The Formulation of Policies for Electronic Commerce and Their Enforcement

目前对电子商务的研究集中在安全和高效的支付机制的手段上，主要由密码技术支持。这样的机制对于电子商务来说确实是必要的，但它们还不够。商业活动并不局限于客户和供应商之间简单的资金和商品交换。它们通常由多步骤交易组成，有时涉及几个参与者，需要根据某一政策进行。此类政策可能涉及不适用于纯粹加密处理的问题，例如：防止证书被复制；确保信用卡仅用于指定的交易；保证在特定情况下可退还服务付款；保护客户的隐私和匿名性；提供一定程度的容错；以及建立访问控制。该项目提出了一种通用机制，可用于以统一、可扩展和易于部署的方式制定和执行广泛的电子商务政策。该策略应明确说明，并由一组分布式的可信通用控制器执行。这一机制的基础是“法律管辖的互动”的概念，这是在目前的国家科学基金会拨款下发展起来的。

Current research on electronic commerce focuses on means for secure and efficient mechanisms for payments, largely supported by cryptographic techniques. Such mechanisms are indeed necessary for e-commerce, but they are not sufficient. Commercial activities are not limited to simple exchange of funds and merchandise between a client and a vendor. They often consist of multi-step transactions, sometimes involving several participants, that need to be carried out in accordance to a certain policy. Such policies may be concerned with issues that do not lend themselves to purely cryptographic treatment, such as: preventing certificates from being duplicated; ensuring that credit card are used only for the specified transactions; guaranteeing that a payment for services is refundable under specified circumstances; securing the privacy and anonymity of clients; providing a degree of fault tolerance; and establishing access control. This project proposes a general mechanism that can be used to formulate and enforce a wide range of such policies for electronic commerce, in a unified, scalable, and easily deployable manner. The policy is to be stated explicitly, and be enforced by a distributed set of trusted generic controllers. This mechanism is based on the concept of ``Law-Governed interaction,'' developed under a current NSF grant.