Re: [legalxml-courtfiling] EFiling Process Models Subcommittee

[John Messing <jmessing@law-on-line.com>]

>>>> Dallas Powell <dpowell@tybera.com> 12/31/02 03:14PM >>> wrote:

<DP>So, how do you publish a security model to the open public that
>communicates
>to the EFM, and at the same time, when each party writes code to meet
>the
>security model it does not jeopardized in any way the ability of the
>EFM to
>recognize and authenticated source or submission from unauthenticated
>source
>or submissions? 
</DP>

There are W3C standards forjust this use case. XMLDSIG permits signing of XML. It is perfectly suitable for securing the XML in transit. XMLENC enables encryption. Either of these can separate out unwanted source communications. Signatures and HMACS are two well-known tools for this purpose. They can be incorporated into software applications without compromising the security of the EFM.

I agree that an EFM can be important as a focal point for receiving XML court filings. It can enable court policy determinations and provide a place for the transformations of the standard XML metadata into a format that is recognized by the CMS. The translation can be made by way of OXCI and CMS-API but that is extremely costly. It can also be done much more cheaply with SOAP messaging for enveloping and XSLT for conversion to backend formats suitable for CMS integration.

Use of the latter rapidly also enables standard XML security solutions based upon DSIG and ENC, which in turn enable the use of many types of standard signature and encryption protocols in a variety of flavors. The work has been done and is being used by other TC's for just this purpose.

Happy New Year all.