Part I. The Vision of SEMPER |
|
|
Secure Electronic Commerce |
|
|
3 | (12) |
|
The Notion of ``Electronic Commerce'' |
|
|
3 | (3) |
|
Shopping over the Internet |
|
|
3 | (2) |
|
Business-to-Business Commerce |
|
|
5 | (1) |
|
What's Special about Electronic Commerce? |
|
|
6 | (2) |
|
Virtuality of Electronic Commerce |
|
|
6 | (1) |
|
The Internet as a Hostile Environment |
|
|
6 | (1) |
|
|
7 | (1) |
|
New Opportunities to Commit Fraud |
|
|
8 | (1) |
|
Existing Approaches to Secure Electronic Commerce |
|
|
8 | (3) |
|
|
8 | (1) |
|
|
9 | (1) |
|
Digital Signatures and Public-Key Infrastructures |
|
|
10 | (1) |
|
|
11 | (1) |
|
The Whole Picture of Electronic Commerce |
|
|
11 | (2) |
|
Resulting Goals of SEMPER |
|
|
13 | (2) |
|
|
13 | (1) |
|
|
13 | (2) |
|
|
15 | (8) |
|
|
15 | (2) |
|
|
17 | (1) |
|
|
18 | (3) |
|
Protocols and Implementation |
|
|
21 | (2) |
|
|
23 | (8) |
|
|
23 | (1) |
|
Predictable Liability for Signature Keys |
|
|
24 | (3) |
|
Commitments without Online Third Party |
|
|
25 | (1) |
|
|
25 | (1) |
|
Security and Market Effectiveness |
|
|
26 | (1) |
|
The SEMPER Electronic-Commerce Agreement |
|
|
27 | (2) |
|
|
27 | (1) |
|
Introducing Electronic-Commerce Agreements |
|
|
28 | (1) |
|
|
29 | (2) |
|
Vision of Future Products |
|
|
31 | (10) |
|
Four Facets of SEMPER as a Product |
|
|
31 | (2) |
|
SEMPER-based Business Applications |
|
|
33 | (4) |
|
|
33 | (1) |
|
Person-to-Person Scenario: The Fair Internet Trader |
|
|
34 | (3) |
|
|
37 | (4) |
Part II. Project Achievements |
|
|
|
41 | (4) |
|
|
41 | (1) |
|
|
42 | (3) |
|
|
42 | (1) |
|
|
42 | (1) |
|
Teams of Individuals, not Organizations |
|
|
42 | (3) |
|
|
45 | (20) |
|
|
45 | (4) |
|
The Model of Deals, Transfers, and Exchanges |
|
|
45 | (1) |
|
|
46 | (2) |
|
|
48 | (1) |
|
Transactions, Sessions, Contexts |
|
|
48 | (1) |
|
|
49 | (9) |
|
|
49 | (2) |
|
|
51 | (1) |
|
Transfer-and-Exchange Layer |
|
|
52 | (2) |
|
|
54 | (1) |
|
|
55 | (3) |
|
Implementation Architecture |
|
|
58 | (3) |
|
Structure of a Block: Manager-Module Concept |
|
|
58 | (2) |
|
|
60 | (1) |
|
Business Applications and Browser Integration |
|
|
61 | (1) |
|
|
61 | (1) |
|
|
62 | (3) |
|
|
65 | (30) |
|
|
65 | (1) |
|
|
66 | (8) |
|
|
68 | (1) |
|
|
69 | (1) |
|
|
70 | (4) |
|
|
74 | (1) |
|
|
74 | (1) |
|
|
74 | (3) |
|
|
75 | (1) |
|
|
76 | (1) |
|
SME Business Applications |
|
|
77 | (1) |
|
|
77 | (1) |
|
Trial Participants' Reactions |
|
|
77 | (8) |
|
Initializing the SEMPER Software |
|
|
78 | (2) |
|
Purse Creation and Management/Payment Options |
|
|
80 | (2) |
|
TINGUIN (Trustworthy User Interface) |
|
|
82 | (2) |
|
Secure Identification and Document Exchange |
|
|
84 | (1) |
|
Service Providers' Reaction |
|
|
85 | (6) |
|
|
91 | (4) |
|
|
95 | (26) |
|
Vision of a Person-to-Person Electronic-Commerce Tool |
|
|
95 | (2) |
|
A New Type of Electronic Commerce |
|
|
95 | (1) |
|
|
96 | (1) |
|
The FIT from a User Perspective |
|
|
97 | (9) |
|
|
98 | (1) |
|
|
98 | (4) |
|
|
102 | (1) |
|
|
103 | (2) |
|
|
105 | (1) |
|
|
106 | (7) |
|
|
106 | (2) |
|
|
108 | (1) |
|
|
108 | (1) |
|
|
109 | (2) |
|
|
111 | (2) |
|
|
113 | (6) |
