********

Access management in memory institutions

Those attending the workshop on authentication at the CULTURAL HERITAGE
PROJECTS CONCERTATION EVENT in Vienna have agreed the following
statement.

Good management of access to cultural resources especially the processes
of authentication and authorisation are critical to providing better
services to end users, improved management of resources and bringing
more activities online such as payments.

The benefits can be summarised as:
* simplifying access to licensed resources for end users
* making possible access from anywhere
* permitting transparent cross searching
* simpler administration
* personalisation of services
* connecting people by virtue of their profile of interests (Knowledge
Management)
* monitoring usage and accurate application of performance indicators
* improving licences by granular control of access

There is also a need for strong authentication to permit
* secure payments or transactions with budgetary implications
* guaranteeing privacy

Projects under FP4 such as Candle, Decomate II and Pride have made
progress in various technical aspects of the problem. TECUP has
addressed the broader licensing issues.

However it was one of the conclusions of the Pride project that
implementation of an X.509-based strong authentication scheme within the
framework of broker/intermediary types of services (such as those
carried out by the PRIDE project) is a promising, yet challenging
undertaking. While the benefits are numerous, the two major problems
that need to be solved are:
1. the deployment of digital certificates for each user is complicated;
moreover, this procedure is drastically different from the
authentication methods commonly practiced by libraries, archives and
museums.
2. strong authentication does not let a trusted intermediary
authenticate itself as its client, which makes it unattractive in
mediated environments.

Billing and payment services have encountered the following obstacles on
the path to their deployment:
* dependency on strong authentication,
* significant differences in legacy payment systems and agreements used
in libraries archives and museums today imply that deployment of a
protocol like SET, however attractive, would not be able to support all
the scenarios.

The workshop participants agreed that there is a need for a major test
bed project to try and push forward the implementation of strong
authentication in memory institutions, permitting electronic commerce
applications and the full protection of privacy online. This should work
should actively involve publishers and intermediaries as well as
libraries, archives and museums. Ideally it should also draw on early
experiences of those European countries already implementing strong
authentication strategies (e.g. German Higher Education) and project
work outside the EC, e.g. in the United States.

**********

Andrew Cox, Senior Researcher, LITC, South Bank University, +44 020 7815
7058