1. Defining a federated messaging and trust infrastructure for secure and reliable exchange of data Kenneth Bengtsson OASIS Business Document Exchange (BDX) TC 19 th UN/CEFACT Forum Geneva, 17 April 2012 www.oasis-open.org

2. BDX – Business Document eXchange n Defining specifications for multi-cornered messaging infrastructures n Secure and reliable exchange of information n Content agnostic n Defining both trust and messaging standards n Base on existing and proven technologies wherever possible

3. BDX background May 2008 PEPPOL project November 2009 1 st specifications ready January 2011 OASIS BDX TC November 2011 European LSP eDelivery convergence April 2012 BDX rechartered to accept new requirements

4. PEPPOL’s 4-corner model

5. PEPPOL’s architecture framework

6. Current situation n Many solutions to the same problem l National / regional / local / sector specific / public / private n Big difference in complexity and architecture l Peer-2-peer model l 3-corner models l 4-corner models l Web-based and/or based on machine-2-machine interaction n Many different business models

7. High-level infrastructure requirements n Secure and reliable n Support for small and medium sized organizations l Trust requirements raise the barrier l Low-latency and availability requirements raise the barrier n Leverage investments in existing infrastructures n Base on existing and proven standards

8. Achievements n Clear architecture model that fits into existing approaches n Coexists and enhances existing infrastructures and networks l Avoids creating another infrastructure “island” n Scalable and robust - no single point of failure l As few centrally managed parts as possible n Trust in the network n Governance enabled n Low barriers-to-entry

9. PEPPOL’s overall architecture Service Metadata Locator PEPPOL Certificate Authority Service Metadata Publisher PEPPOL Access Point Service Central Governance Points Distributed Replicated Scaled Systems

10. Basic elements of the PEPPOL infrastructure

11. PEPPOL scenario Company ACompany B Country A Country B Operator 1 Company C Operator 2 BusDox SML Registry Access point, VAN 1 Access point 2, Operator 2 Transport properties Secure Reliable Profile properties Transport + QoS Invoice Public agency D Key: CompanyC SMP point: SMP point de http://smp.de/ SMP Registry Endpoint: Access point 2 http://ap2.de/ Key: CompanyC Doc: Invoice Profile: Peppol

12. Roadmap for OASIS BDX PEPPOL specifications and requirements have been submitted Other European LSPs have submitted requirements as well Gather further requirements and analyze use cases Specifications for a unified architecture for secure and reliable exchange of business documents

13. Thank you Kenneth Bengtsson OASIS BDX TC kenneth@alfa1lab.com

14. BACKUP SLIDES

15. Overall standards used in PEPPOL n DNS l Service Metadata Locator (SML) n HTTP l SMP (HTTP GET) l START and LIME profiles (SOAP transport) n SOAP l START and LIME profiles n WS-Transfer l START and LIME profiles n WS-Security, WS-ReliableMessaging l START profile

16. Why use a four-corner model? n Connecting existing infrastructures rather than creating a new “island among the islands” n Freedom to choose service provider and avoiding lock-ins l Avoiding the need to connect to multiple providers n The requirements differs a lot between service providers, large companies and SME’s l Trust requirements raise the barrier n The technical solution requires a trusted third-party l Low-latency and availability requirements raise the barrier n Requires hosted services with good SLA l No single transport profile matches all the requirements. The four-corner model caters for this inherent problem

17. Why is the SMP separate from the Access Point? n Orthogonal n Can use metadata without agreed transport protocol n Can use transport protocol without looking up metadata l e.g. hardcoded endpoints n Allows new protocols to be added n Allows alternate governance models Metadata Transport