An Examination of Identity Management Models in an Internet Setting

3. The Traditional Model

The traditional model for internet transactions involved two parties:

• –

  A user - a person who makes use of the services in an online environment,

• –

  A relying party - an entity which provides a service on the internet, normally but not restricted to being a website.

The main transaction will occur between the user and relying party. As a practical example, the user may be an individual and the relying party a website such as an online bank or store. In this context, transactions will be initiated by the user. Furthermore, the biggest challenge will be for the relying party to authenticate the user.

We note here that relying party authentication should also be considered since spoofing or phishing attacks or malicious relying parties are also possible.

A typical transaction between the two parties is shown in Figure 1.

Figure 1.

Transaction in the traditional model

It would typically consist of the following steps:

• 1.

  User U requests a service from relying party R.

• 2.

  R requests some sort of authentication from either U.

• 3.

  U sends authenticating information to R.

• 4.

  R examines the information from U and establishes that U is authentic.

• 5.

  U and R carry out their transaction.