Be able to process information coming from different sources of client interaction, i.e.: , web, sms, fax,

Transcription

1 Secure Intelligent Broker for m-commerce 1. Diego Ponce, Miguel Soriano Abstract-- The great acceptance of mobile telephony in the world market represents an excellent opportunity for electronic commerce. Characteristics of mobile devices with capabilities of WAP (Wireless Application Protocol) and intrinsic properties of wireless environments impose a set of constraints for mobile commerce development presented in this article. At the same time an intelligent broker between mobile clients and servers on Internet is proposed to profit standards and existing technologies to fulfill client needs, manage and personalize client information. Index terms-- WAP, m-commerce, intelligent broker, end to end security I. INTRODUCTION Management in new economy enterprise is built in the network, internally and the relationship with providers and the market. The concept known in the 80's as "new technologies" has originated a "new economy". At the end of 90's, the "e-business" concept appears as a way to understand enterprise adaptation to the digital world. Electronic Commerce could be defined, in a general sense, as any kind of financial transaction or commercial information interchange based on data transmission over communication networks. Economy Analysts point the success of e-commerce proportional to the value added to the supply chain of the product. The use of new technologies eases the provider to offer service after-sales and obtain a useful feedback to trace the product with information from client. Currently there are different technological alternatives for mercantile processes in important aspects as advertising, market investigation, negotiation, payment mechanisms, post-sales service, Massive implementation success, however, must still overcome cultural barriers, improve usability and guarantee user confidence. One of the novelties of e-commerce is the possibility to attract client in the neighborhood of commercial centers and/or service centers by providing them with appropriate information. This paper presents first a series of aspects to keep in mind at the moment of design of an m-commerce scheme. Section 3 proposes the use of a broker based on artificial intelligence mechanisms, the following section show characteristics and constraints of the proposed model. Finally, conclusions of the work are enumerated. II. M-COMMERCE Mobile Commerce involves three basic aspects; business and service delivery in the client neighborhood, timely and geo-referenced information while the user is moving, possibility to complete a transaction immediately. User should have the following facilities: negotiation and immediate delivery, fast methods of micro and macro payment, and usability in the mobile environment [6]. There are, however, a series of factors that difficult the implementation and development of m-commerce related to e-commerce. Those drawbacks are related with the characteristics of wireless environment (normally less bandwidth, lower latency, less stability of connections, less predictable availability) and constraints in the mobile devices (less powerful CPU, less memory, limitations on power consumption, form factor of displays, ). Figure 1 shows typical WAP environment, usually the mobile device connects to Internet through a gateway (WAP proxy) that translates between protocols of Internet and WAP. Department of Telematics Engineering, Polytechnic University of Catalonia. Jordi Girona 1-3. Campus Nord, Mod. C3, UPC Barcelona - Spain. {dponce, soriano}@mat.upc.es. 1 This work has been developed as part of the project ACIMUT CICYT TIC C Figure 1 Typical WAP Environment. In the frame of e-commerce, there exist interesting proposals that integrate emerging technologies in an infrastructure

2 that redefines the way of making business and get access to information on line. The goal is to implement a new infrastructure conceptually better than the Web, kwon as "The Grid" [10]. Mobile market could be used as an extension of B2B (business to business model) for corporation mobile environments. The end client situation is of the B2C (business to Consumer model), free unlimited access to contents in Internet. A way to communicate platforms of B2B with B2C could be using brokers to manage and ease information search and retrieval for the user. Negotiation will require data security. In e-commerce negotiation alternatives and models are of vital importance for the user. User chooses among a set of them according to his own personal and enterprise needs. The security standards at transport and IP level such as TLS (Transport Layer Security) [4] and IP-Sec [24] on Internet, and WTLS (wireless TLS), WIM (Wireless Identity Model), WVPN (Wireless Virtual private network), and bearer ciphering algorithms are also widely deployed [1]. Figure 2 shows Internet and WAP protocol stacks and placement of security layers. and integrity of data at WAP gateway the following is required: 1. Never store data in clear on secondary memory. 2. Use fast cipher and decipher with erasure of contents in clear in volatile internal memory immediately after transaction has been done. 3. Make physically secure the access to the console of WAP gateway to authorized administrator personnel only. 4. Apply all security mechanisms to protect invoice systems and location record at WAP gateway. However, security in WAP environments still present the following weaknesses [5]: It does not provide end to end authentication between Internet Server and Mobile User. Contents of messages are in the clear in the WAP gateway. In [20] an alternative to WAP security architecture is presented to solve the mentioned problems. Security on TCP/IP at the IP layer level is denominated IP- Sec. It allows the implementation of virtual private networks inside Internet. Analogous in WAP is the WVPN wireless virtual private network. III. BROKER Figure 2 Internet and WAP Protocol Stacks. In m-commerce environment both the provider and the client get connected through software entities. Authentication, integrity and confidence relationships must be established [7]. Authentication of messages is reached when the user signs a message with his private key and the receiver deciphers it with the public key, in order to guarantee the authenticity of the keys, PKI (public key infrastructure) is needed. Certification Authorities extend a digital certificate authenticating each party and the message they interchange. Unfortunately, there are not a worldwide public key infrastructure implemented yet and that is the reason why merchants have adopted other solutions. Figure 1 represents the security model in WAP environment. It could be observed that secure channels between client and WAP gateway are supported by WTLS, while the channel between WAP gateway and Internet server is supported by TLS. Translation between WTLS and TLS is executed at the WAP gateway. In order to guarantee privacy An important constraint in WAP environment is the narrow bandwidth available. Reports made by important analysts like Nielsen Group, Jupiter Media Matrix and Yankee Group point the need to provide content by different means like SMS, and WML pages. Rich and fast data delivery is also indispensable [25]. In order to speed up the content delivery with the existing constraints a broker with intelligent mechanisms is proposed. Figure 3 shows a general scheme of the broker that manages the data content interchange between client and server. A search mechanism, intermediate storage, customer relationship management and a user certificate repository are integrated and protected by mean of a security layer.

