All STAR Transport Security Requirements can be supported by using SSL over HTTP as a secure channel Infrastructure. The SSL handshake requires that the Receiver pass a Digital Certificate to the Sender. The Sender can verify that the Receiver is a known party and that the Receivers Digital Certificate has been signed by a Trusted Party, such as a Certificate Authority. In this manner, a Sender may enable Business Authentication, Party Authentication, Target Authentication, System Authentication and or Unique Party Identification, depending on how the Sender defines and uses its own security policies.

Optionally, SSL can be used by the Receiver to require the Sender pass a Digital Certificate, allowing the Receiver to enable Business Authentication, Party Authentication, Source Authentication, System Authentication and or Unique Party Identification, again depending on how the Receiver defines and uses its own security policies.

SSL enables Privacy/Confidentiality. All SSL traffic is encrypted using dynamically generated symmetric keys, which are reasonably efficient and very secure.

A Virtual Private Network can provide the Infrastructure level security needed by STAR messages. Typically VPNs are implemented as proprietary software, where both the Sender and Receiver must install and maintain similar software or in some cases two parties may install and use two messaging software packages based on a common standard such as IPSec. There are a large variety of technologies and practices that are covered by the term VPN; the primary idea of a VPN is to provide a secure channel that allows messages to be transported in a safe “tunnel” that may be running over public networks or may utilize privately leased lines or communication systems.

A Secure Channel Infrastructure MAY be used to enable all STAR Security Features including Business Authentication, Party Authentication, Privacy / Confidentiality, Source and Target Authentication, Source Only Authentication, System Authentication and Unique Party Identification.

Infrastructure Level Security is equally applicable to STAR Web Services messages and STAR ebMS messages.

STAR RECOMMENDS Parties utilize either an Infrastructure-Level Security or Message-Level Security for a single message exchange.

Parties SHOULD NOT utilize both an Infrastructure-Level Security and Message-Level Security such that the security is duplicated or redundant across both layers.

It is strongly RECOMMENDED that Parties use SSL over HTTP.

Parties MAY utilize VPN technologies such as IPSec, if the two parties can agree to use the VPN in a manner that is as reasonably secure as SSL over HTTP.

Parties MAY exchange Digital Certificates out of band.

Parties MAY utilize self issued or self signed Digital Certificates if both partners agree to use them.

STAR RECOMMENDS the use of Digital Certificates for Infrastructure Level Authentication, but does not prohibit the use of Username/Password.