secured internet payment

PREPAREDBY:

AtulDave(500530985)ShaukatRaza(500543780)SimranveerBrar(500468450)

ComputerNetworkSecurity(EE8213)

GUIDE&MENTORBY:

Dr.CungangYang

1SecureInternetPaymentSystems

IncorporatethePaymentFunctionsinInternetWorld

PaymentMethods

CashCreditCardChequeCredit&DebitTransfer

INTRODUCTION

SecureInternetPaymentSystems 2

SecureElectronicTransaction(SET)ProtocolforImplementingCreditCardPaymentElectronicChequeSystemforSupportingChequePaymentElectronicFundTransfer&ElectronicCashSystemforEmulatingPhysicalCashPaymentOtherMethodsi.eMicropayment&SmartCardPayment

CREDITCARDBASEDMETHODS:CREDITCARDOVERSSLSETELECTRONICCHEQUES:

NETCHEQUEANONYMOUSPAYMENTS:

DIGICASHCAFEMICROPAYMENTS

SMARTCARDS

MAJORINTERNETPAYMENTMETHODS


ANONYMITY:WHETHERTHEPAYMENTMETHODISANONIMOUS

SECURITY:WHETHERTHEMETHODISSECURE

OVERHEADCOST:THEOVERHEADCOSTMUSTBECOMPETENTENOUGH

TRANSFERABILITY:WHETHERTHETRANSACTIONCANBEDIVIDEDINTOARBITRARYSMALLPAYMENTSWHOSESUMISEQUALTOTHEORIGINALPAYMENT

ACCEPTABILITY:WHETHERTHEMETHODISACCEPTEDGLOBALLY

FEATURESOFSECUREPAYMENTMETHODS


PAYMENTMETHODSHOULDBE

VERYSECURE

LOWOVERHEADCOST

TANSFERABLE

USERFRIENDLY(GLOBALLYACCEPTED)

DIVISIBLE

ANONYMOUS

4CPAYMENTMETHODS


4CPAYMENTMETHODSCOMPARISONS

SecureInternetPaymentSystems

METHODS/FEATURES

CASH CREDITCARD

CHEQUE CREDIT/DEBIT

ANONYMITY YES,INGENERAL

NO NO NO

SECURITY GOOD GOOD GOOD GOOD

OVERHEADCOST

LOWEST,INGENERAL

HIGHERTHANCASH&

DEBIT

HIGHEST,INGENERAL

LOW

TRANSFERABILITY

YES NO NO NO

DIVISIBILITY NOTCOMPLETELY

YES YES YES

ACCEPTABILITY

YES,INGENERAL

YES,INGENERAL

NO,INGENERAL

NO,INGENERAL

6

THECREDITCARDISTHEMOSTCOMMONLYUSEDPAYMENTMETHODGLOBALLY.

BEFORETHEINTRODUCTIONOFSETPROTOCOLTHESECURECREDITCARDPAYMENTWASUSUALLYCARRIEDOUTOVERANSSLCONNECTION.

SETPROTOCOLFORCREDITCARDPAYMENTMETHOD


ADVANTAGEOFSSL:ITENSURESTHESECURETRANSMISSIONOFCREDITCARDINFORMATIONOVERTHEINTERNETDISADVANTAGEOFSSL:ITISNOTACOMPLETECREDITCARDPAYMENTMETHODFOREXAMPLE:ITCANNOTSUPPORTONLINECREDITCARDAUTHORIZATION

SETISSPECIALLYDEVELOPEDTOPROVIDESECURECREDITCARDPAYMENTOVERTHEINTERNETITISNOWWIDELYSUPPORTEDBYMAJORCREDITCARDCOMPANIESINCLUDINGVISAANDMASTERCARD.

PROS&CONSOFSSLV/SSET


SETNETWORKARCHITECTURE


SETAIMSATSATISFYINGTHEFOLLOWINGSECURITYREQUIREMENTSINTHECONTEXTOFCREDITCARDPAYMENT:

CONFIDENTIALITY:SENSITIVEMESSAGESAREENCRYPTEDSOTHATTHEYAREKEPTCONFIDENTIAL

INTEGRITY:NEARLYALLMESSAGESAREDIGITALLYSIGNEDTOENSURECONTENTINTEGRITY

AUTHENTICITY:AUTHENTICATIONISPERFORMEDTHROUGHAPUBLICKEYINFRASTRUCTURE.

