Provision of Secure Policy Enforcement Between Small and Medium Governmental Organizations

Abstract

This paper is derived from research work conducted within eMayor project, funded by the EU committee (IST-2003-507217). Motivation of the project was the fact that small and medium sized governmental organizations (SMGOs) interact frequently with citizens and/or businesses, to offer paper-based and electronic services utilizing a limited number of resources (e.g. employees and funds). SMGOs also interact with each other, in local or cross-border transactions, to exchange information on behalf of citizens, businesses or the organization itself. Main objectives of eMayor are to build a secure, interoperable, cost-effective and open e-government platform, addressing the needs of SMGOs. The core of the eMayor platform will be built upon state-of-the-art web-services technology which enables the interoperability with existing web-services already provided by governmental organizations. However, the problem of heterogeneity of security, access control, privacy and process flow policies among the different organization remains, both on national and international level. To provide full interoperability a framework which solves the addressed issues and provides transparent coordination of different policy enforcement mechanisms is needed. Such a framework, enforcing security and access-control policies across a decentralized network of governmental organizations is discussed in this paper. First the system architecture of eMayor platform is introduced. Thereafter, general and specific security requirements that apply to an interoperable e-government platform are discussed and the trust model together with the roles which pose different authentication and authorization attributes are depicted. Results of the requirements analysis provide input for platform design. Policy enforcement mechanisms together with an overview of security solutions on identified communication channels are presented. Deployment of chosen technologies, specifically for distributed e-Government structures, is introduced taking into account the possible extensions in order to provide higher level of security standards. The paper concludes with final objectives on policy enforcement framework and outlines the work in progress.