Regulating e-commerce through certified contracts

Access control has traditionally assumed a single, monolithic authorization policy, generally expressed as an access matrix. We argue that this assumption does not fit e-commerce applications, which are governed by a potentially large set of independently stated, evolving contracts. In order to support this growing class of applications we propose an enforcement mechanism which uses certified-contracts as authorization policies. A certified-contract is obtained: (a) by expressing contract terms in a formal, interpretable language, and (b) by having it digitally signed by a trusted principal. We show that this approach would make dissemination, revision, and annulment of contracts more manageable and more efficient. We propose a language for stating contract terms, and present several formal examples of certified contracts. We describe the implementation of the enforcement mechanism, which can be used as an extension to a Web server or as a separate server with interface to application. The proposed model does not require any modification of the current certificate infrastructure, and only minor modifications to servers.