SECURITYREQUIREMENTSSETPROTOCOL


SETNETWORKPARTICIPANTS


HenricJohnson 11

A SELLER ,WHICH IS CONNECTED TO AN ACQUIRER

A REGISTERED HOLDER OF THE CREDIT CARD WHO IS A BUYER

THE BANK THAT ISSUES THE CREDIT CARD TO A CARD HOLDER

THE BANK THAT SERVES AS AN AGENT TO LINK A MERCHANT TO MULTIPLE ISSUERS.

THIS IS TYPICALLY CONNECTED TO THE ACQUIRER THE PAYMENT GATEWAY IS SITUATED BETWEEN THE SET SYSTEM AND THE FINANCIAL NETWORK

11

SETDIGITALCERTIFICATESYSTEM


INTHEPHYSICALCREDITCARDSYSTEMTHEPAYMENTINSTRUCTIONS(PI)INCLUDINGTHECARDHOLDERSCREDITCARDNUMBERANDSIGNATUREARENOTKEPTCONFIDENTIALDATAINTEGRITYCANBASICALLYBEENSUREDBYUSINGPRINTEDRECEIPTSCARDHOLDERSAUTHENTICATIONRELIESONSIMPLESIGNATURECHECKINGONLY

INANELECTRONICCREDITCARDSYSTEMTHEORDERINFORMATION(OI)ANDPICANBEDIGITALLYSIGNEDTOENSUREDATAINTEGRITYTHESENSITIVECREDITCARDINFORMATIONMAYSTILLBEDISCLOSEDTOOTHERPEOPLE

SETINTRODUCESANOVELMETHODCALLEDTHEDUALSIGNATURE(DS)TOENSUREDATAINTEGRITYWHILEPROTECTINGTHESENSITIVEINFORMATION

DUALSIGNATUREGENERATION&VERIFICATION


SETNETWORKARCHITECTURE


H(OI))]||)(([ PIHHEDScKR

=

14

SETPROTOCOLFORCREDITCARDPAYMENT


FLOWCHARTOFTHEPROCESS

15

THEMERCHANTISPROVIDEDWITHOI,H[PI],ANDDSTHEDUALSIGNATURECANBEVERIFIEDASFOLLOWS:

STEP1:THEMERCHANTFIRSTFINDSH[H[PI]||H[OI]]STEP2:HETHENDECRYPTSTHEDIGITALSIGNATUREWITHTHECARDHOLDERSPUBLICSIGNATUREKEYASFOLLOWS:DRSA[DS|KEYPUBLIC_SIGN,CARDHOLDER]WHERE,KEYPUBLIC_SIGN,CARDHOLDERPUBLICSIGNATUREKEYOFTHECARDHOLDER

STEP3:FINALLY,HECOMPARESTHETWOTERMSH[H[PI]||H[OI]]ANDDRSA[DS|KEYPUBLIC_SIGN,CARDHOLDER]

THEYSHOULDBETHESAMEIFTHETRANSMITTEDDSHASNOTBEENCHANGED;OTHERWISETHEORDERISNOTVALID

HOWTHEMERCHANTANDPAYMENTGATEWAYVERIFYTHEDS?


THEPAYMENTGATEWAYISPROVIDEDWITHPI,H[OI],ANDDS

BYUSINGTHEDUALSIGNATUREMETHOD,EACHCARDHOLDERCANLINKOIANDPIWHILERELEASINGONLYTHENECESSARYINFORMATIONTOTHERELEVANTPARTY

IFEITHERTHEOIORPIISCHANGED,THEDUALSIGNATUREWILLNOLONGERBEVALID

HOWTHEMERCHANTANDPAYMENTGATEWAYVERIFYTHEDS?


DIGITALENVELOPE


ARANDOMDESKEY(KEYRANDOM)FIRSTGENERATEDTOENCRYPTTHEMESSAGE,I.E.EDES[MIKEYRANDOM]KEYRANDOMISTHENENCRYPTEDBYTHEVBS'SPUBLICKEY_EXCHANGEKEY,SAYKEYPUBLIC_EXCHANGEI.E.ERSA[KEYRANDOMIKEYPUBLIC_EXCHANGE.VBS]EDES[MIKEYRANDOM1ANDERSA[KEYRANDOMIKEYPUHLIC_EXCHANGE.VBSLARESENTTOTHEVBS

