In today's information economy, entities frequently interact with other entities through computer networks. It is important to entities with more than one agent that a given agent interacts with other entities only in ways authorized by the entity. For example, a first entity may only authorize select personnel to interact with a second entity to purchase goods through the Internet. Granting limited authorization to agents helps prevent the first entity from acquiring unwanted legal obligations. At the same time, the second entity wants assurances that the first entity has authorized the agent to interact with the second entity. For example, the second entity wants to be certain that the first entity will not repudiate a legal agreement resulting from the interaction because the first entity did not authorize the agent to make the agreement.
Because of this situation, it may be crucial that entities interacting across a computer network assure one another that agents claiming to operate on behalf of the entity in fact operate on behalf of the entity. However, there are security problems inherent in exchanging such assurances. It can be difficult for one party to trust the assurances made by another party, especially when the assurances could have been made casually, falsely, or under false pretense. For instance, a third party could falsely pose as an authorized agent of a first entity and surreptitiously interact with a second entity, generally disrupting the operations of both entities. Or an agent of a first entity may falsely claim to have privileges that the first entity has not authorized. Or the first entity may casually assign computer-readable privileges to an agent and upon their later misuse, seek to avoid responsibility for their misuse. Or an unauthorized individual, such as a person with criminal intent, may create a situation of false pretense where assurances are made on his or her behalf by the first entity, and any interaction that arises may be dishonored or incur cost to one or both parties.
In another instance, a first entity may disclose a list of authorized agents to a second entity that the second entity may rely upon when authorizing requests for a network resource or resources. However, the first entity may fail to update the list of authorized agents in a timely manner, or the second entity may not possess an efficient means to update its copy of the list of authorized agents securely. Any errors in the copy of the list of authorized agents held by the second entity could lead to unauthorized actions.
In any of these or similar instances, a second entity may doubt assurances received via a public network claiming that a first entity has authorized an agent to perform certain business activities on behalf of the first entity. Compared to traditional face-to-face settings where the agent of the first entity is clothed with apparent authority to conduct business, conducting business over a network may prevent or render untrustworthy the presentation of traditional signals of apparent authority. This problem is not explained precisely as an inability to trust; parties to a traditional agreement such as a business contract commonly demonstrate a willingness to trust each other in limited ways. The problem may be better identified as difficulty in communicating trustworthy assurances regarding an agent's limited authority to act on behalf of a first entity upon the resources provided by a second entity. A system and method that invokes a memorialization of parties' willingness to trust in a limited way, and affirms the true affiliation of the agent, and also provides a secure and accurate means to “clothe” an agent undertaking business activities while communicating over a public network may be used to address the problems described above.
Several current technologies address one or more aspects of the security problem. For instance, an entity may use passwords to verify the identity of a specific agent. In addition, entities may attempt to use cryptography to ensure that unauthorized agents cannot view, alter, or create certain information. Granting possession of cryptographic certificates to agents may help prevent unauthorized agents from pretending to be authorized agents. In addition, attribute certificates or extensible markup language-based security assertions may provide a secure mechanism of supplying authorization information about an agent.