These include access control lists, authorization servers, revocation lists, delegation of authority between principals and authorization techniques for mobile systems. These primitives must be simple enough that application programmers, who are not security experts, can be educated in the combination of formal methods and art needed to build secure applications using standardized primitives. These include configuration control and prevention of unauthorized modification, tamper-proof routing protocols, protection against denial of service, physical protection of switches and communication circuits, and protection against unauthorized traffic analysis. To be commercially viable, these systems must link to such existing distributed payment mechanisms as credit cards and electronic funds transfer. Research issues include how to provide security commensurate with financial exposure, keep costs low enough to make the system usable for low-value transactions and handle very large transaction volumes.
Research is needed on ways to make the payment system integrate easily with applications.
Accountability requires research into mechanisms for receipts and non-repudiation. Research is needed into fraud detection as well as fraud prevention. Technical, social-science and policy research is also needed to understand how to balance privacy with fraud detection. This may include separate tags in a multimedia document for audio, image or the arrangement as a whole. These tags will facilitate voluntary payment of royalties and in principle can be brought into use very quickly.