© Prentice Hall, 2000 Chapter 8 Electronic Payment Systems and Security 1 2 © Prentice Hall, 2000 Learning Objectives ❚ Describe typical electronic payment systems for EC ❚ Identify the security requirements for safe electronic payments ❚ Describe the typical security schemes used to meet the security requirements ❚ Identify the players and procedures of the electronic credit card system on the Internet ❚ Discuss the relationship between SSL and SET protocols 3 © Prentice Hall, 2000 ❚ Discuss the relationship between electronic fund transfer and debit card ❚ Describe the characteristics of a stored value card ❚ Classify and describe the types of IC cards used for payments ❚ Discuss the characteristics of electronic check systems Learning Objectives (cont.) 4 © Prentice Hall, 2000 SSL Vs. SET: Who Will Win? ❚ A part of SSL (Secure Socket Layer) is available on customers’ browsers ❙ it is basically an encryption mechanism for order taking, queries and other applications ❙ it does not protect against all security hazards ❙ it is mature, simple, and widely use ❚ SET ( Secure Electronic Transaction) is a very comprehensive security protocol ❙ it provides for privacy, authenticity, integrity, and, or repudiation ❙ it is used very infrequently due to its complexity and the need for a special card reader by the user ❙ it may be abandoned if it is not simplified/improved 5 © Prentice Hall, 2000 Payments, Protocols and Related Issues ❚ SET Protocol is for Credit Card Payments ❚ Electronic Cash and Micropayments ❚ Electronic Fund Transfer on the Internet ❚ Stored Value Cards and Electronic Cash ❚ Electronic Check Systems 6 © Prentice Hall, 2000 ❚ Security requirements Payments, Protocols and Related Issues (cont.) ❙ Authentication: A way to verify the buyer’s identity before payments are made ❙ Integrity: Ensuring that information will not be accidentally or maliciously altered or destroyed, usually during transmission ❙ Encryption: A process of making messages indecipherable except by those who have an authorized decryption key ❙ Non-repudiation: Merchants need protection against the customer’s unjustifiable denial of placed orders, and customers need protection against the merchants’ unjustifiable denial of past payment 7 © Prentice Hall, 2000 Security Schemes ❚ Secret Key Cryptography (symmetric) Scrambled Message Original Message Sender Internet Scrambled Message Key sender (= Key receiver ) Encryption Original Message Receiver Key receiver Decryption 8 © Prentice Hall, 2000 ❚ Public Key Cryptography Sender Original Message Scrambled Message Scrambled Message Public Key receiver Original Message Receiver Private Key receiver Internet Security Schemes (cont.) Message Sender Original Message Scrambled Message Scrambled Message Private Key sender Original Message Receiver Public Key sender Internet Digital Signature 9 © Prentice Hall, 2000 ❚ Digital Signature A digital signature is attached by a sender to a message encrypted in the receiver’s public key The receiver is the only one that can read the message and at the same time he is assured that the message was indeed sent by the sender Sender encrypts a message with her private key Any receiver with senders public key can read it Security Schemes (cont.) ❙ Analogous to handwritten signature 10 © Prentice Hall, 2000 ❚ Certificate Name : “Richard” key-Exchange Key : Signature Key : Serial # : 29483756 Other Data : 10236283025273 Expires : 6/18/96 Signed : CA’s Signature Security Schemes (cont.) ❙ Identifying the holder of a public key (Key- Exchange) ❙ Issued by a trusted certificate authority (CA) [...]