Web Commerce Security Design and Development

Communications Security

As discussed in Chapter 5, encryption is a strong tool to protect communications. Protocols such as SSL and IPSec, if properly applied, can provide transmission security for sensitive data. Additional approaches, such as the trusted network connect architecture, have also been developed to secure inter-network communications.

Inter-Network Security

Internetworking is defined as connecting multiple networks together or as a network of networks. One approach to inter-network security is the Trusted Network Connect (TNC) Architecture.

The Trusted Network Connect Work Group (TNC-WG) (www.trustedcomputinggroup.org) has developed the open TCG Trusted Network Connect (TNC) Architecture for Interoperability to promote network communications security. The architecture supports network access control and enforcement of policies that can be put in place to determine the state of security in communication endpoints of a network or internetwork as communications security is a function of the trustworthiness of the end points of the communication path. The endpoint security can be evaluated using prescribed integrity measurements based on features of trusted platforms. End point integrity is defined as the freedom of endpoints from harmful hardware or software.

The TNC defines platform authentication, which comprises the following two elements:

• Proof of identity
• Integrity verification

These criteria provided by the platform requesting connection are used by verifiers ...