This presentation describes a system which is in widespread use in the UK. The present situation in Russia may be different but the Russian Library and Information sector is developing rapidly its use of online services. Copyright and other aspects of intellectual property are of increasing importance. Athens provides a system which holds the balance between the requirements of library and information service for access and the rights of intellectual property owners for just compensation in conformity with agreements between the various parties.

Consider the average University Library. It will have

• Books and journals on its shelves documented in its Library OPAC
• Inter Library Loan agreements for ranges of other printed material
• Bibliographic databases to which it subscribes: INSPEC, EBSCO, Medline, etc
• Online full text material from: Elsevier Science, Academic Press, Institute of Physics, etc
• Perhaps a Virtual Learning Environment providing course based information

This body of material provides an Information Web that members of the University can navigate using the facilities of the web.

So what’s the problem? The problem is that little, if any, of this information, offered through this range of products, is free. They tend to be products that the University has purchased from a range of different suppliers. The same journal article can be available on paper, in a bibliographic database, in full text from a range of places. Also, rights to the article can be purchased from a range of places, from the publisher, from a subscription agent, from a third party such as Adonis, ingenta or the British Library, through a consortium deal.

As the user navigates through this web of information, at every content boundary he will be challenged

• Who are you?
• What rights do you have?

The ‘who are you?’ is the authentication, and attribute check, the ‘what rights do you have?’ is the authorisation check. In the context of Academic Research Material, ‘who are you?’ is likely to be Ivan Ivanovich, with attributes of the State University of X Oblast, member of staff, lecturer, in the department of chemistry, say. Ivan’s rights are the collection of his personal rights, his departmental rights and his institutional rights.

The term Access Management is generally used in the context of managing access for approved individuals to protected online content, where its primary objective is to protect access to subscribed or purchased content on behalf of the content owner in accordance with his licence conditions.

Authentication is about identifying the user of an online service. Various techniques are used, the most common being:

• IP authentication
• Usernames and passwords
• Smart cards
• Biometric authentication
• X.509 certificates

The simplest form of authentication is IP authentication. This works as follows:

Each computer connected to a network has a unique network address associated with its position on the network. It is usually expressed as a number, like 123.456.67.890. These are IP addresses, where IP stands for Internet Protocol. IP addresses are all unique and are managed world-wide by the Domain Naming Scheme (DNS). When a user connects to a web-site or online service the IP address of his computer is made available through his web browser to the online service. He can then be recognised by his unique network number.

These days, all organisations, large or small, use a firewall to connect their local network to the Internet at large. All connections to external networks go through the firewall. This allows the organisation to control which of their internal computers can access which external services, and which external services can access their internal network.

So, when an organisation subscribes to an online service, the organisation can simply register its firewall addresses. Then when a user on the internal network connects to the online service, the service will be able to identify the user’s organisation, and allocate the user the rights belonging to his organisation.

There are many advantages of IP authentication:

• Simple administration with only one or two firewall addresses which change infrequently to cover hundreds or thousands of individual users
• Seamless for the end user, who does not have to do anything or remember anything
• Simple to implement for the online service

But it has several disadvantages:

• The subscribing organisation is defined by the network topology. For instance, within the National Health Service (NHS), it is impossible to identify an organisation other than the NHS as a whole, because the firewalls are NHS wide. Similarly, it is unlikely to be possible to identify the Department of Chemistry within a University as typically the firewalls are institution wide.
• IP addresses are relatively easy to fake, ask any computer science undergraduate
• It is not possible to authenticate a genuine member of an organisation if they access a service from outside the internal network. Remote users are increasing all the time as more people are not based at their home organisation, either working from home or simply located remotely. In Universities, distance learners are an increasing part of the University population and may be located in a different part of the world. Indeed, some organisations like the Open University may not possess any central facilities at all.
• IP addresses provide no means of personalisation. Attribution is purely at the organisational level, so there is no opportunity for the online service to offer personalised features such as saved searches, email alerting or different language options.
• Only institutional statistics
• No audit trail for individual accountability
• Security of access is dependent upon the physical security of computers on the internal network. Organisations who operate an open door policy to their library or PC laboratory cannot claim with any justification that users of their computers are genuine members of their organisation.

When an individual or organisation is entitled to access an online service, he is often issued with a username and associated password to allow him access to the protected content. The username is his unique identity, according to that content owner, and has associated with it his rights. On entry to a protected area of the service, he will be asked to supply his username and password on a login form.

Online services that are username/password based all provide a facility for the user to request a new password. This reduces the load on their Customer Service department for requests for forgotten passwords.

At the institutional level, the management of usernames and passwords for online services is a greater problem. The average UK University Library has over 300 online services. If these all have usernames then management is a substantial task, as is distribution of the username to approved members of the organisation.

The problems of usernames and passwords relate mostly to the proliferation of them, and the consequent management problems. The basic concept of a username and password is relatively sound.

One possibility to ease the problems is the use of devolved or delegated authentication. In this case, the online service does not attempt to authenticate the user itself, it simply directs the user to a trusted body, usually his home institution. The user is then authenticated, probably using his normal username and password, his attributes are determined, and he is returned to the online service.

