InformationWeek

But that's about to change. Marketplace operators, security software vendors, and financial institutions are working to automate authentication and payment processes so that secure transactions can happen online.

VeriSign Inc., a leading security systems vendor, this week will reveal that it's working with marketplace platform provider Ariba Inc. and financial-services giant American Express Co. to provide a secure payment infrastructure for American Express' Pay on Ship procurement-card system, which was introduced in March. The payment system will let customers at Ariba-powered marketplaces use the American Express procurement card for transactions.

The three-company deal is the latest move by VeriSign to incorporate security services into business-to-business payment systems. The company intends to expand these services to provide authentication and digital-certificate technology to buyers and sellers of goods on marketplaces. "The immediate need was to integrate on the payment side," says Anil Pereira, VP for the Internet services group at VeriSign.

The American Express Pay on Ship card is expected to be available from Ariba in August. VeriSign also is working with Ariba rivals Commerce One Inc. and Intelisys Electronic Commerce Inc. to include digital certificate authentication into their marketplace platforms.

Digital certificates--and the public key infrastructure systems used to manage them--are the leading method for authenticating people or businesses over the Internet. Offered by Baltimore Technologies, Entrust Technologies, VeriSign, and other vendors, digital certificates and PKIs encrypt and decrypt documents and can be used to verify identity and restrict access to authorized users.

But few of the more than 1,000 marketplaces in operation use such systems because they aren't automated or integrated into the exchanges. That's despite the fact that "there is a critical need for buyers to authenticate sellers and sellers to authenticate buyers," says Andrew Bartels, a senior research analyst of E-commerce at Giga Information Group. "An authentication mechanism for identification is a very handy device."

Integrating authentication capabilities into marketplaces will enable a variety of services. "Once a transaction is consummated, we provide the ability to route a broad range of Internet checks, and debit-card or credit-card payments," says VeriSign's Pereira. "It enables the migration of payment transactions currently happening offline into the online world."

Marketplace operators see the need for these types of services, especially for transactions involving substantial amounts of money. Tradiant, an online marketplace that connects shippers of goods with ocean-going carriers, processes payments between buyers and sellers offline because a single transaction can exceed $1 million. "Anytime there's a high monetary transaction, authentication is crucial," says Anil Nair, VP of engineering at Tradiant. "It's crucial even when there's no payment involved--just doing negotiations or interacting with a Web marketplace."

Tradiant uses passwords on its site and cross-checks participants on a database of established importers and exporters. Nair is considering adding digital certificates in the next year. "We assume anybody who has a log-in and password is who they say they are, but clearly this isn't sufficient for the future," says Nair. "We've already investigated VeriSign and Entrust's public key infrastructures to issue certificates to authenticate users."

But installing an authentication system, even one that's been preconfigured to accept the use of digital certificates, still requires the marketplace to manage the system, unless it partners with a security outsourcer. Buzzsaw .com, an online marketplace for the construction industry, is manually authenticating a limited number of participants while it tests its site. "But as the numbers get higher, I think the need to outsource is going to be more and more obvious," says Jason Pratt, director of product marketing for Buzzsaw.com.

Pratt has spoken with Eccelerate .com, a subsidiary of Dun & Bradstreet Corp. that provides information on buyers and sellers so online trading communities can process E-commerce transactions, and Isignonline.com, which offers digital certificates. "We're looking for an authentication partner, and our urgency for finding that partner is directly related to the number of people in our marketplace," he says.

Other marketplaces are developing their own systems. E-IDC.com is a marketplace for the design and construction industries. Such businesses transfer large sums of money on a regular basis, making payments directly to suppliers' accounts as goods are delivered.

E-IDC.com is developing a system that will be hosted by an application service provider to facilitate large payments over the Internet, says Dwayne Shipley, chairman of E-IDC.com in Annapolis, Md. The system will require all participants to set up accounts in a single bank to avoid transferring money among different financial institutions. It will use digital certificates to authenticate users.

"If I have a thousand accounts in the same bank, I don't have the regulations of transferring from one bank to another to worry about," says Shipley. "All I'm doing is a bookkeeping entry." The E-IDC.com marketplace is slated for general availability in September; the payment system will be available two months later.

Financial institutions are also getting in on the action. Identrus LLC is a company created by 21 financial powers, including Bank of America, Barclays, and Chase Manhattan. It plans to offer secure payments for marketplaces through its own digital certificates, which will be designed to work with systems from any vendor, including VeriSign and Entrust. "Part of the risk that the financial institution assumes is identity," says Paul Donfried, Identrus' chief marketing officer. "That's what we're trying to deliver a solution for."

Identrus intends to provide a three-part system of authentication: a digital certificate, a real-time validation service, and a financial warranty that provides recourse should problems arise. Banks will issue Identrus certificates to businesses they verify. In addition, Identrus intends to create a network of trusted member banks, so if one financial institution issues a certificate to a user, a second bank will trust that user, too. Payments across marketplaces and higher-value online transactions would be validated by those banks.

Identrus' system could remove the burden from marketplaces to validate users. "But it's pretty far off in the future in getting full and wide adoption," says Giga Group's Bartels.

In the meantime, marketplace operators will have to use other options. Verida Internet Corp. operates several marketplaces, including AgriPlace .com for farming supplies. The site authenticates members through user names and passwords. It leaves payment authentication to credit-card companies for smaller purchases, says Michael Hinshaw, president and CEO of the San Francisco company. Larger deals are handled offline.