A NOVEL FRAMEWORK FOR BUSINESS TO CONSUMER E- COMMERCE

Transcription

1 A NOVEL FRAMEWORK FOR BUSINESS TO CONSUMER E- COMMERCE M Y SIYAL School of EEE, Information Engineering Division Nanyang Technological University SINGAPORE Abstract: - In recent years an upsurge in the business-to-business electronic commerce has been observed. The popularity of electronic commerce among the masses is still not what it was expected and the fall of DOT.COMs has made it even worst. Whereas business-to-business electronic commerce has found the Internet as a new medium to deploy age old EDI based trading mechanism and thus getting a new boost, while business-to-consumer electronic commerce is finding it hard to gather the customer's confidence in trading over the Internet. Many people are reluctant to adopt the new way of doing business mostly because of distrust on the products and services advertised by many vendors and as a whole on the Internet itself. While the distrust on the Internet is abating thanks to improved cryptographic techniques, the former reason of distrust is still there. In this paper we present a framework to improve customer's trust on the products and services provided over the Internet. Our solution also takes into consideration smaller merchants who want to enter the huge Internet marketplace by providing them a venue for competing with the bigger organizations something that they cannot do in the traditional markets. Key-Words: - E-commerce, E-Trust, Third Party, E-Security, and Framework. 1 Introduction In a recent report [1], Gartner Group has reported that by end of year 2002 business users will account for 63 percent of all the people logging on to the Internet. This is contrary to the previous predictions about the Internet as being a billion dollar plus consumer electronic marketplace. The clearing picture shows that business-to-business (B2B) electronic commerce (EC) is leading business-to-consumer (B2C) EC in terms of transaction volume [12]. Many reasons have been attributed to this outcome. The first reason is the expertise and infrastructure available to the companies to do business on the Internet. This infrastructure is based on the heavily used and tested Electronic Data Interchange (EDI) standard that is in use for more than two decades [2,11,12]. Traditionally EDI requires a Value Added Network (VAN) that adds a lot of cost (subscription or maintenance) to the transactions. A VAN is a dedicated network between trading companies and adds various special functions, such as mailboxing, digitally signed , conversion to and from the company's document format to EDI format. Companies are finding Internet as an alternative to VAN by putting these functions on the Internet. This has resulted in a dramatic cut in costs. Aside from these technological advantages gained by the B2B EC, B2C EC suffers from some disadvantages not found in B2B EC. In B2B EC, a prior business relationship between the trading parties already exists so the trust problem is not serious. However, in B2C EC, no prior relationship between the customer and the vendor exists. So, buying goods or information over the web corresponds, security and liability wise, to buying merchandise from a street vendor. Other concerns are personal privacy, risk of being cheated by the vendor, lack of information or distrust on vendor given information about the product. This research, therefore, focuses mainly on a framework whose foundations are laid on the notion of providing essential trust services for the Internet Commerce. We aim to provide a framework, which integrates well with the existing, and tested services present on the Internet and automate as much of the trust aspect of the business transactions. The bottom line is that entities will have the means to assess the value and risk involved, in a reliable way (e.g. customer is assured that what you see is what you get!). This paper is organized as follows: Section 2 presents our proposed framework for enhancing trust in general EC, Section 3 highlights its business, legal, and technical aspects, Section 4 gives an analysis of the framework and compares it

2 with other trust enhancing solutions, and Section 5 ends the paper by giving the conclusion and future work. 2 The Proposed Framework There are many mechanisms available on the Internet that can be thought of providing some level of trust. Certification authorities and Endorsement agencies are well established and provide a necessary support to, for example, public key infrastructures. These agencies are then used by other mechanism such as payment protocols to facilitate payment over the Internet. Moreover, a large number of online catalogs and their associated searching mechanism along with brokerage and negotiations services are also in use of general public. However, there exists no such entity that can provide security, trust, and accountability services in all. The available services are also unable to talk to each other thereby limiting the range of services they provide. Our framework proposes the idea of a Trust Service Provider (TSp), which is a more advanced form of A Third Part, Trusted Intermediary. Trusted Intermediaries have been found very successful in business transactions where transacting parties have no prior relationship. For instance, the use of trusted intermediaries has been very successful in information commerce where information is bought over the Internet [4]. In future E-Commerce architectures, we envision a network of TSps, which will provide not only trust services, but also search and negotiating services. Each TSp is supposed to provide a set of necessary or Core services. In addition to this, a TSp may also provide search, negotiation, brokerage, payment, and logistics services either by implementing itself or by out sourcing from other service providers. We call these services collectively as Peripheral services. In providing the notion