TOOBTAINTHEMESSAGEM,VBSFIRSTOBTAINSKEYRANDOMBYDECRYPTINGERSA[KEYRANDOMIKEYPUHLICEXCHANGE,VBS]I.E.DRSA[ERSA[KEYRANDOMIKEYPUBLICEXCHANGE,VBS1IKEYPRIVATE_EXCHANGE,VBS=KEYRANDOM,WHEREKEYPRIVATEEXCHANGE,VBSDENOTESTHEPRIVATEKEYEXCHANGEKEYOFTHEVBSAFTEROBTAININGKEYRANDOMTHEVBSCANOBTAINMBYDECRYPTINGEDES[MIKEYRANDOM],I.E.TOFINDDDES[EDES[MIKEYRANDOM1IKEYRANDOM]=M

DIGITALENVELOPE


SETPROTOCOLARCHITECTURE


SETPROTOCOLHASFOURPHASES:INITIATIONPURCHASEAUTHORIZATIONCAPTUREFIRSTTHECARDHOLDERSENDSAPURCHASEINITIATIONREQUESTTOTHEMERCHANTFORINITIALIZINGTHEPAYMENTTHENTHEMERCHANTRETURNSARESPONSEMESSAGETOTHECARDHOLDERINTHESECONDPHASE,THECARDHOLDERSENDSTHEPURCHASEORDERTOGETHERWITHTHEPAYMENTINSTRUCTIONTOTHEMERCHANTINTHETHIRDPHASE,THEMERCHANTOBTAINSTHEAUTHORIZATIONFROMTHEISSUERVIATHEPAYMENTGATEWAYFINALLY,THEMERCHANTREQUESTSAMONEYTRANSFERTOITSACCOUNT

SETPROTOCOLPHASES


THEMERCHANTNEEDSTOOBTAINPAYMENTAUTHORIZATIONFROMTHEACQUIRER

THEAUTHORIZATIONREQUESTCONSISTSOF:TRANSACTIONIDAMOUNTREQUESTEDMESSAGEDIGESTOFORDERDESCRIPTIONOTHERTRANSACTIONINFORMATION

THEAUTHORIZATIONREQUESTISENCRYPTEDBYUSINGKEYB(PRIVATEKEYOFMERCHANT).

KEYBISTHENENCRYPTEDBYUSINGPUBLICKEYEXCHANGEKEYOFTHEPAYMENTGATEWAYTOFORMTHEDIGITALENVELOPE

PAYMENTAUTHORIZATION


THEMERCHANTSENDSTHEFOLLOWINGTOTHEPAYMENTGATEWAY

THEENCRYPTEDAUTHORIZATIONREQUESTANDTHEENCRYPTEDKEYBCARDHOLDERSANDMERCHANTSCERTIFICATESTHEFOLLOWINGINFORMATIONASRECEIVEDFROMTHECARDHOLDER:

PI+DI+H[OI](ALLENCRYPTEDUSINGKEYA)KEYA+CARDHOLDERINFORMATION(ALLENCRYPTEDUSINGTHEPAYMENTGATEWAYSPUBLICKEYEXCHANGEKEY)

AFTERRECEIVINGTHEAUTHORIZATIONREQUEST,THEPAYMENTGATEWAYPROCESSESITASFOLLOWS

OBTAINKEYBBYMEANSOFDECRYPTIONANDUSESITTODECRYPTTHEAUTHORIZATIONREQUESTVERIFIESMERCHANTSCERTIFICATESANDDIGITALSIGNATUREONTHEAUTHORIZATIONREQUESTOBTAINKEYAANDTHECARDHOLDERINFORMATIONBYMEANSOFDECRYPTIONUSESKEYATOOBTAINTHEPI,DSANDH[OI]VERIFIESTHEDSACCORDINGLY



THEPAYMENTGATEWAYALSOVERIFIESTHATTHERECEIVEDTRANSACTIONIDISTHESAMEASTHEONEINTHEPI

BYCHECKINGTHEORDERDESCRIPTIONINTHEAUTHORIZATIONREQUESTMESSAGE,ITCANBEVERIFIEDTHATTHEORDERHASBEENACCEPTEDBYTHECARDHOLDERANDTHEMERCHANTUPONALLSUCCESSFULVERIFICATIONS,THEPAYMENTGATEWAYFORWARDSTHEAUTHORIZATIONREQUESTTOTHEISSUERVIATHECURRENTPAYMENTSYSTEM

