e-Authentication Framework

Document Sample
e-Authentication Framework Powered By Docstoc
					   e-Authentication Framework
            Classification of authentication solutions




WG e-authentication
November 2005
Content



Part I: Introduction .................................................................................................................................... 3

Part II: Explanation of the framework for authentication solution providers ................................ 5

Part III: Guidelines for the process owner .......................................................................................... 7

Part IV: Framework Authentication solutions ................................................................................... 11
  A. Life-cycle of the solution .............................................................................................................. 11
  B. Security of the authentication solution ........................................................................................ 15
  C. User friendliness ........................................................................................................................... 16
  D. Suitability ....................................................................................................................................... 18
  E. Availability ..................................................................................................................................... 19
  F. Liability of the provider of the solution ........................................................................................ 20
  G. Costs .............................................................................................................................................. 20

Score form ................................................................................................................................................. 21
Part I: Introduction


For a real breakthrough in e-business, e-government and e-health good electronic authentication is
crucial. Authentication deals with the question: is someone really who he/she says he/she is ? This
is something which is difficult to check on the internet. Also accessibility and user friendliness plays
an important role in this. A good way needs to be found to identify someone accurately without
scaring off the user.

In particular, users are finding that they need to carry more and more cards and remember more
and more passwords to carry out their work and live their lives. Even while this burden is increasing
the dangers of identity theft and fraud are also increasing. Better means of authentication could
reduce identity theft crime and help users and reduce the need for end users to carry multiple cards
and remember numerous passwords.

Different processes, (eg withdrawing cash from a bank, borrowing a library book, boarding a bus,
watching a TV programme, buying a house, taking medicine) have different needs for security and
quality of identification. For example, the level of authorisation and security for banking will be
higher than that for buying a metro ticket. Different security levels are needed.

To address these issues, we propose an authentication framework that aims to give guidance on
selecting and using the appropriate level of authenication.


Authentication Framework

Cooperation between different initiatives is needed to make e-authentication work. Also the level of
security of all the initiatives should be easier to recognize. Often the end user and the process
owner don’t know the difference between security levels.

This framework consists of different parts:
   - explanation of the framework for the provider of the authentication solution (Part II)
   - a guideline for process owners who want to offer a service on the internet but need a
        authentication solution. Process owners will eventually have to make their own choice for the
        solution that best fits their wishes but this form makes them aware of the aspects they need
        to consider. (Part III)
   - A questionnaire which can be filled in by providers of authentication solutions to determine
        the level of reliability/trust. (Part IV)


Who can use this framework ?

Providers of authentication solutions should fill in the questionnaire (Part IV) and the guidelines
(Part III) are meant for the process owners who are looking for a suitable authentication solution.
Both documents can also be useful for the end user who is looking for background information
about e-authentication.

One of the most important target groups of the framework are the authentication service providers.
These are organisations or initiatives that act as a intermediary organisation between providers of
means of authentications and process owners.
Definition of Terms


Means of authentication           A technical means which can be linked to the user with a certain
                                  degree of trust (forexample username/password, chip card, PKI
                                  certificate, mobile telephone).

Authentication solution           A means of authentication, including processes, procedures and
                                  supporting measure that is needed to implement, roll out and use
                                  the means.

Authentication Service Provider   A party in between providers of authentication solutions and
                                  process owners who can offer different solutions on different trust
                                  levels.

Level of trust                    A measure for how strong the connection is between a means of
                                  authentication and the identity of the user. It strongly depends on
                                  the issuing process and the moderation process of the solution.
                                  The degree of trust in the authentication service provider is also
                                  important.

                                  The framework recognizes 3 levels: high, middle, low.

End user                          The person who wants to authenticate him/herself with a means
                                  of authentication. The end user usually has multiple roles:
                                  consumer, patient, employee, citizen.

Intermediate party                A party in between providers of authentication solutions and
                                  process owners and who can offer different solution on different
                                  trust levels.

Process owner                     Organisation that wants to offer a service or product via internet
                                  but need a trustworthy identification of the user.
Part II: Explanation of the framework for authentication solution providers


Target group of the instructions for    This explanation is meant for the authentication solution
filling in the framework                provider who wants to check his authentication solution
                                        based on the framework.

