Cross-Border Business Models

Transcription

1 Secure Management of Information across multiple Stakeholders Cross-Border Business Models Jon Shamah EEMA conference 13th June 2012

2 Why Cross-Border Business? Political Digital Agenda New: consolidation of the Euro? Economic Increasing both users and applications to Build an economic critical mass ( Economies of Scale ) Extend markets Achieved through wide-scale federation and application component re-use 2

3 Scope: B2B, B2C 3

4 Keep It Seriously Simple Because.. 4

5 Goal: Use existing processes and relationships if possible 5

6 Minimum number of relationships Most relationships will be contractual 6

7 Three Tier Architecture Individual Stork+? Infrastructure Services Application Services Identity Selector egov egov Identity Selector 7

8 Identity Selector in Use Hub Identity Selector IDsP User enters Application Portal 8

9 Identity Selector in Use Hub Identity Selector User enters Application Portal 9

10 Identity Selector in Use Hub Identity Selector Request to IDSP for credential with type of attributes 10

11 Identity Selector in Use Username/password/OTP Hub Identity Selector IDsP IDSP Authenticates User 11

12 Identity Selector in Use Attribute Manager Hub Identity Selector IDSP requests attributes from User (automatic or manual) 12

13 Identity Selector in Use Attribute Manager Hub Identity Selector IDSP sends SAML Assertion with attributes 13

14 Identity Selector in Use Attribute Manager Hub Identity Selector User Commences Session 14

15 Three-Tier Architecture Operatiing Costs Infrastructure Services Provide the applications with: Transmission Trust Federation Identity Assurance Attributes handling Security Provide the individual with attribute-based credentials Multiple coordinates Registration reference Citizenship MIDS etc Single Name Geolocation 15

16 Three-Tier Potential Revenue Sources Application Services Productivity Savings Exception/Error management Fraud Reduction Novel Applications Compliance Individual (options) Increased insurance Increased Convenience (ie GUI) Privacy preferences Special handling 16

17 Revenue (or Liability) Flows Identity Selector Providers Attribute Providers 17

18 Traditional Payment Mechanisms EMV, Others Risk Engine? Payment Intermediaries Hub Hub? Schemes Already works in cross-border environment 18

19 Payment Models Application Services Subscription Per Identity Per Transaction Per Click Individual Per Option 19

20 Multi-Planar Architectures 20

21 Multi-Planar Architectures 21

22 Multi-Planar Architectures service contracts backed by insurances scheme Liability Revenues Risk Analysis 22

23 Parts of Transaction Identification / Authentication eid Architecture Conducted between individual and Identity Service Provider (IDSP) Liability for identity risk is: Directly between Application Service Provider and IDSP.or Between Application Service Provider and Trusted Third Party for crossborder transactions.or Between Application Service Provider and cross-border IDSP if identity is on Trusted Service Status List and/or a mutually recognised eid Should always be offset via local insurances which will vary in cost depending on assurance level (see above) Transaction Payment Mechanism Insured via payment intermediary (Visa, Paypal etc) Increased insurance for high value transactions and assurance levels For non-financial transactions, agreed values for personal data loss need to be established otherwise redress cannot be achieved 23

24 Examples Bank Loan Application Compliance Social Tickets Mail-Order Tailoring Hailo Starbucks 24

25 Digitisation of Bank Loan Application Service consisting of a signing and workflow service is used in conjunction with eids to digitally process bank loan application Application Guarantee Contract Terms & Conditions Applicant X x x Advisor X x x Manager X x x Guarantor x x x Traditionally in this process can take over one month in time to complete and require over 70 sheets of paper. Real examples have shown savings in excess of 70 per application and each bank may process many thousands of applications per week. For the case of 10,000 applications per month, the saving to a bank is worth approximately 8m+ per year. 25

26 Safety Compliance Service consisting of a signing and workflow service is used in conjunction with eids for Safety Assessment of a Public Venue. Risk Assessment Equip Performance Evacuation Procedures Security Procedures Health & Safety Manager x x x x House Manager x x Facilities Manager x General Manager x This process will need to be completed for each event and many will need to be signed in a specific order, collated and filed both on site and externally. Digital completion, non-repudiation of documentation and archiving, coupled with a flexible alert and warning system can ensure that tasks are completed on time and documentation is filed and archived according to regulations. Real experience has shown that timely completion of documentation against hard deadlines is challenging, and can lead to fines and closures. 26

27 Social Service Tickets/Vouchers Service Ticket/Voucher valid and redeemable for a particular approved social service or item with approved suppliers and is not linked to a specific monetary value. virtual and is signed by participants in process as each stage Signatures needed are role based: Issuer Recipient Authorised Merchant Payment Authority Ticket can be provided by or postal services with barcode to present to the merchant. In the event of there being no digital identity available, Every stage of the process is signed on a central server and cannot be changed 27

28 True e-commerce Step 1 28

29 True e-commerce Step 1 Enquire Step 2 Order and send attributes 29

30 True e-commerce Step 1 Enquire Step 2 Order and send attributes Step 3 Fulfil 30

31 Hailo Identity = Geo-location, need for taxi Service = Fast taxi booking, security and ease of payment Payment mechanism = Pre-arranged EMV or cash 31

32 Starbucks Identity = Geo-location Service = Store/product information and ease of payment Payment mechanism = Pre-pay 32

33 Conclusions Cross-border is less challenging in B2B, B2C Complicated does not work. Keep existing business relationships We have a missing player: Insurance companies 33

34 Conclusions Cross-border is less challenging in B2B, B2C Complicated does not work. Keep existing business relationships We have a missing player: Insurance companies 34

35 Conclusions Cross-border is less challenging in B2B, B2C Complicated does not work. Keep existing business relationships We have a missing player: Insurance companies 35

36 Conclusions Cross-border is less challenging in B2B, B2C Complicated does not work. Keep existing business relationships We have a missing player: Insurance companies 36

37 Thank You Contact: Jon Shamah