1 / 33

Authentication, Authorisation , Accounting

Authentication, Authorisation , Accounting. Experience and Status – Austria - Overview. Governmental AA(A) Systems in Austria. Citizen to Government (C2G) Austrian Citizen Card ( eID ) / MOA Authentication /Authorisation Business to Government (B2G)

hagop
Download Presentation

Authentication, Authorisation , Accounting

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Authentication, Authorisation, Accounting Experience and Status – Austria - Overview

  2. Governmental AA(A) Systems in Austria • Citizen to Government (C2G) Austrian Citizen Card (eID) / MOA Authentication /Authorisation • Business to Government (B2G) Unternehmesseriveportal (Portal for business company services) Authentication / Authorisation • Government to Government (G2G) Austrian Portal Federation (Portalverbund) Authentication / Authorisation / Accounting G2G experiences are the main focus of this presentation. DI Wolfgang Tinkl, Peter Pichler

  3. Authentication, Authorisation, Accounting Citizen to Government Use Cases

  4. C2G / Austrian Citizen Card / MOA-ID* (STORK) • Established chip-card and mobile TAN (2 factor system using phones) authentication system • User numbers increase permanently • Integrated in the STORK project • Social Security Card (and others) can be used as chip-card * MOA is the name of the Austrian open source software for the national e-ID solution. MOA-ID is responsible for authentication. (MOA… Modules for Online Applications) DI Wolfgang Tinkl, Peter Pichler

  5. C2G Authorisation (MOA-VV) (german: “Vollmachten und Vertretungen” means about “Service for electronic letters of attorney””) In C2B e-government system authorisation in concrete is mainly the process that one citizen allows someone else to act on behalf of him/her. The first technical approach was to store proxy authorisations directly on the card. Because of technical and practical problems (e.g. that most citizen prefer the mobile phone solution not the chip card, requiring special hardware) we shifted to a server based solution. DI Wolfgang Tinkl, Peter Pichler

  6. Current Status / Authorisation C2G • There is a service from the Austrian data protection authority to create electronic letters of attorney. • Currently the service is not used very much and only few services are supporting the usage electronic letters of attorney. • We are working currently on converting authentication information from the C2G authorisation in the format used for G2G use cases (PVP), to make it more easy for services to support electronic letters of attorney. DI Wolfgang Tinkl, Peter Pichler

  7. Authentication, Authorisation, Accounting Business to Government Use Cases

  8. Unternehmensserviceportal / Authentication and Authorisation Infrastructure for cooperations 2010 a central E-Government AA infrastructure for all companies was introduced. (USP – UnternemensServicePortal) For authentication the Austrian Citizen Card is used and a username/password system, used also before from the ministry for finance for the E-Taxation System. (Finanz Online) Some services (e.g. register of lobbyists) are available only with the Austrian Citizen Card (chip card or mobile TAN) DI Wolfgang Tinkl, Peter Pichler

  9. Unternehmensserviceportal / Authentication and Authorisation Infrastructure for cooperations Authorisation in this use case means, that a company decides, which member of staff may/should use which e-government Service. An important challenge is to set up the processes for the authorisation management within the companies. An other main challenge was to create an register for all companies. DI Wolfgang Tinkl, Peter Pichler

  10. Authentication, Authorisation, Accounting Government to Government Use Cases DI Wolfgang Tinkl, Peter Pichler

  11. Austria is a really federal republic 9 Austrian Federal States with their own legislation Peter Pichler, DI Wolfgang Tinkl

  12. Austria is a really federal republic • 118 politicaldistricts Peter Pichler, DI Wolfgang Tinkl

  13. Austria is a really federal republic • > 2000 communities with own local authority Peter Pichler, DI Wolfgang Tinkl

  14. A lot of governmental and government near agencies with different responsibilities • Ministries, Federal State Governments, Courts, …. • Special Topic Agency (statistic, environment protection, financial auditing, food safety, drug studies, calibration and measurement, water protection, IT Services,…) • Governmental Insurance Agencies • Compulsory interest groups for business cooperation, employees, farmers, advocates,... • a.s.o. Peter Pichler, DI Wolfgang Tinkl