          The goal of the framework is to compare authentication solutions by conducting a review.
           The framework helps making a selection of suitable authentication solutions: finding the
           match between demand and supply.

          The subject of the review concerns an authentication solution that is available on the
           market and can be reused for authentication of users within a business process.
           Authentication solution means in this case a means of authentication including all the
           processes, procedures and supporting means that are needed to implement, roll out and
           use the means.

          The framework is divided in different aspects and criteria based upon which the
           authentication solution is reviewed. Per criterion a maximum of three questions are
           formulated.

          This Framework has seven aspects regarding authentication solutions:
           1. Life-cycle of the authentication solution;
           2. Security of the solution;
           3. User friendliness;
           4. Suitability;
           5. Availability;
           6. Liability of the provider of the solution;
           7. Costs.

      A classification low/middle/high is made for answering the questions for aspects [A and B] 1
       and 2. A classification strong/middle/ weak is made for the aspects [C until E] 3 to 5. The
       model answers are formulated in such a way that they apply to a broad scale of solutions.

      For determining the strength of the authentication a solution offers (aspects A and B of the
       questionnaire) a weakest link approach is used. This means that the total score of these
       aspects is established by the lowest score on a criterion in the review.

      The other criteria and aspects aren't summed up like the criteria of aspects A and B, but can
       play an important role in the considerations of the (potential) organisations that might user
       the solution.

      The provider can provide multiple authentication solutions (different security levels). The
       provider should review each authentication solution separately by conducting a self-
       assessment. The results of the self-assessment are filled in by the provider on the score
       form.
   The process owner is advised to base the requirements of the solution on a risk analysis of
    the process which is supported by the solution. The results from this may be that the
    measure with the highest score isn't always necessary. In general more secure levels of
    authentication will be more intrusive, disruptive and burdensome for the end user. It is
    therefore necessary to ensure that the degree of burden imposed on end users is
    proportionate to the identified risk from incorrect authentication.

   After the selection of the means of authentication by the process owner more thorough
    research is needed to determine whether the selected solution meets the requirements on
    all detailed issues.
Part III: Guidelines for the process owner


Target group of the guidelines       These guidelines are meant for the process owner who wants to
                                     (re)use an available authentication solution.


The subject of the review concerns an authentication solution that is available on the market and
can be reused for authentication of users within a business process. Authentication solution means
in this case a means of authentication including all the processes, procedures and supporting
means that are needed to implement, roll out and use the means.

Processes can be business processes (e.g. paying a bill through electronic banking, boarding a
tram). Equally, they can be governmental or charitable processes (e.g. voting in an election, filing a
tax return).

The authentication service provider should have reviewed each authentication solution by
conducting a self-assessment. The results that have been scored based on the framework can be
checked by an organisation that wants to use the solution for a particular process to see whether it
is suitable. The framework serves as a guideline for the selection of a suitable authentication
solution.

This document is a guideline for using the framework. The following subjects will be discussed:
    Electronic handling of a (business) process
    Authentication and authentication solution
    Selection suitable authentication solution


Electronic handling of a (business) process
Your organisation has chosen to provide a service which requires electronic handling of a part of
the business process. Organisations are making this choice more often because efficiency can be
increased and cost savings can be realised. Many services can be often provided more promptly,
accurately and effectively and at lower cost through electronic means.

In an electronic process it is often easy for a person with bad intentions to pretend he/she is
someone else. For many purpose, but not all, it is essential to be sure of the identity of the person
who wants to make use of the electronic service.

(An example of a electronic process where it may not be desirable to have knowledge of the identity
of the end user is on information requests from suicide, drug or medical information or help bureaux.
Requiring confirmation of identity may dissuade potential clients.)

Authentication and authentication solution

Authentication means verifying an identity. There are several solutions to realize electronic
authentication. Each authentication solution is accompanied with a certain degree of trust. This
degree of trust is higher for some solutions and lower for others.

The trust of the solution is mainly determined by the means of authentication and the way in which
the subscription and issuing process is set up.
A means of authentication is always based on at least one of the factors below:
    Knowledge - Know something. For example a password of pin code.
    Possession – Own something. For example a token (like a bank card with secret keys).
    Be – A physical mark: biometric data.

Dependent on your need a larger level of trust can be obtained by combing the above factors. A
well-known example is the bank card (possession) and the accompanying pin code (knowledge).

