E-Commerce Security Systems - Study Notes

Chapter Summary

E-Commerce Security Systems are critical frameworks that protect online commercial activities from diverse electronic threats. Since the internet is an inherently open network, maintaining transaction security is paramount to prevent loss of revenue and preserve business reputation. Security mechanisms involve encryption technologies, digital authentication, and secure protocols to protect the confidentiality, integrity, and authenticity of user data.

Learning Objectives

• Understand the core principles and necessity of E-Commerce security frameworks.
• Identify and classify various accidental and intentional online security threats.
• Explore the essential dimensions of E-Commerce security including privacy, non-repudiation, and integrity.
• Compare symmetric and asymmetric key encryption mechanisms.
• Comprehend the functionalities of digital signatures, digital certificates, and validation authorities.
• Analyze secure communication protocols such as SSL, SET, and 3D Secure.

Key Concepts and Definitions

• E-Commerce Security: A set of protective guidelines and software protocols designed to secure digital transactions over computer networks.
• Phishing: A fraudulent attempt to acquire sensitive personal information like usernames, passwords, and credit card details by masquerading as a trustworthy entity.
• Symmetric Encryption: A cryptographic technique where a single shared key is used for both encrypting and decrypting data.
• Asymmetric Encryption: A cryptographic system that uses a public key for encryption and a private key for decryption, ensuring authenticity and confidentiality.
• Digital Certificate: A verified electronic document that uses a digital signature to bind a public key with an individual's or organization's identity.
• Digital Signature: A mathematical technique used to validate the authenticity and integrity of a digital message, document, or transaction.
• SSL (Secure Sockets Layer): A secure protocol designed to establish an encrypted link between a client and a web server, protecting data transmission over the internet.
• SET (Secure Electronic Transaction): A secure protocol developed to protect credit card transactions specifically during online shopping.

Worked Methods

1. The SSL / HTTPS Secure Connection Process

The secure connection between a browser and a server works in steps:

• Establish Connection: The browser contacts the secure website.
• Certificate Verification: The server responds with its digital certificate and public key.
• Session Key Creation: The browser generates a unique symmetric session key and encrypts it with the server's public key.
• Key Exchange: The server decrypts the session key using its secret private key, establishing a shared symmetric key on both ends.
• Encrypted Session: Data is encrypted and transmitted securely using the shared key.

2. Diffie-Hellman Key Exchange Analogy

This method allows two parties to create a shared secret key without sending the key itself over the network:

• Both parties publicly agree on a starting value (e.g., a base color).
• Each selects a private secret (a secret color) and mixes it with the base value.
• They swap their mixtures, keeping their individual secret values private.
• Each adds their own secret to the received mixture, producing an identical final key (e.g., a final secret color) that an observer cannot easily calculate.

Common Exam Traps

• Symmetric vs. Asymmetric Keys: Symmetric uses the same key for both encryption and decryption, whereas Asymmetric uses distinct public and private keys.
• Digital Signatures vs. Digital Certificates: Certificates confirm the sender's identity, while signatures guarantee that the data has not been modified.
• Phishing vs. Technical Attacks: Phishing relies on user deception to steal secrets, whereas hacking exploit system vulnerabilities.
• SSL vs. SET: SSL is used to secure all general web traffic, while SET is specialized solely for payment card networks.

Exam Tips

• Memorize the core dimensions of security like confidentiality, integrity, non-repudiation, and authenticity.
• Remember that HTTPS uses the Secure Sockets Layer to protect data transmissions, indicated by a green padlock in the browser address bar.
• Study the three domains of the 3D Secure protocol: Acquirer, Issuer, and Interoperability.