Glossary Item Box

Government Gateway 2.2.0 (MR-01) ISV Developer Help (Doc Version 06/03/08) | Send comments on this topic.

# Security Goals

The Gateway architecture and implementation addresses the three primary goals of security:

- Confidentiality – the protection of data from unauthorised access. In part this is achieved through the Secure Socket Layer (SSL) sessions that provide encryption between all communicating parties; users (browser/Web Portal or ISV applications) and the Gateway. Confidentiality is also provided through identification/authentication and authorisation. The Gateway uses security tokens based directly, or indirectly, on a user’s User ID/Password or X509 digital certificate credential, that is embedded in each SOAP method call.
- Integrity – the trustworthiness of data. This is achieved through hashing and digital signatures to prevent data from being tampered with, plus the use of non-repudiation tokens to confirm that key operations should be performed. SSL sessions also ensure communicating parties know who they are communicating with.
- Privacy – Information on users in one department is not shared (by Gateway) with other departments.

© Crown Copyright 2008. All rights reserved