  15. Challenges for Governmental IT Services in Government To Government Use Cases (G2G) Organisation B Service A2 Service C1 Organisation C Service A1 Organisation A Different Organisations use and/or provide services Service B1 DI Wolfgang Tinkl, Peter Pichler

  16. Challenges for Governmental IT Services in Government To Government Use Cases (G2G) Organisation B Service A2 Service C1 Organisation C Service A1 Organisation A Implement AAA within the service? Service B1 DI Wolfgang Tinkl, Peter Pichler

  17. Challenges for Governmental IT Services in Government To Government Use Cases (G2G) Organisation B Managing user and rights separately for each service is not manageable in a secure way! Service A2 Service C1 Organisation C Service A1 Organisation A Service B1 DI Wolfgang Tinkl, Peter Pichler

  18. Challenges for Governmental IT Services (G2G) • Authorisation Management Not a person has the right to use a G2G service, but the organisation he/she is working for. The agency delegates this rights to staff need the service, because of the scope of their duties. If responsibilities within the organisation are changed, also authorisation have to be adapted • Credential management Password, certificate and chip-card Management • Account and Identity Management Account registration needs a solid identification, much more easy if the user requiring the account is physical present (passport check) DI Wolfgang Tinkl, Peter Pichler

  19. Austrian Solution – Federation of Governmental Organisations IdPs, Authorisation Profiles for foreign organisations AAA Data Store User PVP (Protocol) Service Implementation Identity Provider (IdP) Service Provider(SP) System-User Organisation providing a Service User Home Organisation § PVV TRUST SPs can trust AAA info from federation members because of a multilateral contract between the participating organisations DI Wolfgang Tinkl, Peter Pichler

  20. Austrian Solution – Federation • Organisations want to access services from other Organisations use an Identity-Provider (User-Portal*). They can use an own infrastructure or can use shared infrastructure. • Access rights for all governmental applications are managed by the home organisation of the user. • Organisations providing services have Service Providers (Application Portals*). • A multilateral contract between all participants allows Service Providers to trust the authentication, the authorisation and accounting information passed to them from IdPs of the federation. (German: “PortalverbundVereinbarung”, about “Portal Federation Agreement”) • * before integrating SAML2, we used the term “User Portal” for Identity Provider (IdP) and “Application Portal” for Service-Provides(SP) DI Wolfgang Tinkl, Peter Pichler

  21. Central Residence Register Usage 2010: PVV (G2G) > 130 000 registered users > 400 services PVP (technologie) > 600 000 registered users > 600 not federated services PVV 1.0 (multilateral agreement) PVP 2,0 (+ SAML2 WebSSO) PVP 1.5 (technical protocol) BM.I Gateway Protocol Standard-Portal 1.0 (common software) Standard-Portal 2.0 2007 2001 2003 2005 2010 2013 2015 DI Wolfgang Tinkl, Peter Pichler

  22. History, Timeline (-2005) • A important driver creating an Austrian governmental AAA infrastructure was the launch of the computer based Central Residence Register. • Predecessor of the technical protocol was a protocol of the ministry of the interior. (BM.I Gateway Protocol). • 2002 the first common specification of the technical protocol was specified (PVP 1.4.1 and 1.5) and the multilateral contract (PVV 1.0 valid till now) allowing participants to trust each others and defining rights and obligations of Identity-Providers and Service-Providers. • 2004 many participants decided to make a common software for the Austrian Portal Federation. The PVP Standardportal, developed by the ministry of the interior and the LFRZ (IT company under the control of the ministry for agriculture) DI Wolfgang Tinkl, Peter Pichler

  23. History, Timeline (2005-2010) • Till 2010 the federation is established. All ministries, federal state administrations, local community administrations (>2000) can access services of the federation. Many special topic organisations have also access to the federation and/or provide services. Also internal applications are developed using the common AAA standards. The federated portal technologies are used also for organisation internal citizen portals. • Already 2010 there was more than 130.000 registered G2G users, more than 600.000 non G2G users. Millions of transactions are handed every day. (e.g. Ministry of the interior: 2 Mio. Transactions/day) DI Wolfgang Tinkl, Peter Pichler

