This concern creates the need to provide evidence of non-repudiation for the transaction. System operators must take responsibility for creating and enforcing security polices and for establishing appropriate security and business policy agreements among themselves and their customers to allow careful management of risk. Moreover, there is a wide variety of attacks that might be perpetrated against an Internet-based system. Leave an audit trail, maintain accountability, and provide non-repudiation and recoverability. The system should be able to positively identify the parties involved in an exchange.
Digital certificates are data files that can be used to identify users.
The CA could be the built-in certificate system or a third party that provides CA services to the hub. A user must be authenticated before being granted permission to access the system, through a commercially acceptable means verifying the identity of the person or company requesting the digital certificate. The digital certificate is used for every user as a means of identification, and the certificate is verified within the CA system before any document is received. The system should protect the information included in a message from eavesdropping or other disclosure, using relatively strong cryptographic algorithms. The system should verify that the content of an exchanged document has not been altered in any way after the document left the sender s site, through the use of digital signatures.