Abstract
Security issues related to the usage of mobile agents in performing operations to which their owners have to be bound, such as payments, are of utmost importance if this kind of agents are to be used in electronic commerce. If this binding is achieved by means of digital signature techniques, this means agents have to carry the owner’s private key to the host where they sign documents. This exposes the key to attacks because it is copied outside a protected environment. In this paper, we present a mechanism, called proxy certificates, that avoids the need for the agent to have access to the user’s private key for digitally signing documents, but still binds the owner to the contents of those documents. In order to support our claims, we apply the mechanism to SET/A, an agent-based payment system we proposed in previous work. We also analyze the emerging technology of attribute certificates and argue that it is appropriate to implement proxy certificates.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
American National Standards Institute. ANSI X9.57: Public-Key Cryptog-raphy for the Financial Services Industry: Certificate Management, 1997.
C. Ellison, B. Frantz, B. Lampson, R. Rivest, B. Thomas, and T. Ylonen. SPKI Certi-cate Theory. Internet Request for Comments 2693, September 1999.
European Computer Manufacturers Association. Authentication and Privilege Attribute Security Application with Related Key Distribution Functions, March 1996. Standard ECMA-219, 2nd Edition.
W. Ford and M. Baum. Secure Electronic Commerce. Prentice Hall, New Jersey, USA, 1997.
S. Haber and W. S. Stornetta. How to Time-Stamp a Digital Document. Journal of Cryptology, 3(2), 1991.
F. Hohl. Time Limited Blackbox Security: Protecting Mobile Agents from Malicious Hosts. In G. Vigna, editor, Mobile Agents and Security. Springer-Verlag, November 1997.
International Telecommunications Union. ITU-T Recommendation X.509: Information Technology—Open Systems Interconnection—The Directory: Authentication Framework, June 1997.
S. Laing. Attribute Certificates—A New Initiative in PKI Technology. White Paper, Baltimore Technologies, Inc., Dublin, Ireland, 1999.
M. Myers, R. Ankney, A. Malpani, S. Galperin, and C. Adams. X.509 Internet Public Key Infrastructure Online Certi-cate Status Protocol-OCSP. Internet Request for Comments 2560, June 1999.
R. Rivest and B. Lampson. A Simple Distributed Security Infrastructure. http://theory.lcs.mit.edu/cis/sdsi.html.
A. Romão and M. Mira da silva. An Agent-Based Secure Internet Payment System for Mobile Computing. In Proceedings of the International Conference on “Trends in Distributed Systems for Electronic Commerce,” Hamburg, Germany, June 1998. Springer LNCS 1402.
A. Romão, M. Mira da silva, and A. Silva. Secure Payments with Mobile Agents. To appear in Journal of Distributed and Parallel Databases, 8(4), Kluwer Academic Publishers, October 2000.
T. Sander and C. Tschudin. Protecting Mobile Agents Against Malicious Hosts. In G. Vigna, editor, Mobile Agents and Security. Springer-Verlag, November 1997.
Set Secure Electronic Transactions, LLC. Approved Extensions. http://www.setco.org/extensions.html.
Surety Technologies, Inc. Digital Notary Service. http://www.surety.com/dns.html.
Veri Sign, Inc. Secure Wireless E-Commerce with PKI from VeriSign. White Paper, January 2000. http://www.verisign.com/.
Visa International and Mastercard International. Secure Electronic Transaction (SET) Specification, May 1997. Version 1.0.
M. Wahl, T. Howes, and S. Kille. Lightweight Directory Access Protocol (v3). Internet Request for Comments 2251, December 1997.
The Wap Forum. Wireless Transport Layer Security (WTLS) Specification. November 1999. http://www.wapforum.org/what/technical.htm
U. Wilhelm and X. Defago. Objets Prot-eg-es Cryptographiquement. In Proceedings of RenPar’9, Lausanne, Switzerland, May 1997.
B. Yee. A Sanctuary for Mobile Agents. In Proceedings of the DARPA Workshop on Foundations for Secure Mobile Code, Monterey, USA, March 1997.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2001 Springer-Verlag Berlin Heidelberg
About this chapter
Cite this chapter
Romão, A., da Silva, M.M. (2001). Secure Mobile Agent Digital Signatures with Proxy Certificates. In: Liu, J., Ye, Y. (eds) E-Commerce Agents. Lecture Notes in Computer Science, vol 2033. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-45370-9_13
Download citation
DOI: https://doi.org/10.1007/3-540-45370-9_13
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-41934-1
Online ISBN: 978-3-540-45370-3
eBook Packages: Springer Book Archive