Secure transactions
Secure transactions
The world of e-commerce is advancing at a pace. We are slowly gaining confidence in carrying out financial transactions over the Internet. A recent poll revealed that more than one quarter of Internet users now bank online, for example. That said, in order to meet Tony Blair's target of making the UK the best place in the world for e-commerce, more work must be done to build this trust.
No one can dispute that authentication of the individual is at the centre of this trust-building challenge. As electronic business becomes more and more a part of everyday life for both individuals and businesses, so the need grows for a means of identifying people and authenticating transactions. Users of electronic services need to be sure that their transactions cannot be forged,altered or intercepted. They also need to be able to enter into binding commitments and they need to be confident that their personal privacy is respected. Digital signatures and public key infrastructures are essential contributors to the solution.
Digital signatures
Where would business, the law and so many other facets of a complex society be without signatures? The signature is a means of demonstrating commitment,understanding, authority and a host of other values. Digital signatures extend this concept into the electronic world. The Electronic Communications Act 2000 made the digital signature admissible in law. Just as signing your name on the dotted line seals an agreement, attaching your digital signature as certificate to an electronic communication will do the same.
Using mathematical and cryptographic techniques, software can use digital signatures to authenticate users, provide confidentiality and integrity of messages, and support non-repudiation. Digital signatures can be combined with digital certificates to establish a hierarchy of trust via third parties. This helps parties involved in electronic transactions to trust each other, even though they may never have met.
How does a user know which third parties to trust? One way is to look for independent assurance that the certificate issuer meets rigorous quality standards. Government has been working closely with industry to set up an organisation that does just that. Users can look for "scheme" approval of trust services as an indicator of quality.
Authentication
The need for strong authentication stretches across all sectors. Whilst it is essential to the financial services industry, e-procurement,business-to-business transactions, on-line shopping and much more, it is also a prerequisite for truly citizen-focused electronic government. Of the 500 plus government services identified for electronic delivery, we estimate that 20 per cent of these will require some form of strong authentication.
Development
In order to develop a comprehensive policy framework around digital signatures, Government has established two working groups. A major area of investigation will be into the fact that the market for trust services has not advanced as well as one might have hoped or expected. These working groups will examine barriers to digital signature usage and ascertain what role, if any,government can play in galvanising the market and driving take-up.
The two working groups will concentrate on the use of digital signatures by individuals and businesses respectively. For the individual, a careful balance must be struck between maximising the security benefits of digital certificates and protecting personal privacy. In order to combat the danger of a widening digital divide, the technology and processes must be easy to use and affordable. For businesses, there are issues of cost, liability and choice of applications.
In many cases, there will be a need for this seal of trust and security to be portable – a facility offered by smart cards. There are a number of different public and private sector smart card schemes being developed for UK citizens. It is an open question as to whether these schemes need to move forward in tandem to ensure that maximum benefit is gained from them all. A third working group will direct policy development in this growing area, looking closely at issues of privacy, trust and consumer choice as well as technological standards.
Consultation documents will be published at the end of this year. Whether Government becomes involved in setting standards for trust services or whether the groups conclude that the market is in fact moving along independently,albeit slowly, the emphasis is upon facilitating wide discussion and gaining input from the broadest possible spectrum. The establishment of trust is paramount and in a new age where information exchange is instant and unrestricted by geography, digital signatures will provide an excellent mechanism for gaining and giving that trust.
