Extending Certificates

Certificates were invented to guarantee public keys, but they can do much more. That's because each certificate consists of an extendible set of fields. Some fields are predefined. But you can add as many as you want. Corporations might want to create strong certificate structures that carry additional information about the privileges given to the holder. For example, a certificate could set a limit on the size of a contract that an employee can guarantee. The corp orate treasurer, for instance, might have a certificate that backs up a digital signature applied to any contract, no matter how large. A new, entry-level employee, on the other hand, might get a certificate that can spend only small amounts (say $100).

There are no limits to the fields that can be added to a certificate. It's easy to imagine certificates that specify the level of travel allowed (first class versus coach), the type of parking, the access to particular financial docu ments, or even the key to the executive washroom. Each corporation can choose to implement these fields differently.

IBM is planning on helping companies add certificate-level security to their personnel data. This is the type of all-encompassing job that certificate-minting software companies need to justify a large installation at a company. This type of system would allow people to check information about their benefits 401(k) plans, and other personal business that an employer is ob ligated to keep private.

Corporate certificate structures could also be moved to a web structure. The entry-level employee might get only a general signature, issued like an ID by the security department, while top management's certificates would be guaranteed by the personal digital signatures of the board of directors. Access to financial documents might require a certificate guaranteed by the comptroller's office, and in the case of special projects, compartmentalized security could be insured by requiring that someone's certificate bears the signature of the project manager.