|
|
119 | (2) |
|
The Commerce Layer: A Framework for Commercial Transactions |
|
|
121 | (34) |
|
|
121 | (3) |
|
|
121 | (1) |
|
The Generic Deal Approach |
|
|
122 | (2) |
|
Concepts and Architecture |
|
|
124 | (12) |
|
The Commerce-Transaction Service Model |
|
|
124 | (2) |
|
|
126 | (1) |
|
|
127 | (1) |
|
|
127 | (2) |
|
The Commerce Service API Access Control |
|
|
129 | (1) |
|
Authorization of Commerce Transactions |
|
|
130 | (5) |
|
Service Quality Management |
|
|
135 | (1) |
|
|
136 | (12) |
|
The Commerce-Layer Use Cases |
|
|
136 | (3) |
|
|
139 | (2) |
|
|
141 | (1) |
|
Representation of a Commerce Transaction |
|
|
141 | (1) |
|
|
141 | (5) |
|
|
146 | (2) |
|
Using the Commerce Transaction Service |
|
|
148 | (7) |
|
|
149 | (1) |
|
Definition of Transaction Classes |
|
|
149 | (2) |
|
|
151 | (1) |
|
|
152 | (1) |
|
|
152 | (3) |
|
Fair Exchange: A New Paradigm for Electronic Commerce |
|
|
155 | (30) |
|
Introduction and Overview |
|
|
155 | (4) |
|
Why ``Generic'' Fair Exchange? |
|
|
156 | (2) |
|
|
158 | (1) |
|
|
158 | (1) |
|
|
159 | (3) |
|
|
159 | (1) |
|
|
160 | (1) |
|
|
161 | (1) |
|
Using Transfers and Fair Exchanges |
|
|
162 | (2) |
|
Transfers of Basic Business Items |
|
|
163 | (1) |
|
|
163 | (1) |
|
A Model of Transfers Enabling Fair Exchange |
|
|
164 | (6) |
|
|
164 | (2) |
|
|
166 | (2) |
|
|
168 | (1) |
|
|
169 | (1) |
|
Transfer-based Generic Fair Exchange |
|
|
170 | (3) |
|
Exchanging Externally Verifiable and Generatable Items |
|
|
170 | (2) |
|
Exchanging Externally Verifiable and Revocable Items |
|
|
172 | (1) |
|
|
172 | (1) |
|
The SEMPER Fair-Exchange Framework |
|
|
173 | (12) |
|
|
174 | (4) |
|
The Transfer-and-Exchange Framework in Action |
|
|
178 | (4) |
|
Extending the Transfer-and-Exchange Layer |
|
|
182 | (3) |
|
|
185 | (28) |
|
|
185 | (2) |
|
Models of Electronic Payment Systems |
|
|
187 | (2) |
|
|
187 | (1) |
|
|
188 | (1) |
|
|
189 | (9) |
|
|
189 | (2) |
|
|
191 | (1) |
|
|
192 | (4) |
|
|
196 | (1) |
|
Transactions and Transaction Records |
|
|
196 | (1) |
|
|
197 | (1) |
|
Adapting a Payment System |
|
|
198 | (1) |
|
Using the Generic Payment Service Framework |
|
|
198 | (3) |
|
|
198 | (1) |
|
Special Application Functionality |
|
|
199 | (2) |
|
Token-based Interface Definition |
|
|
201 | (2) |
|
|
203 | (6) |
|
|
203 | (3) |
|
Payment Security Policies |
|
|
206 | (3) |
|
|
209 | (2) |
|
|
211 | (2) |
|
Trust Management in the Certificate Block |
|
|
213 | (20) |
|
Public-Key Infrastructure |
|
|
213 | (3) |
|
The Need for Trust Management |
|
|
216 | (4) |
|
Specifying Trusted CAs and Acceptable Certificates |
|
|
218 | (1) |
|
Selecting Certificates Automatically in a Business Session |
|
|
218 | (2) |
|
Design of Policy Management |
|
|
220 | (3) |
|
Maintaining Information about Policies |
|
|
220 | (1) |
|
|
220 | (2) |
|
Negotiation of Certificates |
|
|
222 | (1) |
|
|
223 | (7) |
|
Public-Key Infrastructure in the SEMPER Trials |
|
|
223 | (2) |
|
|
225 | (5) |
|
|
230 | (3) |
|
|
230 | (1) |
|
Microsoft Internet Explorer |
|
|
231 | (1) |
|
|
232 | (1) |
|
Limiting Liability in Electronic Commerce |
|
|
233 | (24) |
|
|
