RE: Non-Repudiation - A Lower Level?

Krishna - What Rodger was discussing is more than auditing. There needs to
be a mechanism, not only to track (as in auditing) but to require a process
that has some controls over it to provide the business some assurance that a
request was not made by accident. This would be similar to simply signing a
document. Below a certain dollar amount of transaction, there is no need for
third party overview for non-repudiation. Mutually agreed business
relationships between companies would able them to use web services, as long
as there is the technical means to verify the origin of the request. Without
some means for conscious (process by people or system by design) notation
that a request was made, we not not have anything that would enable common
business processes to operate using web services.
 
I am not sure I articulated this very well, but I think you get the idea.

Gerald W. Edgar <Gerald.Edgar@Boeing.com>
Architecture support, BCA Architecture and e-business
425-234-1422

Mailing address:
The Boeing Company, M/S 6H-WW
PO Box 3707, Seattle, WA 98124-2207
USA

  

-----Original Message-----
From: Krishna Sankar [mailto:ksankar@cisco.com]
Sent: Sunday, May 19, 2002 18:10
To: www-ws-arch@w3.org
Subject: RE: Non-Repudiation - A Lower Level?


Roger,
 
    What you are articulating is auditing and I think it is in scope of
security. But auditing to support (legal) non-repudiation is not. Also
auditing for IDS purposes is also in scope of security.
 
cheers

-----Original Message-----
From: www-ws-arch-request@w3.org [mailto:www-ws-arch-request@w3.org] On
Behalf Of Cutler, Roger (RogerCutler)
Sent: Saturday, May 18, 2002 8:54 AM
To: www-ws-arch@w3.org
Subject: Non-Repudiation - A Lower Level?



The last con call had some discussion of non-repudiation in which Joe
emphasized that non-repudiation is about convincing a third party that
something happened involving the two direct participants in a transaction,
and others talked about the legal aspects -- such as problems guaranteeing
legal validity over a seven year period in the face of evolving technology.
And a rather complete discussion of non-repudiation has been posted but for
some reason I don't seem to be able to find it at the moment.  (Sigh.)

I would like to suggest a different understanding of non-repudiation that I
think is useful in a lot of business cases.  In fact, beyond "useful" to
"crucial".  Perhaps it is confusing to call it the same thing, but I don't
know what else to name it. Quoting from the EDI-like usage case I am
drafting, 

	Non-Repudiation is of particular importance, although in practical
terms less in terms of a legal process than simply the ability to say, "You
got this invoice on March 24, and here is your signed confirmation of
receipt".  That is, by far the most common scenarios that require
non-repudiation involve people in both companies trying, in good faith, to
sort out what has gone wrong in some screwed up transaction.  What is
required in these cases is an unambiguous record, not rock-solid legal
proof.  Taking these issues to court is a very rare occurrence given an
ongoing trading relationship between businesses. 

I believe that it is fair to say that in practical, EDI-like transactions
this sort of "unambiguos record" doesn't just satisfy the 80-20 but more
like the 99.9.  There is NO WAY that any technology or standards are going
to prevent screwups and confusion in business transactions, which in
practice happen all the time.  "You didn't pay us."  "Yes we did."  Or "We
ordered this but didn't receive it."  There are a bazilion things that can
go wrong which have nothing whatsoever to do with the web services or
business protocols, and have nothing to do with anybody taking anything to
court.

Now one might well say, "Well, if one satisfies the more rigorous, legally
motivated requirements of non-repudiation, one also satisfies this lower
level requirement".  That's OK, but what I am concerned about is that the
higher level of non-repudiation may be difficult to achieve.  I believe that
there is a genuine and immediate need for the sort of non-repudiation
described above, and perhaps it could be useful to get quickly to such an
understanding.

Or am I perhaps talking about what some people are calling "auditing"?  I'm
afraid I have not been entirely clear what people have meant by that.  Am I
really asking for clarification of terminology rather than a different
understanding of requirements?