电子商务：管理视角chap08.ppt

1、Chapter 8Electronic Payment Systems and Security,1,Learning Objectives,Describe typical electronic payment systems for EC Identify the security requirements for safe electronic payments Describe the typical security schemes used to meet the security requirements Identify the players and procedures o

2、f the electronic credit card system on the Internet Discuss the relationship between SSL and SET protocols,Discuss the relationship between electronic fund transfer and debit card Describe the characteristics of a stored value card Classify and describe the types of IC cards used for payments Discus

3、s the characteristics of electronic check systems,Learning Objectives (cont.),SSL Vs. SET: Who Will Win?,A part of SSL (Secure Socket Layer) is available on customers browsers it is basically an encryption mechanism for order taking, queries and other applications it does not protect against all sec

4、urity hazards it is mature, simple, and widely use SET ( Secure Electronic Transaction) is a very comprehensive security protocol it provides for privacy, authenticity, integrity, and, or repudiation it is used very infrequently due to its complexity and the need for a special card reader by the use

5、r it may be abandoned if it is not simplified/improved,Payments, Protocols and Related Issues,SET Protocol is for Credit Card Payments Electronic Cash and Micropayments Electronic Fund Transfer on the Internet Stored Value Cards and Electronic Cash Electronic Check Systems,Security requirements,Paym

6、ents, Protocols and Related Issues (cont.),Authentication: A way to verify the buyers identity before payments are made Integrity: Ensuring that information will not be accidentally or maliciously altered or destroyed, usually during transmission Encryption: A process of making messages indecipherab

7、le except by those who have an authorized decryption key Non-repudiation: Merchants need protection against the customers unjustifiable denial of placed orders, and customers need protection against the merchants unjustifiable denial of past payment,Security Schemes,Secret Key Cryptography (symmetri

8、c),Public Key Cryptography,Security Schemes (cont.),Message,Digital Signature,Digital Signature,A digital signature is attached by a sender to a message encrypted in the receivers public key,Sender encrypts a message with her private key,Security Schemes (cont.),Analogous to handwritten signature,Ce

9、rtificate,Security Schemes (cont.),Identifying the holder of a public key (Key-Exchange) Issued by a trusted certificate authority (CA),Certificate Authority - e.g. VeriSign,RCA : Root Certificate Authority BCA : Brand Certificate Authority GCA : Geo-political Certificate Authority CCA : Cardholder

10、Certificate Authority MCA : Merchant Certificate Authority PCA : Payment Gateway Certificate Authority,Hierarchy of Certificate Authorities Certificate authority needs to be verified by a government or well trusted entity ( e.g., post office),Security Schemes (cont.),Public or private, comes in leve

11、ls (hierarchy) A trusted third party services Issuer of digital certificates Verifying that a public key indeed belongs to a certain individual,Electronic Credit Card Systemon the Internet,The Players,Cardholder Merchant (seller) Issuer (your bank) Acquirer (merchants financial institution, acquires

12、 the sales slips) Brand (VISA, Master Card),The process of using credit cards offline,Electronic Credit Card Systemon the Internet (cont.),Cardholder,Credit Card Procedure (offline and online),14, Prentice Hall, 2000,Secure Electronic Transaction (SET) Protocol,1. The message is hashed to a prefixed

13、 length of message digest. 2. The message digest is encrypted with the senders private signature key, and a digital signature is created. 3. The composition of message, digital signature, and Senders certificate is encrypted with the symmetric key which is generated at senders computer for every tra

14、nsaction. The result is an encrypted message. SET protocol uses the DES algorithm instead of RSA for encryption because DES can be executed much faster than RSA. 4. The Symmetric key itself is encrypted with the receivers public key which was sent to the sender in advance. The result is a digital en

15、velope.,15,Senders Computer, Prentice Hall, 2000,Senders Computer,Senders Private Signature Key,16, Prentice Hall, 2000,5. The encrypted message and digital envelope are transmitted to receivers computer via the Internet. 6. The digital envelope is decrypted with receivers private exchange key. 7. U

16、sing the restored symmetric key, the encrypted message can be restored to the message, digital signature, and senders certificate. 8. To confirm the integrity, the digital signature is decrypted by senders public key, obtaining the message digest. 9. The delivered message is hashed to generate messa

17、ge digest. 10. The message digests obtained by steps 8 and 9 respectively, are compared by the receiver to confirm whether there was any change during the transmission. This step confirms the integrity.,Receivers Computer,Secure Electronic Transaction (SET) Protocol (cont.),17, Prentice Hall, 2000,R

18、eceivers Computer,18, Prentice Hall, 2000,Entities of SET Protocol in Cyber Shopping,19, Prentice Hall, 2000,SET Vs. SSL,Secure Electronic Transaction (SET),Secure Socket Layer (SSL),Electronic Fund Transfer (EFT)on the Internet,An Architecture of Electronic Fund Transfer on the Internet,Payer,Debit Cards,A delivery