1. E-Profile-based Security for Critical Transactions in Web Applications Written by: Jean Stephan et al., 2009 Reported by: Renato Casipe, 2/15/2010

2. Dominant Web development drivers Reliability –Applications that work well do not crash, and do not provide incorrect data. Usability –“the extent to which a product can be used by specified users to achieve specified goals with effectiveness, efficiency and satisfaction in a specified context of use”. Security –Applications that handle customer data and other information safely, so that problems such as financial loss, legal consequences, and loss of credibility can be avoided.

3. Goal of the Paper The goal of this paper is to propose a security framework which depends on the collaboration of ecommerce stakeholders in order to build an infrastructure that provides confidence and security while respecting the privacy of individuals at the same time.

4. The Model “The main thrust of our model is assessing the profile of a user and determining the confidence level which can be entrusted in the user. The overall framework of our model consists of two main components: User profile development and confidence determination and decision making.

5. Process Flow Legend User Profile Development: R = f (S1, S2, S3, S4, P, F, G)

6. Process Flow Legend Confidence Coefficient: C = f (T, R, K)…

7. Process Flow of Distributed Model User Profile Development: R = f (S1, S2, S3, S4, P, F, G) Confidence Coefficient: C = f (T, R, K)…Depending on the outcome of C, the vendor may decide to allow or decline the transaction. Profile Builder -> Rating Agent -> Confidence Determiner -> Vendor Decision

8. Authors Conclusion Preserves privacy by centralizing the access to user profiles and acquiring a rating through a profile assessment service. Identity Management is no longer based on static data. Instead, the user’s profile is a dynamic entity which evolves with time and matures based on the user’s behavior, experience, and/or interventions. E-commerce websites will be able to set their own security rules to manage critical transactions and clarify their filtering schema. Collaboration of different stakeholders will provide a rich added value towards a more trustworthy Internet-based economy.