3 Figure 3 Broker General Scheme Information search is performed using intelligent agent technology. Multi agent systems allow a cooperative behavior between agents for the search and retrieve of information on Internet. Specialized agents search retrieve and classify clusters of information. Information obtained in the search process could be profited by other mobile users so the need of intermediate storage. Successful distributed data bases and proxy and cache mechanisms that consider special characteristics of mobile users (low latency, noise, unpredictable availability, disconnection) are proposed. WAP Push and Pull delivery mechanisms allow two different strategies for information content delivery. Push mechanism allows automated delivery without explicit request. The customer relationship management makes it possible to obtain a personalized user profile that could be profited to filter and delivery content of interest for a specific user. Figure 4 shows the flowchart of a Push content delivery transaction. Pull mechanism based on user request of information could profit intermediate storage and agent assisted search of contents to ease and speed up content delivery. Figure 5 shows the flow diagram for a pull request from WAP user. Figure 4 Push Information Delivery Security is an important concern and its strategy should involve: the network, operating system, database protection, code interchange and data transmission. Administrator personnel access measures must be similar to WAP gateway. Fast delivery of information is also a concern. The wireless channel between the mobile user and the WAP gateway constitutes the bandwidth "bottleneck" for the data transmission. Typical bandwidth over GSM is about 9600 b/s. The broker should be located near this bottleneck at the Internet side to buffer, cache and proxy the traffic to the wireless terminals with a distributed scheme similar to [12].

4 Be able to process information coming from different sources of client interaction, i.e.: , web, sms, fax,. Figure 5 Pull Information Delivery The customer relationship management CRM technology, is very often related to sales force automation. Automated management of user information could make automated service personalization feasible. User profile could be managed and updated dynamically, processing information from different sources. CRM technology for wireless environments improves usability and extends capacity of mobile terminals. Content delivery could be done in a predictive fashion profiting facilities of Push mechanism of WAP. Delivery of contents could be done using SMS, e- mail or WML/Script. Push mechanism implies less occupation of the wireless channel compared to Pull requests (round trip). CRM strategy of implementation in the Broker requires three steps: startup, growth and establishment of the system. Minimum parameter recommendations are: Manage transactions from the Company Web Service. Provide a centralized repository of information of clients. Have enough intelligence and analysis capacity available to capture and convert client data to useful information. Integrate in the workflow all the information and make it available on each step of the process. Work with their own and different operating systems/applications (Portable). Push delivery of information requires generation of distribution lists. Distribution lists are generated using user profile information. Up to date content in Broker storage system must be filtered and delivered to users on each list by means of a batch process. A Client could be user of different lists. Intelligent multi agent systems based on object oriented code also require special attention to the security of its code to guarantee availability and correct operation. Tasks like: search, advice, contact, compare, filter, facilitate access to data bases are ideal for agent technology deployment. Multiuser environment should also use expert systems in order to manage personalization and content delivery. Agent technology requires from environment the following: accessibility, determinism, predictable static or dynamic environments, and rules of access. Unfortunately Internet is not friendly enough for intelligent agents [23]. Once the broker has connected the mobile terminal with the Internet server, a secure channel can be necessary for negotiation and payment. Broker stops its intervention and an end to end secure tunnel is established. The "wireless extensions for TLS" proposal of IETF [21] could offer a suitable mechanism to provide end to end security, another alternative is [20]. Public key infrastructure is needed to provide authentication and privacy. Broker is suitable to store digital certificates in a repository. Combined with OCSP (On line Certificate Status Protocol) fast information about the status of certificates could be obtained. Hiding complexity for the user need intelligent mechanisms that ease the use and provide additional information like: geographic proximity to a service center, delivery of information organized by zone. Processing information to be presented to the mobile terminal, user profile and personalized relationship management, and anticipated delivery of contents. Knowing user profile we are able to manage user needs of information, delivery information in a predictive fashion and dynamic tracking of clusters of information. IV. CONCLUSIONS Security, fast delivery of data content and customer relationship management are key elements for WAP success in wireless telephony environment.

