B2B Integration : A Practical Guide to Collaborative E-commerce

320 B2B Integration — A Practical Guide to Collaborative E-commerce
Continued from page 319
way. Once a message is sent, non-repudiation capability must be in
place so that there is no question who sent or received a particular
message.
TradeWave secured OASIS transactions by building upon an Entrustbased
Public Key Infrastructure (PKI) to create a nonproprietary,
open-architecture solution that meets all relevant industry, government
and international security standards. The standard Entrust PKI was
advanced by 'Web-enabling' it, automating its ability to issue certificates
and adding an access-control tool that handles data-access
privileges for each user.
Security Implementation at MAIN
The major TradeVPI components that support the OASIS architecture
at JTSIN participant MAIN (Mid-America Interconnected Network)
are the TradeWave's online certificate authority (CA) service, client
and server software and the TradeAccess Control Server software.
• A trusted CA directory manages and distributes electronic keys for
encrypting information and electronic certificates for authenticating
user and server identities.
• TradeAgent client enables a user's Web browser to gain secure
access to the Web pages of MAIN and other participating OASIS
utilities.
• TradeAgent Server provides secure MAIN resources, such as
confidential OASIS pages, to TradeAgent client users.
• Both the TradeWave client and server software encrypt and decrypt
data detailing the pricing and availability of electricity at MAIN
and other OASIS participants.
• The TradeAccess Control Server software ensures that authenticated
users with the proper access privileges can access certain protected
MAIN and OASIS resources.
User Authentication
Users must first be approved by a local registration agent (LRA), who
provides the user with a security profile. MAIN'S LRA then confirms
Continue on page 321