... electronic payment systems „ Electronic payment system solution providers can offer various types of electronic payment systems to electronic stores and banks „ Electronic stores should select an appropriate set of electronic payment systems „ Banks need to develop cyberbank services to be compatible with the various electronic payment system „ Credit card brand companies need to develop an EC standard... Prentice Hall, 2000 Payee’s Bank Credit account Deposit check 30 Electronic Check Systems (cont.) „ Electronic Checkbook ƒ Counterpart of electronic wallet ƒ To be integrated with the accounting information system of business buyers and with the payment server of sellers ƒ To save the electronic invoice and receipt of payment in the buyers and sellers computers for future retrieval ƒ Example : SafeCheck... acquirer bank, and pays fee for the service This process is called a “capturing process” © Prentice Hall, 2000 13 Cardholder credit card Merchant Payment authorization, payment data Card Brand Company payment data account debit data payment data amount transfer Issuer Bank Acquirer Bank Cardholder Account Merchant Account Credit Card Procedure (offline and online) © Prentice Hall, 2000 14 Secure Electronic. .. in Hong Kong „ Multiple Currencies ƒ Can be used for cross border payments © Prentice Hall, 2000 28 Contactless IC Cards „ Proximity Card ƒ Used to access buildings and for paying in buses and other transportation systems ƒ Bus, subway and toll card in many cities „ Amplified Remote Sensing Card ƒ Good for a range of up to 100 feet, and can be used for tolling moving vehicles at gates ƒ Pay toll without... financial transactions ƒ EDI is a standardized way of exchanging messages between businesses ƒ EFT can be implemented using a Financial EDI system „ Safe Financial EDI needs to adopt a security scheme used for the SSL protocol „ Extranet encrypts the packets exchanged between senders and receivers using the public key cryptography © Prentice Hall, 2000 23 Electronic Cash and Micropayments „ Smart Cards ƒ The... Adding money to the card „ Payments in a new era of electronic shopping „ Paying on the Internet © Prentice Hall, 2000 25 Electronic Money „ DigiCash ƒ The analogy of paper money or coins ƒ Expensive, as each payment transaction must be reported to the bank and recorded ƒ Conflict with the role of central bank’s bill issuance ƒ Legally, DigiCash is not supposed to issue more than an electronic gift certificate... Bank Cyber Bank Payment Gateway Payment Gateway Bank VAN Bank Automated Clearinghouse VAN An Architecture of Electronic Fund Transfer on the Internet © Prentice Hall, 2000 21 Debit Cards „ A delivery vehicle of cash in an electronic form „ Mondex, VisaCash applied this approach „ Either anonymous or onymous „ CyberCash has commercialized a debit card named CyberCoin as a medium of micropayments on the... DB A/C DB payer’s bank © Prentice Hall, 2000 payee’s bank The Architecture of SafeCheck 32 Integrating Payment Methods „ Two potential consolidations: ƒ The on-line electronic check is merging with EFT ƒ The electronic check with a designated settlement date is merging with electronic credit cards „ Security First Network Bank (SFNB) ƒ First cyberbank ƒ Lower service charges to challenge the service... Customer y Customer x With Digital Wallets Certificate Authority Electronic Shopping Mall Merchant A Merchant B Payment Gateway Protocol X.25 Credit Card Brand Entities of SET Protocol in Cyber Shopping © Prentice Hall, 2000 19 SET Vs SSL Secure Electronic Transaction (SET) Secure Socket Layer (SSL) Complex Simple SET is tailored to the credit card payment to the merchants SSL is a protocol for generalpurpose... approval from the brand company The acquirer bank requests the issuer bank to pay for the credit amount The authorization of card issuance by the issuer bank, or its designated brand company, may require customer’s physical visit to an office The card can be in effect as the cardholder calls the bank for initiation and signs on the back of the card Upon the approval, the merchant requests payment to the . Prentice Hall, 2000 Chapter 8 Electronic Payment Systems and Security 1 2 © Prentice Hall, 2000 Learning Objectives ❚ Describe typical electronic payment systems for EC ❚ Identify the security requirements. 2000 Payments, Protocols and Related Issues ❚ SET Protocol is for Credit Card Payments ❚ Electronic Cash and Micropayments ❚ Electronic Fund Transfer on the Internet ❚ Stored Value Cards and Electronic. requirements for safe electronic payments ❚ Describe the typical security schemes used to meet the security requirements ❚ Identify the players and procedures of the electronic credit card