of a trust service provider, we have emphasized on the simplicity, implementability, and maintainability of the framework. The necessary services have been identified by closely observing the needs of the today's retail customers. Moreover, on the technical side, reuse and interoperability issues have also been taken care of in the framework. As reported in [1], future EC markets and service providers will collaborate more closely. Collaboration or association is, thus, an important part of our proposed framework. Figure 1 illustrates the concept of a TSp Trust Services As mentioned above, a TSp can provide two types of services; the core services and the peripheral services. We identify three core services; Quality evaluation, Contract enforcement and a policy package, and Collaboration among TSps. The peripheral services are the one needed by the customer but not necessarily requiring trust. These are cataloging, brokering, negotiation, payment, and logistics services Core Services Each TSp has to provide following essential services: (i) Quality evaluation. (ii) Contract enforcement and a policy package. (iii) Ability to collaborate with other TSps. By providing the quality evaluation service, a TSp provides a measure of either the quality of the product the customer intends to buy or that of merchant. In the case of the products, they may be tangible or intangible. Tangible products require physical examination whereas intangible goods can be evaluated on the basis of some publicly available ratings or endorsements of some accepted authority. For example, software can be evaluated on the basis of the feedback provided by the current users or the rating of some popular magazine. A TSp specializing in tangible goods may have to define special procedures for examining different goods. This involves more work on part of a TSp. Quality evaluation of a merchant is actually the evaluation of the quality of the products the merchant provides as well as that of the services. Nowadays many merchants and companies carry ISO 9000 quality certification. In these cases, providing quality evaluation becomes trivial for the TSp. The policy package is an ensemble of various policies depending on the type of customers the TSp is serving. At the very basic it should provide clear cut policies for the enforcement of contracts; i.e. what measures are taken when the product is not as advertised, or what liability or indemnity is placed on a transacting party when it backs out of the contract. Moreover, it also insures the transacting party against any possible damages. All in all we see enforcement of contracts as one of the most difficult aspect of Internet Commerce. Additional policies can be provided for tax collection, customs, and privacy. The last one is important because anonymity is not always desirable [5] especially in the case when transaction involves a lot of money or the parties are across political boundaries. Again we can see that a single TSp may not provide all types

3 of policies. For example, policies dealing with customs can only be offered by specialized TSps called gateway TSp because it operates across international boundaries. The last core service is the ability of a TSp to associate or collaborate with other TSps to extend the range of services and/or products. Since we assume that a TSp cannot cover all types of products or policies, the TSps can ask others for providing such policies. In this way we can envision a TSp web where a chain of TSp exist along the path from customer to merchant Peripheral Services These are the services that a TSp may additionally provide besides the core services. Examples of these services are: 1. Search and Catalog services. 2. Brokerage services 3. Negotiation services 4. Payment services 5. Logistic services, etc These services are not entirely independent of the core services, for example, the output of the negotiation service may be required by the second core service, i.e. policing and enforcement of contracts. The interaction and integration of peripheral services is a major future work of this research. 3. Implementation Aspects In this section we show some of the implementation aspects involved in realizing the proposed framework. We give more attention to the core services as they represent the core of the framework. We treat the first two services briefly as they contribute to the future work. The details of realizing the third service are also partial because some of its aspects are dependent on how the rest of the services are implemented Quality Evaluation For quality evaluation, we have already suggested the use of customer feedback lists or the use of ISO 9000 certification that a merchant carries. Note that the quality evaluation is for the merchants or the products only, a customer does not need to be evaluated. Once the payment from the customer is verified and acknowledgement of the product delivery is received, no other verification is required Contract Enforcement And Policy Package Before a TSp can get any acceptance from the customers, it should take care of various aspects. Without these the trustworthiness of TSp cannot be established. We mention a few of the business and legal aspects Liability Liability is the ability and willingness (and under certain circumstances, the obligation) of a Service Provider to cover financial losses suffered by its users as a result of its failure to deliver service in accordance with an agreed service definition. It is an important element, which identifies and limits the potential risk associated with doing transaction over Internet. Liability is clearly linked with the financial standing of the Trust Service Provider s organization. A subscriber of a TSp service has to be sure that the TSp is able to cover the financial obligations associated with his liability conditions. To provide these liability conditions, TSp has to provide following (not mutually