These factors are checked against a reliable database that relates the factor to the individual.

Different levels of trust can also be identified with the implementation of different control processes
of a means of authentication. For example a subscription and issuing process which is completely
web based provides less trust compared to a process which requires that the user goes to the
provider in person. This would give greater reliability and authority to the verifying database.

Before you start developing your own authentication solution first check whether there isn’t already
a suitable solution on the market which you can reuse. The costs and difficulties in creating, testing
and porving new solutions are substantial and fall on both the organisation providing a service and
its end users. Many solutions are available on the market. These providers of authentication
solutions can install the authentication functionality for you. For realizing the authentication these
providers issue means of authentication independently.

Apart from identifying users you need to determine which proceedings these users are allowed. One
user might only be allowed to check data while another user might also be allowed to change data.
Determining and registering privileges of users is called authorisation. This is the responsibility of
the process owner. The authorisations are, after all, linked to the process. An authentication soluti on
focuses only on identifying users. After authentication the process owner will have to determine
which authorisations the user is allowed.


Selection suitable authentication solution
You need to determine whether a specific authentication solution meets the needs and can be
implemented in your process.

Based on the framework you can determine whether there is a link between one of the reviewed
authentication solutions and your needs. When selecting an authentication solution it is advisable to
follow the following steps:
1. Describe electronic process

2. Determine relevant risks and identify measures

3. Determine requirements of authentication solution

4. Check framework and make a selection of authentication solutions

5. Get in touch with providers of authentication solutions and discuss detailed requirement

6. Selection of authentication solution based on quality and price. (Don’t forget that quality will
   include factors such as ease of use by and acceptability to your end users.)

7. Make agreements with provider of authentication solution

8. Make the necessary changes in electronic processes


1. Before you can choose a suitable authentication solution you need to describe your
   electronic process. Pay extra attention to the moments in the process that require
   authentication. It is advisable to make a process scheme. This is a graphic picture of the
   chronological activities that need to be executed within a process. There are different
   techniques to make a process scheme. Maybe the administrative organisation of your
   process is already worked out that way. The result of this step is a clearly described process
   which has paid specific attention to the authentication moments.

2. After describing your process you need to make a risk analysis. Points of attention are the
   risks that show up when determining the identity of the user within your (organisation)
   process. The result of the risk analysis is a set of measures that need to be followed to have
   the process meet your requirements. These measures can concern the level of trust of an
   authentication, the user friendliness of the authentication process and the legal rules that
   need to be complied to. Also you need to write down the compensating measures based on
   the risk analysis. These compensating measure can result in less requirements for the
   authentication solution.

   For example, you might always send a summary of the electronic transaction to the user by
   letter or e-mail. The user could object to certain proceedings in this communication within a
   certain timeframe. When you implemented this compensating measure you don't have to
   implement such a heavy measure with the result that the costs for the authentication solution
   can be reduced. The result of this step is a summary of the measures that need to be taken
   to meet the needs.

3. Now you need to translate these measure to (detailed) requirements. The result of the step
   is a list of requirements regarding an authentication solution.

4. Based on this list of requirements you can check the framework and make a first selection of
   authentication solutions. You have to compare the requirements of your process with the
   marks of the reviewed authentication solutions. The result of this step is a shortlist with
   possible authentication solutions.
5. After this first selection you need to determine whether the selected authentication solutions
   are also suitable at a detailed level. Get in touch with providers of authentication solutions
   and discuss detailed requirements. A possible approach could be to send out a mini
   Request for proposal to the selected providers. The result of this step is a summary of
   authentication solutions and whether they apply to your detailed requirements.

6. Based on the results from step 5 you select an authentication solution which best meets
   your requirements regarding quality and costs. It can also occur that none of the
   authentication solutions meets your requirements. In that case you should implement your
   own solution. The result of this step is a selected authentication solution.

7. In this step you have to make agreements with the provider of authentication solution. These
   agreements should be written down in contracts and Service Level Agreements (SLA's).
   Also your commitment should be written down (forexample way of payment). The result of
   this step is a legal anchorage of the agreements between you and the provider of the
   solution. You might also consider having any software for the solution being held in escrow
   against the event of the supplier becoming bankrupt.