233 | (7) |
|
Necessity to Limit Liability |
|
|
233 | (4) |
|
Separation Between Digital Signature and Undeniable Commitment |
|
|
237 | (2) |
|
Principles and Achievements of the Solution Proposed |
|
|
239 | (1) |
|
Description of the Commitment Service |
|
|
240 | (7) |
|
What Exactly is an Undeniable Commitment? |
|
|
241 | (1) |
|
Initialization of the Subscriber |
|
|
242 | (1) |
|
|
243 | (1) |
|
|
244 | (1) |
|
Commitment Request and Response |
|
|
244 | (2) |
|
Validity of the Commitment Certificates |
|
|
246 | (1) |
|
Using the Commitment Service as Liability-Cover Service |
|
|
246 | (1) |
|
Integration in a Legal Framework |
|
|
247 | (1) |
|
Possible Variants and Supplements |
|
|
247 | (5) |
|
|
248 | (1) |
|
|
248 | (1) |
|
Combination with ``Solvency Service'' |
|
|
249 | (1) |
|
|
249 | (1) |
|
Several Relying Parties or Beneficiaries |
|
|
250 | (1) |
|
Other Kinds of Authorization and Issuance of Commitment Certificates |
|
|
251 | (1) |
|
Who is Liable for Failures at the CCA? |
|
|
252 | (1) |
|
|
253 | (4) |
|
Reasons for Merchants to Use the Commitment Service |
|
|
253 | (1) |
|
Chambers of Commerce to Provide the Commitment Service? |
|
|
254 | (1) |
|
Reasons for Buyers to Use the Commitment Service |
|
|
254 | (3) |
|
|
257 | (48) |
|
|
257 | (1) |
|
Legal Issues in Electronic Commerce |
|
|
258 | (12) |
|
Applicable Law and Jurisdiction |
|
|
259 | (1) |
|
Electronic Authentication---Validity of Digital Signatures |
|
|
260 | (1) |
|
Proof of Digital Signatures |
|
|
260 | (2) |
|
Regulations for Use and Export of Dual-Use Goods |
|
|
262 | (1) |
|
|
263 | (1) |
|
Privacy and Data Protection |
|
|
263 | (1) |
|
Advertising, Competition, Spamming |
|
|
264 | (1) |
|
Content of Contracts and Internet Pages |
|
|
265 | (1) |
|
|
266 | (1) |
|
|
267 | (2) |
|
|
269 | (1) |
|
|
270 | (1) |
|
|
270 | (1) |
|
Selected Approaches at Legal Frameworks |
|
|
270 | (9) |
|
UNCITRAL Model Law on Electronic Commerce |
|
|
271 | (2) |
|
Approach of the Commission of the European Community (CEC) |
|
|
273 | (2) |
|
|
275 | (1) |
|
Utah Digital Signature Act (1996) |
|
|
276 | (1) |
|
German Digital Signature Act (1997) |
|
|
277 | (1) |
|
Electronic Data Interchange Agreements |
|
|
278 | (1) |
|
|
279 | (1) |
|
The SEMPER Electronic-Commerce Agreement |
|
|
279 | (8) |
|
|
279 | (1) |
|
|
280 | (1) |
|
|
281 | (1) |
|
|
281 | (1) |
|
|
282 | (2) |
|
Blacklists of Players Claiming Compromised Keys and Signatures |
|
|
284 | (2) |
|
|
286 | (1) |
|
|
287 | (16) |
|
|
287 | (5) |
|
|
292 | (2) |
|
|
294 | (9) |
|
|
303 | (2) |
|
Future Directions in Secure Electronic Commerce |
|
|
305 | (20) |
|
|
305 | (2) |
|
|
305 | (1) |
|
|
306 | (1) |
|
|
307 | (1) |
|
|
307 | (8) |
|
|
307 | (1) |
|
|
308 | (1) |
|
|
309 | (1) |
|
|
310 | (2) |
|
Web Tracking, Personalized Accounts, and Directed Marketing |
|
|
312 | (1) |
|
|
312 | (1) |
|
Visualization of Security |
|
|
313 | (2) |
|
|
315 | (5) |
|
|
315 | (2) |
|
|
317 | (3) |
|
|
320 | (5) |
|
|
320 | (1) |
|
Dependable Third-Party Implementations |
|
|
321 | (1) |
|
|
322 | (3) |
References |
|
325 | (10) |
Glossary |
|
335 | (8) |
Index |
|
343 | |