一个新的电子商务的安全方案:HTML表单签名

A New Resolution of Safe E-Commerce:HTML Form Signing

随着计算机和电子通讯技术,包括因特网的迅猛发展,金融电子化的步伐大大加快,许多传统上基于纸面的、常常需要签名盖章的重要凭证,已陆续转化为数字电子媒体的形式出现.目前,许多网站都是通过HTML表单(或称为HTML页面)的形式在Internet上接受用户输入的请求信息,从非常简单的订阅电子杂志的请求到具有高度商业价值的信息,如BtoB、BtoC业务中用户和商家之间传递的商业信息.在交易过程中为双方提供不可伪造的、不可抵赖的签名信息将是非常必要的.虽然SSL技术在SSL连接期间提供暂时的客户身份认证,但它不能为连接期间发生的交易提供持续稳定的认证.一个提供这样认证的方法是把数字签名连同交易产生的数据作为交易的结果信息.

Many kinds of e-commerce require the ability to prove that someone has authorized a transaction. One way to provide such proof is to associate a digital signature with data generated as the result of a transaction. However, until now, there has been no widely available, standards-based way to digitally sign forms or other transaction-related text on the Web. This paper presents an implementation of HTML form signing, which utilizes the Public-Key Cryptosystem and the Digital Signature technology. By providing components of client and server, the system signs the user's form at the client end and verifies it at the server end.