8. Now the authentication solution is selected you need to make adjustments in your
   (organisation)process to implement the solution. This could be technical and organisational
   activities. The result of this step is a process in which the selected authentication solution is
   integrated. This step will include rigorous testing including end use acceptance tests.
Part IV: Framework Authentication solutions



This Framework has seven aspects regarding authentication solutions:

1. Life-cycle of the authentication solution;
2. Security of the solution;
3. User friendliness;
4. Suitability;
5. Availability;
6. Liability of the provider of the solution;
7. Costs.

The first 2 aspects give insight in the level of authentication. The higher a solution scores, the more
sure a communication partner can be of the identity of the person on the other side.


   A. Life-cycle of the solution

The quality of the authentication solution depends on the way in which processes have been set up
during the life-cycle. This aspect determines the level of security of the processes.


A1. Registration process

Question A1.1: How is the identity of the user determined at the first registration ?

High      Through physical appearance
Middle    Through a means of identification for which a physical appearance is required to
          obtain it.
Low       Other than the above.


Question 1.2: Based on which validation source is the identity verified ?

High      Based on a government issued photographic proof of identity (for example a
          driver’s licence, passport or identity card).
Middle    Based on another external source (e.g. bank cards, student cards)
Low       Based on another source.
Question 1.3: How are the collected registration data registered and secured ?

High           There is a defined, auditable process for the registration of data.
               There is an extensive set of registration data which contains at least more
                than names and initials.
             The surrounding in which the registration data is saved is physically and/or
                logically secured in accordance with a general accepted norm framework
                for information security (international, national, sectoral) obeying all relevant
                data protection rules.
Middle   One of the above criteria isn't met.
Low      Two or more of the above criteria aren't met.



A2. Production process

Question 2.1: Are there adequate security means in the area where the production process takes
place ?

High     The set up of the information security meets the general accepted norm framework
         for information security (international, national, sectoral) including data protection
         rules.
Middle   A documented risk analysis has taken place. Based on that a set of measures
         have been identified and implemented.
Low      Where needed, security measures have been set up.


Question A2.2: Have measures been set up regarding the production process for guaranteeing the
internal check ?

High           The production process is recorded and work instructions are available for
                and used by for employees.
             Within the organisation a division has been made between functions and
                registration (verification of identity and acceptance of the users) and
                production.
             The process is regularly, independently checked to ensure compliance,
Middle   One of the above criteria is met.
Low      None of the above criteria are met.


Question A2.3: Are the activities/proceedings of the production process recorded ?

High     1. The different steps in the production process are recorded manually or by the
         production machine (in an audit trail), so it is possible to check afterwards.
         2. Checks are made on the process and its operation by a independent person.
Middle   Only summaries of the produced means of authentication are produced (input-
         output checks).
Low      No records take place regarding the production process.
A3. Issuing process and use

Question A3.1: Which guarantees regarding information security are set up by the provider of the
solution within the issuing process ?

High     The set up of the information security meets the general accepted norm framework
         for information security (international, national, sectoral).
Middle   A documented risk analysis has taken place. Based on that a set of measures
         have been identified and implemented.
Low      Where needed, security measures have been set up.


Question A3.2: Which measures are taken to guarantee that the means of authentication is given
to the right user ?

High     The user collects it with identification and proof (for example token, unique code).
Middle   Online identification through out-of-band sent unique code.
Low      Mail to email address or postal address.


Question A3.3: Which measures are taken to guarantee checks of the user proceedings during
usage ?

High     All user proceedings with means of authentications are recorded and reports are
         generated and used. Special reports are generated and consistently acted upon of
         abnormal or atypical use. (This might involve special checks.)
Middle   All user proceedings with means of authentications are recorded. Reports are
         either not generated or not consistently acted upon.
Low      Not all user proceedings with means of authentications are recorded.



A4. Renewal

Question A4.1: Under which conditions is a new means of authentication issued ?

High     The means of authentication is replaced when the life cycle is expired. It is also
         replaced with every mutation in personal data and/or in case of a suspicion of a
         security incident.
Middle   The means of authentication is replaced when the life cycle is expired. It is also
         replaced with certain mutations in personal data and/or in case of a security
         incident.
Low      The means of authentication is replaced when the life cycle is expired or other
         circumstances.
Question A4.2: How is the identity of the user checked when the means of authentication is
replaced before the life cycle expires ?

