View
4
Download
0
Category
Preview:
Citation preview
Intra-ASEAN Secure Transactions FrameworkPitinan Kooarmornpatana
Director of IT Infrastructure Office of ETDAJun 2015
Background
• What is Intra-ASEAN Secure Transactions Framework ?– Funded Project by ASEAN ICT – Part of the ASEAN ICT Masterplan 2015
Initiative 2.4 “ Building Trust and promote secure transaction within ASEAN”
• Objective1. Provide guideline, technology-neutral framework, and legal consistency
in secure transaction approaches across ASEAN member states2. Increase trust and promote secure and efficient electronic transactions
through proper selection of e-authentication mechanism3. Initiate sharing of online identity and authentication across cross-
border systems
1. Guideline for technical-neutral framework
• Legal Framework for secure transaction is almost ready
• A Little reminder: Legal is the supporting framework, but Business Framework or Existing Flow is the main actor.
• Methodology for selecting the proper e-authentication mechanism
2. Increase trust by proper e-authentication
1.AssuranceLevelsandRiskAssessments
• ISO/IEC29115:2013• OMBM‐04‐04• NeAF
2.IdentityProofingandVerification
• ISO/IEC29115:2013
3.AuthenticationMechanism
• NISTSpecialPublication800‐63‐1
2.1 Level of Assurance and Mechanisms1.AssuranceLevelsandRiskAssessments
Source: ISO/IEC29115:2013
2.IdentityProofingandVerification
3.AuthenticationMechanism
3. Initiating Shared Online Identity
National Contact Information System
DP
Info Out
In
Mapping Level of Assurance Smart form will
distribute data to related agency
GOV.C
GOV.B
GOV.A
Communication via email to separate security domain
Response from sending back to requester’s Inbox
User can manage who (service provider) to share what information with
User
User can Register And Upgrade Level of Assurance by providing more information (Authoritative of Corroborative)
Control Accessibility Based on LoA
3. Initiating Shared Online Identity
Mapping with the Framework
NCIS Key Feature: Perform online identity regular ch
Pilot Project – B2G e-Filing for exporter
Cert.
Exporter
staff
Review Request and the corroborative document
Submit to NSW
e‐CustomE‐Permit1
Request Form1
NSWGovernment Agency1
Ministry of Commerce
Req.
Cert.
Request for business registration certificate
Business registration certificate
AS‐IS
Pilot Project – B2G e-Filing for exporter
Cert.
Exporter
staff
Review Request and the corroborative document
Submit to NSW
e‐CustomE‐
Permit1
Request Form1
NSWGovernment Agency1
Ministry of Commerce
Req.
Cert.
Request for business registration certificate
Business registration certificate
To‐be
NCIS(Authen.)
Response form in data schema format- Signed by PKI
certificate of authorized government staff(Secured Message)
- Sharing Information over https (Secured Channel)
Finding: We also care the ‘function’ of that identity
• It’s not only I know to know he is Mr. John• But we also wants to know what Mr. John can do
Exporter
Ministry of Commerce
Req.
Cert.
Request for business registration certificate
NCIS(Authen.)
School
ProfessionalAssociation
Financial Institute
- Signed by PKI certificate of authorized government staff(Secured Message)
- Sharing Information over https (Secured Channel)
How PKI can help complete the jigsaw
• Maintain the liability chain • Keep integrity of data • Non‐ repudiation • Not only human to server but also server to server
Recommendations
• ASEAN should adopts the risk-based approach to define the Level of Assurance requied for each application
• ASEAN should define identity proofing and verification for each LoA based on ISO29115:2013
• Credential management should include the corroborative information and Authoritative information
Key Points
• Legal is there to support the business process
• Authentication Framework should consider the
‘functional’ information from other entities
• PKI plays the big role to make the trusted
ecosystem in Thailand
Recommended