  24. History, Timeline (2010-now) • From 2010 on the responsible specification group developed Version 2.0 of the PVP protocol, to create a PVP variant based on the Web-Single-Sign-On Profile of SAML 2 and the eGovernment Profile of the Kantara Initiative. (PVP2 S(AML)-Profile) • From 2012 to 2014 the Standardportal was extended to support PVP 2. • Currently we work on bringing PVP2 to productive systems and on building up central services required for an SAML Federation (e.g. central SAML metadata services) DI Wolfgang Tinkl, Peter Pichler

  25. Technology – PVP R-Profile – Austrian Standard HTTP / SOAP over HTTP X509 X509 User Service Implementation Identity Provider (IdP) Service Provider(SP) System-User Identity Provides act as non transparent reverse proxy. (every HTTP request is passed over IdP and SP; non-transparent means that portals have own DNS names) DI Wolfgang Tinkl, Peter Pichler

  26. Technology – PVP R-Profile – Austrian Standard • IdPs and SPs act as non transparent reverse proxy. (every HTTPS request is passed over IdP and SP; non-transparent means that portals have own DNS names) • SPs are authenticate the foreign IdP and trust them (limited by trust-profiles describing maximal authorisations of a foreign organisations). • Authentication between IdP and SP is made mainly using certificates for the https trafic. • Authentication and authorisation information is transported using HTTP Headers with each request DI Wolfgang Tinkl, Peter Pichler

  27. Technology – S Profil – PVP using the SAML2 Web SSO Profile In the PVP2 S-Profile users are accessing the service directly. When a service needs to authenticate a user, it passes the control over the browser of the user to the IdP. (after asking user, which IdP should be used = IdP Discovery) After authentication the IdP sends an SAML response to the SP – and gives back control over the browser. Messages are signed using XML signatures, to ensure they are originated by a member of the federation. authenticate IdP use service SP DI Wolfgang Tinkl, Peter Pichler

  28. Technology: Handling different protocols and profiles Service Provider PVP X.X (R-Profil oder S-Profil) ForeignIDP PVP R-Profil (PVP 1.8 - 2.x) StdPortal StdPortal AWP / R-Profil-SP Protocol-Bridge PVP S-Profil (PVP 2.x) Identity Provider SAML 2.0 SP Portal software converts different protocols and profiles. Services need not be updated, e.g. for the introduction of Version 2.0. DI Wolfgang Tinkl, Peter Pichler

  29. Usage of the Austrian Governmental Portal Federation in the INSPIRE Implementation Several organisations using a common platform for INSPIRE service from LFRZ. The administrative user interfaces (e.g. to bring in new INSPIRE metadata) are accessible using the PVP federation technologies. Central INSPIRE services DI Wolfgang Tinkl, Peter Pichler

  30. Current use and ideas concerning INSPIRE • Used in applications around the INSPIRE services • Service and Metadata Editor • Administration GUI • eCommerce GUIs • Building up a central e-commerce platform for governmental with costs. (e.g. GIS data, but also for other services) • Using PVP as technical protocol between this payment platform and services DI Wolfgang Tinkl, Peter Pichler

  31. Used Images Source: Wikipedia; Licence: Creative Commons Logos of the Austrian E-ID solution Source: buergerkarte.at Logo Central Residence Register; Austrian Ministry of the Interior The Austrian Social Security Card Source: http://www.chipkarte.at Logo of the Austrian Governmental B2G Portal Source: https://www.usp.gv.at DI Wolfgang Tinkl, Peter Pichler

  32. Used Images Maps from the Austrian Statistics Agency (Statistik Austria) Sources: http://www.statistik.gv.at/web_de/klassifikationen/regionale_gliederungen/gemeinden/index.html http://www.statistik.gv.at/web_de/klassifikationen/regionale_gliederungen/politische_bezirke/index.html http://www.statistik.gv.at/web_de/klassifikationen/regionale_gliederungen/gemeinden/index.html LFRZ Images LFRZ GmBH has the using rights and allows using them in the context of this presentation DI Wolfgang Tinkl, Peter Pichler

  33. Autors Peter Pichler Authentication, Authorisation, Accounting pvp@peterpichler.at; peter.pichler@lfrz.at DI Wolfgang Tinkl Geographical information systems, INSPIRE wolfgang.tinkl@lfrz.at DI Wolfgang Tinkl, Peter Pichler

More Related