High      The user collects it with physical identification and proof (forexample. token, unique
          code).
Middle    Online identification through valid used means of authentication or through out-of-
          band sent unique code.
Low       Mail to email address or postal address or no renewal takes place.



A5. Withdrawal

Question A5.1: What is the availability of the facility to withdraw the means of authentication ?
High    The facility is available through multiple channels 24*7*365.
Middle The facility is available through one channel 24*7*365.
Low     The facility is only available during more restricted hours.


Question A5.2: How is guaranteed that only an authorised person can request a withdrawal ?

High      Only a user and/or his supervisor are authorised to request a withdrawal. The
          identity of the one who requests this is verified and recorded. (The degree of
          verification for withdrawal or amendment may be higher than the usual level.)
Middle    Only a limited amount of people are authorised to request a withdrawal. The
          identity of the one who requests this is verified and recorded.
Low       Anyone can request a withdrawal. The identity of the person who requests this is
          not verified.


Question A5.3: What is the period of time that a request for withdrawal of a means of
authentication is processed ?

High      Processing takes place real-time or within 60 minutes after receiving the verified
          request.
Middle    Processing takes place within 24 hours after receiving the request.
Low       Processing doesn't takes place within 24 hours after receiving the request.
   B. Security of the authentication solution
During possession and use of an means of authentication there are many risks. This aspect tries to
determine what kind of level of security an authentication solution offers against those risks.


B1. Theft of authentication data

Question B1.1: Which (entry) security does the means of authentication offer against theft of the
authentication data ?

High      Security is realised by something of the user (biometrics) combined with something
          the user 'knows' (PIN or passphrase) and 'has' (token). (Three factor identification)
Middle    Security is realised by two of the above factors
Low       Security is realised by biometrics or something the user 'knows' or 'has' – single
          factor identifcation



B2. Sensibility for copying

Question B2.1: What kind of security does the means of authentication offer against illegal
copying?

High      The carrier of the means of authentication has authenticity marks and the
          authentication data are secured with powerful technical measure to prevent
          copying. Even an experienced fraudster can not/ hardly copy it.
Middle    No physical authenticity marks on the carrier or there is no carrier. The
          authentication data are secured against copying. Hard to copy by experienced
          fraudster.
Low       No carrier. The authentication data aren't shielded against copying. Easy to copy
          by experienced fraudster.



B3. Sensibility for the man-in-the-middle attack

Question B3.1: Which measures prevent a man-in-the-middle attack during the authentication
process ?

High      Although the user doesn't take action during the authentication process the server
          is authenticated in a transparent way for the user.
Middle    During the authentication process the user needs to take action to authenticate the
          server.
Low       No measures have been taken to prevent a man-in-the-middle attack during the
          authentication process.
B4. Security of centrally saved authentication data

Question B4.1: Which measures are taken to protect centrally saved data ?

High                    There is only a limited amount of centrally saved sensitive data.
                        Adequate network security measures are taken.
                        There is a database for authentication data with adequate entry
                         security. Entry is only possible for authorised people.
                       All entries are recorded and analysed. Suspicious entries are
                         investigated. Penalties exist and are used for improper use.
Middle    There are adequate network security measures or there is adequate security entry
          security regarding the database of authentication data.
Low       Limited security measures are taken.



B5. Security of decentralized infrastructure (readers)

Question B5.1: To which degree have measures been taken to secure the decentralized
infrastructure ?

High                  Tamper resistant hardware. Identification of the hardware prior to
                       the session.
                    PC security (virus scanner) installed and adequately configured (up-
                       to-date).
                    Remote testing of infrastructure to minimise risk.
Middle        Tamper evident hardware.
              PC security (virus scanner) installed.
Low       No measures taken for the security of the decentralized infrastructure.



   C. User friendliness

One specific aspect of user friendliness relates to people with disabilities. The aim should be to
make the authentication service
accessible to as many people, including those with disabilities, as possible. For those that cannot
use the authentication service as designed for non-disabled people alternative special processes
and procedures may be designed and implemented for those with disabilities of specific types. Any
evaluations should consider the degree to which the authentication solution is accessible to the
various classes of people with disabilities.

The evaluation should take account of the people who are most likely to use the electronic service
in question. For example, it will be much more important to design a service that takes account of
the needs of those with sight disabilities for a hospital than for an air force base.

