Security is one of the primary concerns of any business project on the World Wide Web. By design, the Internet is an 'open' system: when data travels from one machine to another it passes through a number of other machines along the way. These other machines have the capability of eavesdropping as they pass the data along. However, if the data is encrypted as it sent, it will be incomprehensible to everyone except the sender and the intended recipient.
The First Chicago Trust Corporation of New York's Internet Proxy Voting system will have different forms of protection for each of its three central parts:
Encryption will be established by the industry standard Secure Socket Layer (SSL) protocol. This protocol insures that any eavesdropper would have to spend years of computer processing time in order to decrypt the information that was sent.
BBN will assist in getting the Internet Proxy Voting project its own Digital Certificate. This type of certificate, secured from a "trusted third party" (one of several established Internet Security Companies) will verify to shareholders that the FCTC server is what it claims to be. The shareholder's web browser (referred to as the 'client') and FCTC's web server will go through a process known as 'handshaking', where the client and the server establish a secure link. Once this link has been established, all information passed between the client and the server will be protected by advanced mathematical encryption.
The shareholder experience will be divided into two sections. One section will hold the welcome and information screens. This section will be accessible to everyone on the world wide web without using encryption, providing general information about the Internet Proxy Voting service. When a shareholder clicks on the "Begin Online Proxy Voting", however, he or she will be taken to the secure section that is protected by SSL security. The shareholder will enter a dialog that explains the secure connection that is being made. An icon will appear on the Browser's window indicating a secure connection has been established.
There are other precautions being taken as well: a checksum (a simple mathematical formula) and several other 'sanity checks' will be applied once the shareholder has entered his or her proxy number, taxpayer identification number, and PIN. If the numbers do not add up the user will not be allowed to enter the actual proxy form screen. This prevents non-shareholders from entering bogus votes into the system.
The setting up and maintenance of the site will have with the same encryption as the shareholder experience: no third party will be able to observe the information being sent. The administration section will add further security: no one without the correct username and password will be permitted to view or change any of the files. Also, only certain computers will be given access to the Administration Areas: if your computer is not one of these few machines (as determined by the IP address) you can not perform any administrative task.
The vote results will not be sent over the Internet, but rather over a leased line reserved especially for the purpose. This line, a direct connection between BBN and FCTC, will be secure in and of itself, avoiding the challenges of securing information over a publicly accessible network.
A good (if somewhat technical) reference on encryption over computer networks is RSA's FAQ 3.0 on Cryptography. Also, most web browser's documentation has browser-specific information about SSL and encryption.