Design and Implementation of RESTful Non-repudiation Services

2005

The use of open, Internet-based communications for business-to-business (B2B) interactions requires accountability for and acknowledgment of the actions of participants. Accountability and acknowledgment can be achieved by the systematic maintenance of an irrefutable audit trail to render the interaction non-repudiable. To safeguard the interests of each party, the mechanisms used to meet this requirement should ensure fairness. That is, misbehaviour should not disadvantage well-behaved parties. Despite the fact that Web services are increasingly used to enable B2B interactions, there is currently no systematic support to deliver such guarantees. This paper introduces a flexible framework to support fair non-repudiable B2B interactions based on a trusted delivery agent. A Web services implementation is presented. The role of the delivery agent can be adapted to different end user capabilities and to meet different application requirements.

Polibits, 2009

Computer Communications, 2002

With the phenomenal growth of the Internet and open networks in general, security services, such as non-repudiation, become crucial to many applications. Non-repudiation services must ensure that when Alice sends some information to Bob over a network, neither Alice nor Bob can deny having participated in a part or the whole of this communication. Therefore a fair non-repudiation protocol has to generate nonrepudiation of origin evidences intended to Bob, and non-repudiation of receipt evidences destined to Alice. In this paper, we clearly de®ne the properties a fair non-repudiation protocol must respect, and give a survey of the most important non-repudiation protocols without and with trusted third party (TTP). For the later ones we discuss the evolution of the TTP's involvement and, between others, describe the most recent protocol using a transparent TTP. We also discuss some ad-hoc problems related to the management of non-repudiation evidences. q

Computer Communications, 2004

Non-repudiation is a security service that provides cryptographic evidence to support the settlement of disputes. In this paper, we introduce the state-of-the-art of non-repudiation protocols for multiple entities. We extend an existing multi-party non-repudiation (MPNR) protocol to allow an originator to send different messages to many recipients in a single transaction. We further propose an optimistic multi-party nonrepudiation protocol for exchange of different messages. The performance of our protocols with enhanced functionalities is still promising in comparison with existing MPNR protocols. q .sg (J. Zhou), onieva@lcc. uma.es (J.A. Onieva), jlm@lcc.uma.es (J. Lopez).

2002

With the phenomenal growth of the Internet and open networks in general, security services, such as non-repudiation, become crucial to many applications. Non-repudiation services must ensure that when Alice sends some information to Bob over a network, neither Alice nor Bob can deny having participated in a part or the whole of this communication. Therefore a non-repudiation protocol has to generate non-repudiation of origin evidences intended to Bob, and non-repudiation of receipt evidences destined to Alice. In this paper, we clearly define the properties a non-repudiation protocol must respect, and give a survey of the most important non-repudiation protocols without and with trusted third party (TTP). For the later ones we discuss the evolution of the TTP’s involvement and, between others, describe the most recent protocol using a transparent TTP. We also discuss some ad-hoc problems related to the management of non-repudiation evidences and briefly overview several efforts on f...

2004

The increasing usage of internet-based services, such as certified e-mails, electronic payment of goods, and non-repudiation require development of security protocols for fair exchange. Non-repudiation is a security service concerned with preventing a denial by one of the principals involved in a communication of having participated in all or part of the communication. This paper discusses the reasoning on security properties of non-repudiation protocols. A case study incorporating the verification of two online nonrepudiation security protocols is presented. The results of the analysis highlight the usefulness of formal verification to increase confidence in the correctness of security protocols.

International Journal of Information Security, 2003

In this paper we introduce the concept of multi-party nonrepudiation protocols. We define the aims of multi-party non-repudiation protocols, compare them to multi-party fair exchange and show some fundamental differences. We present two protocols, the first one using an online trusted third party and the second one using an offline trusted third party. We also show how to modify each of these protocols in order to provide confidentiality. The definitions and the resulting protocols are more general than the only comparable work, a multi-party certified e-mail protocol.

Proceedings of the …, 2006

The participation of an e-notary, acting as an on-line Trusted Third Party is required in some scenarios, such as Business to Business, Intellectual Property Rights contracting, or even as a legal requirement, in contract signing is frequently necessary. This e-notary gives validity to the contract or performs some tasks related to the contract, e.g. contract registration. In the abovementioned contracting scenarios, two important additional features are needed: the negotiation of the e-contract and confidentiality. However, until now, e-contract signing protocols have not considered these issues as an essential part of the protocol. In this paper, we present a new protocol which is designed to make negotiation and contract signing processes secure and confidential. Moreover, compared to other previous proposals based on an on-line Trusted Third Party, this protocol reduces the e-notary's workload. Finally, we describe how the protocol is being used to achieve agreements on the rights of copyrighted works.

1999

Abstract ABECOS is an agent-based e-commerce system under development at the Nanyang Technological University. A key factor in making this system usable in practice is strict security control. One aspect of security is the provision of non-repudiation services. As protocols for non-repudiation have focused on message non-repudiation, its adaptation to afford non-repudiation in a communication session for two agents in ABECOS is inefficient.

Security and Privacy in the Age of Uncertainty, 2003

Non-repudiation is a security service that provides cryptographic evidence to support the settlement of disputes. In this paper, we introduce the state-of-the-art of multi-party non-repudiation protocols, and analyze the previous work where one originator is able to send the same message to many recipients. We propose a new multi-party non-repudiation protocol for sending different messages to many recipients. We also discuss the improvements achieved with respect to the multiple instances of a two-party non-repudiation protocol, and present some applications that would benefit from them.