Generic Architecture Architecture Generic to Securely Securely - PowerPoint PPT Presentation

Trusted Architecture for Trusted Architecture for Securely Shared Services Securely Shared Services Generic Architecture Architecture Generic to Securely Securely Manage Manage to Employability, Healthcare & Employability, Healthcare & Personal Information Information Services Services Personal Web: http://tas3.eu Email: tas3@ls.kuleuven.be TAS³ is an IST FP7 funded Integrated Project TAS³ contract number 216287 Duration: 1 Jan 2008 - 31 Dec 2011 Research budget: 13.200.000 € EC Funding: 9.400.000 €

What is TAS 3 About? • TAS 3 focuses federated identity management • TAS 3 consolidates scattered research in – Security, Trust, Privacy, Digital identities, Authorization, Authentication… • TAS 3 integrates adaptive business-driven end2 end Trust Services based on personal information: – Semantic integration of Security, Trust, Privacy components • TAS 3 provides dynamic view on application-level end2 end exchange of personal data: – Distributed data repositories Trusted Architecture for Securely Shared Services 2

18 TAS 3 Partners • Coordinators: – K.U.Leuven & Synergetics • 9 Research Institutes: – Universities of Eindhoven, Karlsruhe, Kent, Koblenz-Landau, Leuven, Nottingham, Brussel, Zaragoza – Consiglio Nazionale delle Ricerche • 9 Companies & Organizations: – Custodix, Eifel ASBL, Intalio Ltd, Kenteq, Medisoft, Oracle, Risaris Ltd, SAP Research, Synergetics Trusted Architecture for Securely Shared Services 3

TAS 3 Phased Approach Phase II Phase I Phase III Requirements Analysis Update of Requirements System Design / Architect . Def. Update of System Design / Architecture Definition Final Baseline Setup Development I Development II Development III Docum . Test bed Test bed Test bed Test Bed Setup phaseI phaseII phaseIII increasing functionality as well as deepness of integration Final Versions of all TAS³ services services AdvancedVersions of all TAS³ services services services services services First Versions of all TAS³ services 6 M 12 M 18 M 24 M 30 M 36 M 42 M 48 M Trusted Architecture for Securely Shared Services 4

Support for Cross-Context Adaptable Business Processes! L 3 M 11 11 L 4 M 10 L 2 M 8 L 1 10 M 2 L 5 M 12 M 3 12 Cont Co ntext L t L M 1 M 4 K 4 K 1 M 6 M 9 K 3 M 7 K 5 K 2 M 5 Cont Co ntext K t K Cont Co ntext M t M Trusted Architecture for Securely Shared Services 5

TAS 3 ’s 4 Core Layers • Layer 1 – Authentication – Federated identities • Layer 2 – Authorization – Federated attributes • Layer 3 – Trustworthiness & Reputation scores – End-user controlled – Fine-grained role-based • Layer 4 – Data-protection policy enforcement – Sticky policies associated with information elements Trusted Architecture for Securely Shared Services 6

Business Process Service Requester Directories Service Provider Trusted Architecture for Securely Shared Services 7

Business Process Service Requester Directories Service Provider Trusted Architecture for Securely Shared Services 8

Business Process TAS3 Entry TAS3 Exit Point Point Service Requester TAS 3 Registry Service Requester • Service Providers Process Engine • Service Types • IdPs Obligations Watchdog Trust & Audit Privacy Authentication Guard Negotiator Authorities (IdPs) Policies Enforcement Point Authorization, Log Analysis Engine Trust & Reputation • Audit Aspects Response Request Authorities • Policy Aspects Verifier Preparer Directories Response Obligations Watchdog Audit Guard Request Verifier Preparer Policies External Credentials Service Provider Enforcement Log Clearing PEP Process Engine Point Analysis Service Log Analysis Engine Credential Actual Application • Audit Aspects Clearing PDP Engine • Policy Aspects Service Provider Trusted Architecture for Securely Shared Services 9