This has many advantages:

• The user only needs to remember his institutional username, which he uses often and is unlikely to forget
• The online service does not have to manage any usernames for the organisation
• The organisation is in the best position to provide an accurate and up-to-date statement of the user and his attributes
• The online service does not ‘see’ the authentication dialog between the user and the trusted body, thus improving security
• Devolved authentication services are now commonly available, usually in the form of LDAP Directory Services such as Sun’s iPlanet or Microsoft Active Directory.

Authorisation is the process of deciding whether this individual with these attributes is entitled to access this protected content. The most common means of entitlement is payment, but not exclusively.

Payment for access seems simple, but can be far from simple. If you consider a single journal article, this is available in a variety of media

• On paper, on the library shelf
• In abstracted form, in a bibliographic database
• Online

An individual can purchase these in a variety of ways

• Yearly subscription to the paper
• Single paper article by Inter Library Loan
• Online journal subscription
• Online single article
• Carnet book of online articles
• Subscription to a bibliographic database
• Block of searches of bibliographic databases

He may also make his purchase from a variety of sources

• The publisher
• A subscription agent
• An online service

Using a variety of attributes

• As an individual
• As a member of an organisation
• As a member of a learned society
• As part of a consortium
• As part of a national agreement.

This is a veritable web of digital rights – which has yet to be disentangled.

Athens is in the unique position of being the only large scale centralised Access Management System in common use. I say unique with justification, as two major online services have recently asked to be able to offer the Athens Access Management System as an adjunct to their own service.

Athens has the current Joint Information Systems Committeel (JISC) contract for an Access Management System for use in UK Higher and Further Education. Athens has a similar contract with the NHS Information Authority for centralised registration, account management and authorisation facilities, for access to the same set of online academic research material.

So what is Athens?

In its simplest terms, Athens is a central database that contains

• Details of institutions who use Athens, with links to their preferred database of credentials for access to Athens-protected services. These can be held centrally in Athens, or delegated to the institution itself, using a local authentication service. This is referred to as Athens Devolved Authentication or AthensDA.

• Usernames and passwords for institutions which do not have the local infrastructure to support a real-time authentication service. Athens offers extensive web-based account management facilities for these usernames and passwords. This is delegated account management.

• Authorisation rights for access to the online services. Athens does not sell services, it simply holds the rights information. When an Athens-protected service is sold to an Athens site, by the content owner or his agent, Athens is simply informed by the accredited agent and the site is given access to the service.

Each organisation registered with Athens has a nominated Athens Site Administrator, who formally agrees to act on behalf of their organisation in accordance with the Athens Conditions of Service.

The Administrator is generally a member of Library staff, who has detailed knowledge of the online services to which the organisation subscribes. Responsibility for meeting the licence conditions of each content owner rests with the Administrator.

The Athens site administrator has the facilities to allocate rights to all or subsets of users at the institution, depending on their attributes. In practice, all resources that an institution subscribes to are generally allocated to all their users, as most content owners offer site licences. This is less work than allocating resources piecemeal, and, if the users are entitled to access these resources, why exclude them?

These capabilities mean that online services which employ Athens-protection can direct users to an Athens login form, which authenticates users against the authentication service of the organisation’s choice, and then determines rights to the service.

Athens authentication is generally offered in addition to an online service’s own authentication. The service can check the IP address of the end-user first , and if it recognises the IP address, can allow the user to enter the service. If the IP address is not recognised, then the service can offer a choice of Athens authentication, or its own authentication.

Each Athens site has usernames with a unique three character prefix, details of which are held publicly in the Athens web site at http://www.athensams.net.This means that the online service can identify the organisation of the user, and can associate the organisation with its own customer database. This allows the service to provide different granularity of service access to different customers.

The Athens database contains 2 million user accounts, from over 750 organisations, of which 250 are UK Higher Education institutions, 250 are UK Further Education colleges, 100 are NHS organisations of various types, with a further 100 organisations world wide.

Over 250 online services use Athens protection, including key figures in the online academic research market, such as Elsevier Science, Wiley, OCLC and EBSCO. For the full list see the Athens web site at www.athensams.net/dsp/resources.html.

In February 2002, Athens launched the Single Sign On facility. This allows a user to navigate from Athens-protected service to Athens-protected service, and only to supply his username and password once. He will be challenged each time he accesses each different service, but will not be asked to supply his username/password as the Athens domain will retain his authentication for 8 hours.

Athens provides an extensive range of account management facilities for Athens administrators. These include

• Shared accounts with IP restrictions, which are designed for small organisations with limited capabilities
• Individual accounts with no IP restrictions suitable for remote users
• Expiry dates on all accounts
• Bulk upload facilities to create accounts based on another data source, such as Student Registry or course information
• Ability to cascade authorisation rights to subsets of accounts
• Hierarchical account structure with the ability to create administrators at different levels, e.g. for the Department of Chemistry.

Athens is an important feature to be considered by database owners and information service providers in Russia who want to market their services in the UK and increasingly worldwide. Equally, Russian institutions which are facing the challenge of managing controlled access to an increasing range of international services should be considering Athens as the system of choice for this service.