AFTERTHERECEIVINGTHEAUTHORIZATIONFROMTHEISSUERTHROUGHTHECURRENTSYSTEM,THEPAYMENTGATEWAYSENDSANAUTHORIZATIONRESPONSETOTHEMERCHANT



THEPAYMENTGATEWAYSENDSTHEFOLLOWINGTOTHEMERCHANTSIGNEDAUTHORIZATIONRESPONSE(ENCRYPTEDBYKEYC)

KEYC(ENCRYPTEDBYMERCHANTSPUBLICKEYEXCHANGEKEY)SIGNEDCAPTURETOKEN(ENCRYPTEDBYKEYD)KEYD+CARDHOLDERINFORMATION(ENCRYPTEDBYPAYMENTGATEWAYSPUBLICKEYEXCHANGEKEY)

AFTERRECEIVINGTHEAUTHORIZATIONRESPONSEFROMTHEPAYMENTGATEWAY,THEMERCHANTOBTAINSKEYCBYDECRYPTIONANDUSESITTODECRYPTAUTHORIZATIONRESPONSETHEMERCHANTVERIFIESTHEPAYMENTGATEWAYSCERTIFICATEANDTHEDIGITALSIGNATUREONTHEAUTHORIZATIONRESPONSEAFTEROBTAININGTHEAUTHORIZATION,THEMERCHANTTHENCOMPLETETHEORDERACCORDINGLY



TOBEGINWITHTHEPAYMENTCAPTUREPROCESS,THEMERCHANTGENERATESCAPTUREREQUESTTHATINCLUDESTRANSACTIONID,CAPTUREAMOUNTANDOTHERINFORMATIONABOUTTHECAPTUREREQUEST

THECAPTUREREQUESTISFIRSTSIGNEDBYUSINGTHEPRIVATEKEYOFTHEMERCHANTANDTHENENCRYPTEDWITHARANDOMSYMMETRICKEYE

EISTHENENCRYPTEDBYUSINGPUBLICKEYEXCHANGEOFTHEPAYMENTGATEWAYTOFORMTHEDIGITALENVELOPE

PAYMENTCAPTURE


THEMERCHANTSENDSTHEFOLLOWINGTOTHEPAYMENTGATEWAY:

SIGNEDCAPTUREREQUEST(ENCRYPTEDBYUSINGKEYE)KEYE(ENCRYPTEDBYUSINGPAYMENTGATEWAYSPUBLICKEYEXCHANGEKEY)SIGNEDCAPTURETOKEN(ENCRYPTEDBYUSINGKEYD)KEYD+CARDHOLDERINFORMATION(ENCRYPTEDBYUSINGPAYMENTGATEWAYSPUBLICKEYEXCHANGEKEY)MERCHANTSDIGITALCERTIFICATES

AFTERRECEIVINGTHECAPTUREREQUEST,THEPAYMENTGATEWAYOBTAINSKEYEBYDECRYPTIONANDUSESITTODECRYPTCAPTUREREQUEST

THEPAYMENTGATEWAYALSOVERIFIESTHEDIGITALSIGNATUREOFTHECAPTUREREQUESTBYUSINGMERCHANTSPUBLICKEY

PAYMENTCAPTURE


THEPAYMENTGATEWAYOBTAINSKEYDBYDECRYPTION,USESTHEKEYTODECRYPTTHECAPTURETOKEN,ANDVERIFIESTHECAPTURETOKEN

AFTERSUCCESSFULVERIFICATIONTHEPAYMENTGATEWAYSENDSAPAYMENTTRANSFERREQUESTTOTHEISSUERVIATHECURRENTSYSTEM

THECAPTURERESPONSECREATEDBYPAYMENTGATEWAYISSIGNEDBYUSINGITSPRIVATESIGNATUREKEYANDISENCRYPTEDBYRANDOMSYMMETRICKEYF

FISENCRYPTEDBYUSINGMERCHANTSPUBLICKEYEXCHANGEKEYTOFORMTHEDIGITALENVELOPE

PAYMENTCAPTURE


THEPAYMENTGATEWAYFORWARDSTHEFOLLOWINGINFORMATIONTOTHEMERCHANT:

SIGNEDCAPTURERESPONSE(ENCRYPTEDBYKEYF)

KEYF(ENCRYPTEDBYPUBLICKEYEXCHANGEKEY)

PAYMENTGATEWAYSDIGITALCERTIFICATES

AFTERRECEIVINGTHECAPTURERESPONSE,THEMERCHANTDECRYPTSITACCORDINGLYANDVERIFIESTHEDIGITALSIGNATURE.

