WebALPS: a survey of E-commerce privacy and security applications

ABSTRACT

Web-based commerce is rife with scenarios where a party needs to trust properties of computation and data storage occurring at a remote machine, operated by a different party with different interests. In our WebALPS project, we have used off-the-shelf hardware and open source software to build trusted co-servers co-resident with Web servers, and bring the secure SSL channel all the way into these trusted co-servers. In this paper, we survey how this tool can be used to systematically address privacy and security issues in e-commerce.

REFERENCES

• 1: W. A. Arbaugh , D. J. Farber , J. M. Smith, A secure and reliable bootstrap architecture, Proceedings of the 1997 IEEE Symposium on Security and Privacy, p.65, May 04-07, 1997
• 2: Freier, A. O., Karlton, P., and Kocher, P. C. 1996. The ssl protocol version 3.0. http://home.netscape.com/eng/ssl3/draft302.txt.
• 3: IBM. 2000. Ibm 4758 models 2 and 23 pci cryptographic coprocessor. Product Brochure G221-9091-02. http://www.ibm.com/security/cryptocards/.
• 4: Shan Jiang, WebALPS Implementation and Performance Analysis: Using Trusted Co-servers to Enhance Privacy and Security of Web Interactions, Dartmouth College, Hanover, NH, 2001
• 5: S. Jiang , S. Smith , K. Minami, Securing Web Servers against Insider Attack, Proceedings of the 17th Annual Computer Security Applications Conference, p.265, December 10-14, 2001
• 6: Knop, E. 2001. Secure public-key services for web-based mail. Senior thesis, Department of Computer Science, Dartmouth College.
• 7: NIST. 1994. Security requirements for cryptographic modules. Federal Information Processing Standards Publication 140-1.
• 8: Smith, S. 2001. Outbound authentication for programmable secure coprocessors. Technical Report TR2001-401 (March), Department of Computer Science, Dartmouth College. http://www.cs.dartmouth.edu/~pkilab/oatr.pdf.
• 9: Smith, S., Perez, R., Weingart, S., and Austel, V. 1999. Validating a high-performance, programmable secure coprocessor. In 22nd National Information Systems Security Conference (October 1999). National Institute of Standards and Technology.
• 10: S. W. Smith , D. Safford, Practical server privacy with secure coprocessors, IBM Systems Journal, v.40 n.3, p.683-695, March 2001
• 11: Sean W. Smith , Steve Weingart, Building a high-performance, programmable secure coprocessor, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.31 n.9, p.831-860, April 23, 1999
• 12: Yee, B. 1994. Using Secure Coprocessors. Ph. D. thesis, School of Computer Science, Carnegie Mellon University. (Available as Technical Report CMU-CS-94-149.).
• 13: Yuan, Y., Ye, E., and Smith, S. 2001. Web spoofing 2001. Technical Report TR2001-409 (July), Department of Computer Science, Dartmouth College. http://www.cs.dartmouth.edu/~pkilab/demos/spoofing/.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce
          Subjects: Security

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.5 Local and Wide-Area Networks
          Subjects: Internet (e.g., TCP/IP)

  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.1 Requirements/Specifications

          Nouns: SSL

  H. Information Systems
  H.3 INFORMATION STORAGE AND RETRIEVAL
      H.3.1 Content Analysis and Indexing
          Subjects: Indexing methods
      H.3.5 On-line Information Services
          Subjects: Web-based services

General Terms:
Design, Languages, Management, Reliability, Standardization