Various member states have guidelines for accessibility of communications and information
technology services. Some member states have specific legislation that needs to be considered.
An accessible product or service is one which can be used by all its intended users, taking into
account their differing capabilities. A user's ability to make inputs and perceive outputs may be
impaired. This can be either permanent or temporary and may be due to various physical, mental or
environmental conditions.

Impairments affect the user's ability to perceive, understand or physically manipulate things. They
can occur for many different reasons, including medical conditions, injury, the environment or simply
old age.

Users may have difficulty understanding things if they have a learning impairment, if they are tired
or stressed or if they have a low level of literacy in the language used.

Users may have difficulty manipulating things if they have a physical disability, an injury or simply if
they are getting older.

Users may also be impaired by the technology itself. For example, services that are delivered
through websites require users to provide their own technology in the form of computer hardware,
operating system and Web browser software. If these are old or slow, they may not have the
capability to interpret or display what is on the Web page.


Criteria that determine the degree of user friendliness are:

C1. Geographical, physical (in-)dependence of authentication solution
Can the authentication solution everywhere be used or is the use limited to for Example a local PC
or desk of a post office ?


Question C.1: Does the authentication solution need a physical location ?

High      Authentication solution needs no physical location.
Middle    Authentication solution is limitedly bound to a domain.
Low       Authentication solution can only be used on one physical location because of
          restrictions to hardware, software, etc.



C2. Essential knowledge
Does the use of the authentication solution require reading a manual, following a course or
something else ?


Question C.2: How easy is the correct use of the authentication solution ?

High      It is not necessary to read the user manual or a tutorial prior to use. All users who
          will use the process will be able to use it easily.
Middle    User need at least have read the user instructions and these are available in a
          suitable language and form
Low       Users need at least have read the user instructions and the (online) tutorial.
C3: Easy to require

Question C.3: How easy is it to require the means of authentication ?

High       User receives the means of authentication directly after subscribing.
Middle     User can subscribe online, by phone or letter. Then the means of authentication is
           sent or can be collected somewhere.
Low        User can subscribe by letter or physically at a desk. After that the means of
           authentication is issued.



C4: Needed adjustment of a device (PC, PDA, telephone) for an authentication solution.

Question C.4: Does the authentication solution require the use of a (adjusted) device ?
High    Use of authentication solution does not require the use of a device.
Middle       Use of authentication solution does not require adjustments of the device.
             Device needs to comply to general criteria.
Low          Use of authentication solution requires adjustments of the device.
             Device needs to comply to specific criteria.



    D. Suitability
Criteria regarding suitability:

D1. The amount of services the user can access.

Question D.1: Is the authentication solution shared by several providers ?
High    Authentication solution is currently provided by more than 2 providers. Because of
        this more services can be accessed with the same authentication solution.
Middle Authentication solution is provided by 2 providers. Because of this more services
        can be accessed with the same authentication solution.
Low          Authentication solution is a standardized solution that is provided in this
                 form by multiple providers. However, currently this hasn't led (yet) to
                 accessibility to multiple services apart from the provider itself.
             Authentication solution is unique and isn't currently used by any other
                 provider.



D2. Growth of users of the authentication solution

Question D.2: How many users can the authentication solution cope with ?

High             There is no maximum amount of users that use the current authentication
                  solution.
               The current authentication solution can cope with over 1 million users.
Middle     The current authentication solution can cope with a maximum of 1 million users.
Low        The current authentication solution can cope with a maximum of 100.000 users.
D3. Use of several communication channels for the distribution of authentication data.

Question D.3: Is the authentication solution suitable for use through multiple communication
channels (SMS, Internet, etc.)?

High      The current authentication solution is suitable for use through more than two
          communication channels including internet.
Middle    The current authentication solution is suitable for use through two communication
          channels including internet.
Low       The current authentication solution is suitable for use through one communication
          channel.



D4. Use of open (technical) standards

Question D.4: Does the authentication solution make use of open standards ?

High      The authentication solution is based on generally used open (technical) standards
          and has proven to be interoperable in practice.
Middle    The authentication solution is based on generally used open (technical) standards
          combined with a proprietary solution.
Low       The authentication solution makes use of a proprietary (technical)standard that isn't
          open.