5 Intrinsic characteristic and constraints of wireless environments make suitable the use of broker extending capacity of wireless terminals and improve delivery of information. Usability is also an important issue so the need to assist the user, ease the use and make it comfortable for the user in crowd, noisy, mobile environment. Secure end to end channel for electronic commerce transactions between mobile terminal and Internet server are also desirable. However, security must cover also the different mechanisms involved and protect the user data and code of the broker itself. Portability and connectivity among different platforms in a distributed scenario is very important. Object technology, Java and CORBA. Distributed data base design tuned for mobile users and scalability are needed. Integration between WWW and WAP reuse of application components and flexibility are also needed. V. REFERENCES [1] WapForum, Wap 1.2 Specification, (Jun. 2000), http.// [2] M. Rader, U. Riehm, Payments by mobile phone more convinient than e-wallets?, ITAS, Karlruhe, Germany. [3] J.H. Saltzer, D.P. Reed, D.D. Clark, End to end Arguments in System Design, ACM Transactions in Computer Systems 2.4, (Nov. 1984), pp , [4] T.Dierks, C..Allen, The TLS Protocol version 1.0, (Jan. 1999), Internet Standard RFC [5] R. Khare, W* Effect Considered Harmful, IEEE Internet Computing, (Jul.-Aug. 1999), [6] A. Fasbender, F. Reichert, Any Network, Any Terminal, Anywhere, IEEE Personal Communications. (Apr. 1999), pp [7] D. Van Thanh, Security issues in Mobile e-commerce, IEEE, ISBN , (Aug. 2000). [8] S. Halevi, H. Krawczyk, Public-Key Cryptography and Password Protocols, ACM Transactions on Information and System Security, Vol 2, No 3, (Aug. 1999), pp [9] Durlacher Research Ltd., Mobile Commerce Report, [10] K. Westhead, et al. New Economy, Forget the Web make way for the grid. Deustche bank, (Jun. 2000). [11] Y. Malhotra, Knowledge Management for e-business performance: Advancing Information Strategy to "Internet Time", CRC Press, (2000). [12] T. Sau Loon, V. Barghavan, Alleviating the latency and bandwidth problems in WWW Browsing, (Dec. 1997), [13] B. Pfitzmann, M. Waidner, Properties of Payment Systems: General Definition Sketch and Classification, IBM Research Division, (May. 1996). [14] Sun microsystems, The Java 2 Platform Micro Edition J2ME for Linux, (Jan. 2001), [15] Qualcomm, Binary Run-time Environment for Wireless BREW, (Feb. 2001) [16] R. H. Guttman, et al., Agent Mediated Electronic Commerce: A Survey, Software Agents Group MIT Media Laboratory, [17] B. Venners, Under the hood: The architecture of aglets, Javaworld, (Apr. 1997), hood.html. [18] M. B. Blake, KOJAC: Implementing KQML with Jini to Support Agent-Based Communication in Emarkets, American Association for Artificial Intelligence. (2000). [19] M. Cannataro, D. Pascuzzi, An Object-Based Architecture for WAP-Compliant Applications, IEEE, ISBN , (Aug. 2000). [20] D. Ponce, M. Soriano, P. Mur, A proposal for B2C Electronic Commerce Scheme based on WAP, World Multiconference on Systemics, Cybernetics and Informatics, SCI (Jul 2000). [21] M. Raynal, M. Singhal, Logical Time:Capturing Causality in Distributed Systems, IEEE Computer Magazine, (Feb 1996), pp [22] Phone.com, Understanding Security on the Wireless Internet. (Jan. 2000). [23] M. Wooldridge, N. R. Jennings. Pitfalls of Agent- Oriented Development. University of London. [24] S. Kent, R. Atkinson, Security Architecture for the Internet Protocol. Request for Comments (Nov. 1998). [25] Nielsen Norman Group, WAP Usability Report: Field Study Fall (Dec. 2000). [26] S. Blake, Magnus Nystrom, Wireless Extensions to TLS, draft-ietf-tls-wireless-00.txt, (Nov. 2000).