Trusted infrastructure support systems, methods and techniques for secure electronic commerce, electronic transactions and rights management

Abstract

An integrated, modular array of administrative and support services are provided for electronic commerce and electronic rights and transaction management. These administrative and support services supply a secure foundation for conducting transaction-related capabilities over electronic networks, and can also be adapted to the specific needs of electronic commerce value chains. In one embodiment a Distributed Commerce Utility having a secure, programmable, distributed architecture provides these administrative and support services. The Distributed Commerce Utility may comprise a number of Commerce Utility Systems. These Commerce Utility Systems provide a web of infrastructure support available to, and reusable by, the entire electronic community and/or many of its participants. Different support functions can be collected together in hierarchical and/or networked relationships to suit various business models or other objectives. Modular support functions can be combined in different arrays to form different Commerce Utility Systems for different design implementations and purposes.

What is claimed is: 
     
         1 . A system comprising:
 a first security checkpoint system, the first security checkpoint system comprising a protected processing environment, and being operable to enforce one or more rules governing transmission of a first secure container; and   a second security checkpoint system located remotely from the first security checkpoint system, the second security checkpoint system comprising a protected processing environment, and being operable to receive the first secure container and to check a certificate associated therewith.   
     
     
         2 . The system of  claim 1 , in which the first security checkpoint system is operable to associate the certificate with the first secure container. 
     
     
         3 . The system of  claim 1 , in which the second security checkpoint system is further operable to verify that the first secure container was transmitted to the second security checkpoint system in accordance with one or more rules. 
     
     
         4 . The system of  claim 3 , in which at least one of the one or more rules comprises a limit on the information that can be sent from a given entity. 
     
     
         5 . The system of  claim 1 , in which the first security checkpoint system is operable to prevent transmission of the first secure container to the second security checkpoint system in accordance with the one or more rules. 
     
     
         6 . The system of  claim 1 , further comprising:
 a certifying authority, the certifying authority being operable to certify a security checkpoint system's membership in a particular class.   
     
     
         7 . The system of  claim 1 , in which at least one of the one or more rules is received by the first security checkpoint system separately from the first secure container. 
     
     
         8 . The system of  claim 1 , in which the first security checkpoint system is further operable to record audit information relating to the transmission of the first secure container. 
     
     
         9 . The system of  claim 1 , in which contents of the first secure container are at least in part encrypted. 
     
     
         10 . The system of  claim 1 , in which contents of the first secure container are at least in part digitally signed. 
     
     
         11 . The system of  claim 7 , in which the at least one of the one or more rules is received by the first security checkpoint system in a second secure container. 
     
     
         12 . A security checkpoint system comprising:
 a processor;   a network interface;   a protected processing environment operable to enforce one or more rules governing access to, use of, and transmission of secure containers, and to check certificates associated with secure containers.