   E. Availability

E1. Limiting conditions to the user group

Question E.1: Is the authentication solution available to anyone ?

High      The authentication solution is available to anyone (disabled might have a slight
          problem in using it).
Middle    The authentication solution is available to anyone who comply to certain
          conditions.
Low       The authentication solution is only available to people who the provider/ process
          owner finds suitable.



E2. Limiting conditions regarding usage

Question E.2: Does the authentication solution have any limitation regarding the frequency of use
or application (for example: can it handle all transactions or only transactions of a certain size) ?
High      The authentication solution has no limitation regarding use and application.
Middle The authentication solution has a limitation in use or application.
Low            The authentication solution has a limitation in use.
               The authentication solution has a limitation in application.
E3. Limitation regarding the life cycle of an authentication solution

Question E.3: How limited is the life cycle of the authentication solution ?

High      The authentication solution has a limitation in time of > 3 years.
Middle    The authentication solution has a limitation in time of > 1 year and <3 years.
Low       The authentication solution has a limitation in time of < 1 year.



   F. Liability of the provider of the solution

No questions have been made for the liability aspect. When looking at the liability conditions of the
provider of the solution the following aspects are considered:
     Excluding liability for sequence damage and indirect damage;
     The limit concerning money in case of a liability.
     The insurances of the provider that cover financial risks
     The ability of others to use or develop the code or technology in event of bankruptcy or
        withdrawal from the market.



   G. Costs
No questions have been made for the cost aspect. These are the costs for the process owner that
wants to set up an authentication solution for its users.

1.   Initial costs:
Costs for setting up the infrastructure for the authentication solution.

2.   Yearly costs:
Actual costs for keeping the authentication solution available.

3.   Costs per user
Costs that are made once for every user.

4.   User costs
Costs that are made every time the authentication solution is used.

5.   Renewal costs
Costs for renewing the means of authentication.
Score form


Providing organisation:
Contact person:
Address:




E-mail:
Telephone:

Name authentication solution:
Short description:




Results answers frame work:                                           High / Middle / Low *
A 1.1     Determining the identity of the user at registration                       
A 1.2     Validation source of identity of the user at registration                  
A 1.3     Registering and securing data                                              
A 2.1     Security measure in area of production process                             
A 2.2     Guarantee internal check production process                                
A 2.3     Recording activities production process                                    
A 3.1     Guarantee information security in issuing process                          
A 3.2     Guarantee issuing to right user                                            
A 3.3     Check use means of authentication                                          
A 4.1     Conditions for renewal                                                     
A 4.2     Identification user renewal in between                                     
A 5.1     Availability facility for withdrawal                                       
A 5.2     Guarantee for authorized withdrawal                                        
A 5.3     Timeframe of processing withdrawal                                         

B 1.1     Security against theft of authentication data                              
B 2.1     Security against illegal copying                                           
B 3.1     Measures against man-in-the-middle attack                                  
B 4.1     Measures protecting centrally saved data                                   
B 5.1     Measures protecting decentralized infrastructure                           


 Total score for intensity authentication solution**:                                

* per question (criterion) 1 answer possible.
** weakest link approach: lowest score on the previous criterion is the total score.
Resultaten overige aspecten e-Ok:                                    Sterk / Gemiddeld / Zwak *
C.1     Solution connected to physical location                                               
C.2     Required knowledge                                                                    
C.3     Difficulty of requiring                                                               
C.4     Needed adjustments to device                                                          

D.1     Sharing of authentication solution                                                    
D.2     Growth of users of the authentication solution                                        
D.3     Suitability for different communication channels                                      
D.4     Use of open technical standards                                                       

E.1 Limiting conditions to the user group                                                     
E.2 Limiting conditions regarding use                                                         
E.3 Limitations regarding the life cycle of the solution                                      

*     per question (criterion) 1 answer possible.

F. Liaibility of the provider of the authentication solution. (Is liaibility for sequence damage and
indirect damage excluded ? What is the limit regarding money in case of damage ? Does the
provider have insurances to cover financial risks ?)




G. Costs
Initial Costs:                         €
Yearly costs:                          €
One time costs per user:               €
User costs (per use):                  €
Costs renewal:                         €




Date:
Place:
Autograph (contact person):


This form can be sent to:


………………………………….