exclusive) solutions. (i) Insurance Whenever a TSp is either not able or is not willing to take the complete risk associated with the liability conditions in relation to his customers, he can take out insurance [6]. With this he can transfer the risk to the insurance company and can provide the customer with the confidence that financial losses will be covered (to the extent that they are defined in the contract or relevant regulation, etc.) if the TSp fails to provide the service as defined in the service agreement with the customer. (ii) Financial Standing This element is defined as the ability of a TSp to manage any failure in their operations and to cover liability cases using their own financial resources. The financial resources of the TSp from which liability cases can be covered are therefore another important aspect These financial resources will also be used in those cases that are not or can not be covered by insurance, e.g. in cases of deliberate misuse of the service or customer data by the TSp or one of its employees [6]. A good financial standing will on the one side provide the customer with a high level of confidence that the TSp will cover his liability and on the other side give some confidence that the TSp himself will set up appropriate security controls to prohibit such deliberate misuse because of the high financial loss he may have to face.

4 Policy Package We can define Policy as the set of rules and practices that regulate how the trust service, including its security provisions, is managed and how the trustworthiness of the TSp is assessed. Three elements are important in the policy package offered by the trust service provider. These are: (i) Information security management (ii) Accountability (iii) Legal compliance and enforcement By providing information security management, the TSp fulfils the requirement of customer's privacy. Transaction through TSp de-links customer and vendor and thus protects customer from the direct influence of vendor. But the privacy provided by a TSp is not complete anonymity. Customer's transactions can still be checked by the government agencies if the need arises. The presence of accountability and law enforcement policies strengthens peoples' confidence in the trustworthiness of the TSp. This constitutes the Institutional Base of the TSp. The policies and processes in the institutional base standardize, regulate, and regulate all transactions made through the TSp. An example of how strong institutional base influences business can be taken from the credit card companies whose policies and processes allows a card holder to shop in a foreign country Risk Model Risk model provides a way to assess the risk of using or providing the trust service. A comprehensive risk model identifies the user's view of using the service and TSp's view of providing the service [6]. Since our framework requires a collaboration of TSps to provide a trust service (third core service), risk assessment requires more careful attention. Currently our risk model is very simple; for a user the total risk in transacting via a chain of TSps is equal to transacting with just one TSp, the one to which it is directly connected. We contend that with strong liability conditions and good set of policies, the risk model need not be very complicated Collaboration Among Trust Service Providers Collaboration among service providers increases the service and product base for the customers and the vendors. Not only collaboration allows customers and vendors not sharing a common TSp to transact but the information database required to make prudent decisions about product selection is also increased. But collaboration brings increased risks and service charges. We contend that the benefits obtained through the use of a TSp based network outweigh the risk involved. We will analyze this more in the next section. One important aspect of our intermediary based framework is how trust among the principals (customer, vendor, and TSp) is modeled. Our trust model is realistic and close to real world. In our trust model: (i) Customer and vendors do not trust each other. (ii) Customer and vendors only trust their respective TSps. (iii) A TSp does not trust every other TSp. By stating (i) we make our model purely related to the B2C EC where there are not prior trust relationship among the customer and the merchant. The second point has been explained in Section 3.2. Here we just add that for an organization to become a TSp in the first place points to the need for an endorsement or certification agency similar to the one found in public key infrastructures. Finally by stating (iii) we envision a Trust Network or Trust Web where a TSp is connected to the TSps whom it trusts. Currently there are two levels of trust; complete trust and complete distrust. In future we will also add partial trust values to our model. It is important to note that in a trust model like ours, if customer and vendor do not share a common TSp, then there is a need to search a path through the trust web which poses least risk and cost to the transacting parties. Since our trust model does not allow transitivity of trust -- Alice trusts Bob, Bob trusts Cathy, so Alice trusts Cathy --therefore a mechanism to establish a trust chain between the customer and vendor with intervening TSps has to be established. This can be done on the basis of recommendation; i.e. Bob can recommend Cathy to Alice. Note that recommended trust exists only between TSps and not between customer and vendor who only trust their direct TSp. An algorithm to find a trust path between the customer and merchant using above trust model is given in [9]. We have also provided an implementation of the algorithm in a distributed object platform called CORBA. In addition to finding the trust path between customer and merchant, our algorithm also takes care of the single-customer-multiple-vendor transaction problem [4,9,12].

