Is the requester of information entitled to receive/use the information? Trustworthiness –Was the system designed so that it is sufficiently trustworthy? –Are we able to corroborate the integrity and authenticity of all information? –Are we able to prove our point in case of litigation?

5. © Synergetics 2007 3 Distinct Issues – Possibilities 1. Information protection –Integrity of the information Possibility: protection of transport mechanism –Authenticity of the information Possibility: information labeling, watermarking, other digital rights management systems –Confidentiality of the information Possibility: data encryption 2. Authorization –Is the requester of information entitled to receive/use the information? Possibility: contracts, roles, profiles 3. Trustworthiness –Was the system designed so that it is sufficiently trustworthy? Possibility: use of standards and independent audits –Are we able to corroborate the integrity and authenticity of all information? Possibility: interoperable security architectures –Are we able to prove our point in case of litigation? Possibility: Digital archives

6. © Synergetics 2007 Remaining Issues Registration of information, services, users… –Attribution of certain attributes to all entities involved Management of information, services, users, access conditions, access rights, attributes… –Revocation, renewal,… Common issues: –Interoperable naming schemes for data, users, services…

7. © Synergetics 2007 Secure Service Discovery Service providers only provide services to authorized service requesters –Introduces the concept/need of registered services, service providers and service users –Policies are used to determine and enforce who is allowed to use which services Implies interoperable naming scheme for policies, actions, services, users… –Well suited for highly dynamic environments where access rights, access conditions and policies quickly change

8. © Synergetics 2007 Security Challenges System must limit –Risks of identity theft –Disclosure of sensitive information –Risks of wrong attribution of charges Flexibility is key –Protocols and algorithms are well understood and standardized –Recent attacks on very popular cryptographic protocols and algorithms illustrate that security primitives should be highly parameterized Context determines which parameters to use {Very/Less} sensitive information is protected with {very/sufficiently} strong cryptographic mechanisms

9. © Synergetics 2007 Open Research Selecting the right combination of security parameters to suit the 3Portfolio requirements –Scalable mechanisms for integrity protection of competences, work experience, preferences… Semantic interoperability issues Management of registered users, services, information… –Highly-distributed identity management –Profiles management –Traceability of all transactions

10. © Synergetics 2007 Open Research Digital identities –Information, service providers and users have to be identified Requires scalable identification scheme –Distinguish stakeholders, devices, communication channels –Strong link between the identity and the identified entity Countering fake identities and identity theft Privacy aspects of using information Efficient enforcement and assessment at run-time of the trustworthiness of architecture components Crypto-challenges –Long-term security of archived information