Business Process TAS3 Entry TAS3 Exit Point Point Service Requester TAS 3 Registry Service Requester • Service Providers Process Engine • Service Types • IdPs Obligations Watchdog Trust & Audit Privacy Authentication Guard Negotiator Authorities (IdPs) Policies Enforcement Point Authorization, Log Analysis Engine PDP PDP Trust & Reputation • Audit Aspects Response Request Authorities • Policy Aspects Verifier Preparer Directories Response Audit Guard Obligations Watchdog Request Verifier Preparer External Policies Service Provider Credentials Log Enforcement Process Engine Clearing PEP Analysis Point Service PDP PDP Log Analysis Engine Actual Application • Audit Aspects Engine • Policy Aspects Service Provider Trusted Architecture for Securely Shared Services 10

11 Some degree of anonymity (optional) • Policy Aspects • Policy Aspects Engine Engine Actual Application Actual Application • Audit Aspects • Audit Aspects Log Analysis Engine Log Analysis Engine Provider PDP PDP PDP PDP Service Point Point Clearing PEP Clearing PEP Process Engine Process Engine Enforcement Enforcement Credentials Credentials Service Provider Service Provider Policies Policies Preparer Preparer Request Verifier Request Verifier Obligations Watchdog Obligations Watchdog Audit Guard Audit Guard Response Response End-to-End Communications Options Trusted Architecture for Securely Shared Services Confidential Data-origin (1) 2.b (n) (1) 2.d (n) Insecure (1) 1.b (1) (1) 2.c (n) Secure Communications Tube Mediator Service 1.c Engine Engine • Policy Aspects • Policy Aspects • Audit Aspects • Audit Aspects Actual Application Actual Application Log Analysis Engine Log Analysis Engine PDP PDP PDP PDP Point Point Clearing PEP Clearing PEP Process Engine Process Engine Enforcement Enforcement Credentials Credentials Service Provider Service Provider Policies Policies Preparer Preparer Request Verifier Request Verifier Obligations Watchdog Obligations Watchdog Audit Guard Audit Guard Response Response (1) 1.a (1) Many to Many (1) 2.a (1) One to Many One to One Requester Service (m) Reference (n) (1) Reference (1) (1) Reference (n) Application Data Preparer Preparer Verifier Verifier • Policy Aspects • Policy Aspects Request Request Response Response • Audit Aspects • Audit Aspects PDP PDP PDP PDP Log Analysis Engine Log Analysis Engine Point Point Policies Enforcement Policies Enforcement Negotiator Negotiator Guard Guard Privacy Privacy Audit Audit Trust & Trust & Watchdog Watchdog Obligations Obligations Process Engine Process Engine Service Requester Service Requester

Trusted Employability Platform Employability Employability Repository Portfolio Companies Schools Private Employment Universities Trusted Trusted Services Em ployability Em ployability Platform Platform Public Training Employment Institutes Services Social Employability Network Service Social Providers Security Certification Services Services Trusted Architecture for Securely Shared Services 12

Healthcare Demonstrator Platform Services Patient • Repositories with Parties (Personal) Health • Primary care Records • Secondary care • Registries Trusted • Home care Trusted • … Healthcare Healthcare Platform Platform Associations Security Services • Patient • Authentication • Professional • Credentials • Scientific • Auditing • … Legal & Ethical Trusted Architecture for Securely Shared Services 13

eHealth – Break the Glass Service 1. (6). Access patient record Policy Policy 2. Denied 8. Granted Enforcement Decision 3. Break the Glass Point Point 5. Granted 7. Retrieve Record Obligations Patient • Break-the-Glass service Service Record – Only activated after strong authentication 4. Enforce Data – Triggers advanced & fine grained monitoring Protection Policy – Audit trail provides hard evidence Data Protection Audit Policy Guard Trail Trusted Architecture for Securely Shared Services 14

Extreme Instantiation ☺ • Why limit ourselves to healthcare and employability use cases? – Generic architecture – Service providers can be physical gate keepers or other guards • When trustworthiness becomes user- unfriendliness – Granularity of policy specifications & validations – Automating Big Brother through obligations Trusted Architecture for Securely Shared Services 15

Contact Information • Web: http://tas3.eu • Email: tas3@ls.kuleuven.be Trusted Architecture for Securely Shared Services 16