5 4. Analysis This section presents an analysis of the framework presented in Section 2. We analyze our proposed framework from two aspects. First we will compare it with other available methods and technologies for trust assurance, second we will discuss and present argument to support our intermediary based framework Comparing With Other Technologies Currently there are no large-scale efforts in providing an effective trust assurance infrastructure to the B2C EC. In fact a mention of the phrase trust management is understood as the management of the public key infrastructure where certification authorities endorse public keys [11]. However, our framework targets trust between the principals rather than trust between the principal and the communication medium. Some available architectures have tried to address this problem like the Visa/Master card Secure Electronic Transaction (SET) protocol [10]. This protocol binds real merchants and customers to their identity on the Internet. This helps in the process of accountability. However, it should be noted that SET is basically a payment protocol designed mainly for credit card transactions and does not support for quality evaluation of the product and complex multi-vendor transactions. There are specialized service providers available nowadays, called Marketspoilers [7], that aggregate information about a market and its suppliers and provide the aggregated information to consumers via a Web site. Moreover, there are regionally and industry focused Micromarketplaces [8] that helps buyers within a particular industry, geographic region, or affinity group make informed decisions by aggregating content, and offering multiple vendor alternatives. These service providers are actually providing the first core service in our proposed framework. Many enterprises are now trying to extend the B2B EC technologies to B2C EC. Two examples exist in this regard. The first one is the technology of Extranets and the other one is Value Added Internet (VAI) [1,12] Extranets Extranets are an extension of an organization's local network -- the Intranet -- to the outside parties who are given access to this area. Extranets are a result of a closed trade tradition among the trading partners and allow selectively sharing information or executing the transactions among customers and suppliers. By this they allow a direct communication among the transacting parties without the need of an intermediary thereby cutting costs Value Added Internet (VAI) Value Added Internet is an adoption of the Value Added Network (VAN) to the Internet standards. Traditionally VANs have been used as a communication medium for the Electronic Data Standard (EDI) document exchange standard. EDI has long been a mainstay of supply-chain management systems of organizations. VAIs will support the implementation of the ultimate extarnet -- the integration of all of an organization's business processes, supported by back-office systems, with key business partners. It is logical to think about extending both Extranets and VAI to general purpose B2C EC. However, they again pose a similar problem of trust among the vendor and an unknown customer. Moreover, both these technologies give control back to the company rather than the customer. Through them companies make sure that Internet is not compromising the effectiveness of other sales channels. This causes an intimidation among the customers who want to make more informed decisions rather than believing a company's advertisement. We see that in future both extranets and VAI will gain grounds in B2B EC but their prospects in B2C EC do not look promising To Intermediate Or Not To Intermediate It is a known fact in traditional commerce that removing intermediary in a business transaction lowers the transaction risk and reduces the cost. It also seems tempting to apply the same concept in Internet based commerce. However, things are not so simple in EC. In traditional commerce transacting parties usually interact face to face. On Internet, identities are hidden and customer and vendor both are interacting via Web pages. So the legitimacy of either party is hard to establish. Things are different in B2B EC, as we have explained before, that a prior trust relationship already exists between the business parties. Below we give two reasons that strengthen our claim that for large scale B2C EC an intermediary is necessary. We have already provided an explanation of these reasons in Section 4.1. (i) Having intermediaries improves and facilitates product search, and quality evaluation of product and the vendor services. (ii) The increased cost of transaction is more

