Development of Ideas: Security

Before examining the effects this has on our sense of identity, I first want to examine the aspects of security in regards to digital currency and trade that must be taken into account. Security as a whole can be organised in terms of its function and there are basic tenants of physical security, concerning such things as locked doors, fences and guards. However, in the online environment there are many other factors involved. Authorisation governs the authority that any user has in a specific situation and monitors what actions are then allowed to be carried out. Accountability has the ability to link back any action undertaken with the person who made that action. Authenticity is about making sure that the user that presents itself as a negotiator in a transaction is the same user throughout the proceedings and the term of the deal. It implies a protection against a falsified identity and proof that all persons or data within any negotiation are authentic and have not changed. This is not to be confused with authentication, which is a usually a single check at certain intervals in the transactions whereas authenticity is more an ongoing proof that continually makes sure that the same participants are involved.

Integrity is the area concerned with making sure that any part of the security process is "correct" and has not been altered or tampered with. The focus is on legitimate users not being able to make unauthorized modifications to any aspect of the process. Non-repudiation guarantees that all parties cannot later deny to be the involved in the transaction, both parties should not be allowed to repudiate their contract or their actions. This is normally undertaken by an authorised third party capable of logging and corroborating identity.

As well as these aspects of security, which are so crucial, any form of digital payment and trade must also fulfil certain criteria to ensure that the final results of any transaction are equal to that of a physical, real world transaction. Atomicity is a factor that must show that a transaction has either occurred in total or not at all, so that all pertinent records are altered to balance out and that a trail of proof can be made to show what has happened. Consistency is the proof of atomicity where all crucial actions involved in the transaction are covered by non-repudiation and all parties can agree upon them. All parties must agree that every aspect of the transaction has indeed taken place. Isolation makes sure that all transactions cannot overlap, in order to prevent simultaneous actions from contradicting each other. Also Durability must show that no form of technological error can interfere with the information of the transaction and that a consistent state can be recovered after any such error.

With such concepts in mind I wish to examine what factors would be involved should we assume that all trade will one day be conducted via some form of integration with technology. Using authorised third party security, an insurance of non-repudiation and accountability we can safely assume that a specific merchant has whatever goods are being offered. We can also show from these methods that the buyer in the transaction has the credit, that the goods on offer are as represented and that the goods are dispatched when the buyer transfers funds or visa versa. Allowing the trade of unknown goods by unaccounted persons opens the door to illegal trade, therefore identification of all parties involved becomes paramount. Thus, how we protect the identity of the buyer, seller and the information that is part of the trade is also paramount, for without it all trust is removed from the system and it no longer functions. Here we arrive at a concept that can be viewed as the lynch pin of modern security: encryption. Encryption is the transformation of any direct communication by cryptographic process into a form of communication that conceals the original meaning; so that no un-authorised party can comprehend or reverse engineer the communication channels in any transaction.

An infinitely robust form of encryption would guarantee that trade, identity or communication via technology would be absolutely secure, though such technology does not exist and nor does it seem likely to appear using any of the current methods. In order to improve the inherent security of a system other aspects are gaining importance, such as the focus on identity itself. Anonymity, privacy, confidentiality and accountability are all concepts that rely upon secure methods of encryption and are integral to the question of proving or hiding one's identity. This is where the power of a system to authenticate its users becomes important. Authentication is the process of determining that someone is who they claim to be, this process does not go into what the person is allowed to do only that they are indeed a genuine user. It is based upon one or all of three main ideas. Physical objects that are issued to you to prove your identity, such as a key card, knowledge that is held only by you, such as a password or account number and finally, biometrics.

Biometrics is a method whereby a person is recognized according to personal traits; such as patterns of blood vessels in the iris, the shape of the face or ear, dimensions of the hand, fingerprints, gait, odour, DNA, voice, the reflection of radio waves within the body and the reflection/resonance of sound waves within the skull. The strong side of this is that biometric data cannot be lost or transferred and are difficult to forge. The weak side is that injury or time can alter a persons biometrics and that a biometric signature cannot be destroyed, once it is compromised there can be no alteration as a safeguard as one can with a normal key and lock.