PAYMENTCAPTURE


ANINTERNETPAYMENTMETHOD.FIRSTGENERATIONSMARTCARDSCREDITCARDSANDBANKCARDS.SMARTCARDSAREINTELLIGENTINTERACTIVEANDINTEROPERABLE.

SMARTCARD


CENTRALPROCESSINGUNIT:8BITMICROPROCESSORTHATCONTROLSTHEOPERATIONOFTHESMARTCARD.

RAM:USEDTOSTORETEMPORARYDATA.

EPROM:USEDTOSTORELONGTERMDATALIKECRYPTOGRAPHICKEYS.

ROM:USEDTOSTOREPERMANENTDATASUCHASTHEOPERATINGSYSTEM.

I/OINTERFACE:ITPROVIDESDATAINPUT/OUTPUTFUNCTIONS

SMARTCARDCOMPONENTS


LEVERAGESTHECHECKPAYMENTSSYSTEM,ACORECOMPETENCYOFTHEBANKINGINDUSTRY.

FITSWITHINCURRENTBUSINESSPRACTICES

WORKSLIKEAPAPERCHECKDOESBUTINPUREELECTRONICFORM,WITHFEWERMANUALSTEPS.

CANBEUSEDBYALLBANKCUSTOMERSWHOHAVECHECKINGACCOUNTS

DIFFERENTFROMELECTRONICFUNDTRANSFERS

SMARTCARDCOMPONENTS


EXACTLYSAMEWAYASPAPER

CHECKWRITER"WRITES"THEECHECKUSINGONEOFMANYTYPESOFELECTRONICDEVICES

GIVES"THEECHECKTOTHEPAYEEELECTRONICALLY.

PAYEE"DEPOSITS"ECHECK,RECEIVESCREDIT,

PAYEE'SBANK"CLEARS"THEECHECKTOTHEPAYINGBANK.

PAYINGBANKVALIDATESTHEECHECKAND"CHARGES"THECHECKWRITER'SACCOUNTFORTHECHECK.

HOWDOESELECTRONICCHEQUEWORK?


ANONYMOUSEPAYMENTPROCESS


1. WITHDRAW MONEY:CRYPTOGRAPHICALLY ENCODED

TOKENS

2. TRANSFORM SO MERCHANT CAN CHECK VALIDITY BUT IDENTITY HIDDEN

3. SE

ND TO

KEN A

FTER

ADDIN

G

MERC

HANT

S IDE

NTITY

4. CHECK VALIDITY AND SEND GOODS

5. DEPOSIT TOKEN AT BANK.IF DOUBLE SPENT REVEAL

IDENTITY AND NOTIFY POLICE

CUSTOMER MERCHANT

34

Stateoftheartinelectronicpaymentsystems,IEEECOMPUTER30/9(1997)2835InternetprivacyThequestforanonymity,CommunicationsoftheACM42/2(1999)2860.Hyperlinks:

http://www.javasoft.com/products/commerce/

http://www.semper.org/

http://www.echeck.org/

http://niiserver.isi.edu/info/NetCheque/

http://www.eceurope.org/Welcome.html/http://www.zdnet.com/icom/ebusiness/

Drew, G. Using SET for Secure Electronic Commerce. Prentice Hall, 1999Garfinkel, S., and Spafford, G. Web Security & Commerce. OReilly and Associates, 1997

SETCo(documentsandglossaryofterms)DataSecurityforeTransaction.RetrievedonApril12th2008,fromWeblink:

http://www.comp.nus.edu.sg/~jervis/cs3235/set.html

REFERENCES


QUESTION&ANSWER


THANK YOU


SECURE INTERNET PAYMENT SYSTEMSSlide 2Slide 3Slide 4Slide 5Slide 6Slide 7Slide 8Slide 9Slide 10Slide 11Slide 12Slide 13Slide 14Slide 15Slide 16Slide 17Slide 18Slide 19Slide 20Slide 21Slide 22Slide 23Slide 24Slide 25Slide 26Slide 27Slide 28Slide 29Slide 30Slide 31Slide 32Slide 33Slide 34Slide 35Slide 36Slide 37

Documents

secured internet payment