6 than compensated by the lowering of risk due to the presence of institutional base provided by the intermediary. Examples showing the how intermediary based EC has increased efficiency of buyers and sellers are provided in [10] and [1]. In [10], an online service for auctioning used cars (AUCNET) is described. This service has been around since 1985 and its success shows how the presence of Trusted Intermediary and a strong institutional base peoples' trust in E-commerce. Specifically this service defines policies for the following activities: (i) How to subscribe to the service. (ii) What user equipment (computer, communication link etc.) qualifies for the use of the service. (iii) How products are evaluated. (iv) How disputes are resolved among buyer and sellers. (v) The guidelines for product delivery and payment. (vi) Incentives for honest users and accountability of malicious users are also part of the policy package. Another example given in [1] describes Fruitof-the-Loom -- a leading distributor of apparel -- which has facilitated for both the customer and the manufacturer to gather crucial information. Using the services provided by Fruit-of-the-Loom, manufacturers can get data on daily sales, inventory balances, and other information that enables the manufacturer to improve the inventory management and reduce cycle time. Customers who are silkscreeners, embroiderers, and other decorators have access to the information about available inventory, potential substitutions, logistics, and customerspecific special. This example also gives a clear indication that not only B2C EC, intermediaries improve efficiency in B2B EC too. 5. Conclusion And Future Work This paper has presented a trust framework to support large-scale business-to-consumer electronic commerce. We have placed main stress on simplicity, implementability, and maintainability of the framework. By presenting it, our goal is to reuse as much of the present facilities on the Internet rather than redefining or reinventing our own. We have converted a third party trusted intermediary into a more structured and general entity, which we have called a Trust Service Provider. Still we do not make a TSp general enough to cover all the trust services; we envision a network of TSps fulfilling this job. In future our main goal is to realize a TSp. In doing so we will work out the risk assessment model for our framework, especially determination of composite risk in case of TSp collaboration, as well as an acceptable service charges model, methods for integrating existing services with the framework, and use of partial trust values in the trust model. 6. References [1] The Internet: The Next Wave of Electronic Commerce", In Business Technology Journal, GartnerGroup, URL: [2] [Premenos' Electronic Commerce Resource Guide to ANSI X12 and EDIFACT standards URL: [3] "Open Buying on the Internet: a standard for business-to-business Internet commerce", SupplyWorks white paper. URL: [4] Steven P. Ketchpel, Hector Garcia-Molina, "Making Trust Explicit in Distributed Commerce Transactions", Proceedings of 16th International Conference on Distributed Computing Systems, Hong Kong, [5] Rivest R., "Perspectives on Financial Cryptography", Financial Cryptography 97, pp , [6] Arthur Williams, Michael L. Smith, Peter C., "Risk management and insurance", McGraw- Hill, [7] David Barnick, Patrick Meehan, "Internet Marketspoilers: An E-Business Model that lets Consumers take charge", In Business Technology Journal, GartnerGroup, URL: [8] Roy Satterthwaite, Dave Taylor, "Micromarketplaces: A new E-Commerce opportunity", In Business Technology Journal, GartnerGroup, URL: [9] Khan Muhammad Arshad, Yacine Atif, Yakoob M. Siyal, " A CORBA based Framework for Trusted E-Commerce Transactions", to appear in the Proceedings of 3 rd Intl. Enterprise Distributed Object Computing Conference, Sep 27-30, 1999, Germany. [10] Ho Geun Lee, "Electronic Market Intermediary: Transforming Technical Feasibility into Institutional Reality", In Proceedings of the Thirtieth Hwaii International

7 Conference on System Sciences, pp. 3-12, vol. 4, [11] P. K. Janbandhu, M. Y. Siyal, Novel Biometric Digital Signatures for Internet based Applications, Information Management and Computer Security Journal, MCB University Press, UK, vol. 9, No. 5, pp , [12] Siyal M Y and Barkat B A Novel Trust Service Provider for Internet Based Commerce Applications, Internet Research Journal, MCB University Press, UK, Vol. 12, No. 1, pp , Peripheral Services Negotiation Quality Evaluation Policy Package Brokerage & Cataloging Core Services Collaboration Logistics Payment Figure 1: The concept of a Trust Service Provider (TSp)