UNIT VIII

Electronic Payment System

E-commerce and electronic payment systems

The most popular definition of e-commerce is based on the online perspective of the
conducted business. E-commerce provides the capability of buying and selling products,
information and services on the Internet and other online environments. As for any trading
activity, the issue of safe and reliable money exchange between transacting parties is essential.
In an e-commerce environment, payments take the form of money exchange in an electronic
form, and are therefore called electronic payments. Electronic payments are an integral part of
e-commerce and are one of its most critical aspects. Generally defined, electronic payment is a
form of a financial exchange that takes place between the buyer and seller facilitated by means
of electronic communications.
The emergence of e-commerce has created new financial needs that in many cases cannot be
effectively fulfilled by the traditional payment systems. Recognizing this, virtually all
interested parties are exploring various types of electronic payment system and issues
surrounding electronic payment system and digital currency. As payment is an integral part of
mercantile process, electronic payment system is an integral part of e-commerce. Payment
represents both cash and non-cash financial transactions, which take place between two or
more parties. But, in a strict sense of word “payment” represents only non-financial
transaction. It is more common for two parties exchanging value to hold accounts with
alternative banks, in which both banks become the parties of payment.
Conventional vs. Electronic Payment System
To get into the depth of electronic payment process, it is better to understand the processing of
conventional or traditional payment system. A conventional process of payment and settlement
involves a buyer-to-seller transfer of cash or payment information (i.e., cheque and credit
cards). The actual settlement of payment takes place in the financial processing network. A
cash payment requires a buyer s withdrawals form his/her bank account, a transfer of cash to
the seller, and the seller s deposit of payment to his/her account. Non-cash payment7
mechanisms aresettled by adjusting i.e. crediting and debiting the appropriate accounts
between banks based on payment information conveyed via cheque or credit cards.
Limitations of traditional payment systems in the context of online payments Three
factors are stimulating the development of electronic payment systems: a) reduced
operational and payments processing costs,
b) growing online commerce and
c) decreasing the costs of technology
Reduction of costs is one of the major reasons for research and development of EPSs. The
central impetus for ecommerce and e-business is to provide a more efficient service, primarily
in terms of costs.
Some of the limitation of Traditional payment system
Lack of usability. Existing payment systems for the Internet require from the end user to
provide a large amount of information, or make payments using complex elaborated web site
interfaces. E.g. credit card payments via a web site are not the easiest way to pay, as these
require entering extensive amounts of personal data and contact details in a web form,
(Kalakota & Whinston, 1997).
Lack of security. Existing payment systems for the Internet are an easy target for stealing
money and personal information. Customers have to provide credit card or payment account
details and other personal information online. This data is sometimes transmitted in an un-
secured way, (Kalakota & Whinston, 1997). In practice this happens even in spite of
introduction of secure transactions mechanisms, such as Secured Socket Layer. Providing
these details by mail or over the telephone also entails security risks, (Guttmann, 2003;
Laudon & Traver, 2002).
Lack of trust. Users tend not to trust existing systems with the long history of fraud, misuse
or low reliability, as well as novel systems without established positive reputation. In the
present situation, money loss by customers is quite possible when using existing payment
systems, such as credit cards, for Internet payments. Potential customers often mention this
risk as the key reason why they do not trust a payment service and therefore do not make
Internet purchases, (Lietaer, 2002).
Lack of applicability. Not all web sites support a particular payment method, thus limiting
customers’ ability to pay. Credit cards work only with merchants who have signed-up to the
services of the corresponding credit card company, and do not support direct business-to-
business or interpersonal payments.
Lack of eligibility. Not every potential customer with money and intention to pay can make
use of certain payment methods. Not all potential buyers can obtain credit cards due to credit
history limitations, low income or other reasons.
Lack of efficiency. Some payments over the Internet can be too small to be handled by
existing payment systems, because of overheads included in the processing of payments and
transaction. Credit cards are too expensive for effecting small payments and are unsuited for
small transactions. The minimum fixed fee charged to the retailer for processing a transaction
could even surpass the value of the goods sold, (Guttmann, 2003).
High usage costs for customers and merchants. Existing payment systems use a rather
expensive infrastructure to facilitate the payment process. Credit cards are very expensive for
end users, not in the least because of the enormous and growing size of fraud, which amounts

2|Page RegBhandarie-COMMERCE
to billions dollars per year. This loss is invisibly refinanced by users by the higher costs of
credit card services. In addition, credit card payments are still heavily paper-dependent. Most
credit card bills are sent in a paper form to customers by post, and the bills are mostly settled
by posting paper documents.

Size of Electronic Payments

Electronic payment system is conducted in different e-commerce categories such as Business-
to-Business (B2B), Business-to-Consumer (B2C), Consumer-to-Business (C2B) and
Consumer-to-Consumer (C2C). Each of which has special characteristics that depend on the
value of order. Danial, (2002) classified electronic payment systems as follows:
Micro Payment (less than $ 10) that is mainly conducted in C2C and B2C ecommerce.
Consumer Payment that has a value between $ 10 and $ 500. It is conducted mainly in B2C
transactions.
Business Payment that has the value more than $ 500. it is conducted mainly in B2B e-
commerce .
Process of Electronic Payment System
Electronic payment systems have been in operations since 1960s and have been expanding
rapidly as well as growing in complexity. After the development of conventional payment
system, EFT (Electronic Fund Transfer) based payment system came into existence. It was
first electronic based payment system, which does not depend on a central processing
intermediary. An electronic fund transfer is a financial application of EDI (Electronic Data
Interchange), which sends credit card numbers or electronic cheques via secured private
networks between banks and major corporations. To use EFT to clear payments and settle
accounts, an online payment service will need to add capabilities to process orders, accounts
and receipts. But a landmark came in this direction with the development of digital currency.
The nature of digital currency or electronic money mirrors that of paper money as a means of
payment. As such, digital currency payment systems have the same advantages as paper
currency payment, namely anonymity and convenience. As in other electronic payment
systems (i.e. EFT based and intermediary based) here too security during the transaction and
storage is a concern, although from the different perspective, for digital currency systems
double spending, counterfeiting, and storage become critical issues whereas eavesdropping
and the issue of liability (when charges are made without authorizations) is important for the
notational funds transfer. Given Figure shows digital currency based payment system.
In this figure, it is shown that intermediary acts as an electronic bank, which converts outside
money (e.g. Rupees or US $), into inside money (e.g. tokens or e-cash), which is circulated
within online markets. However, as a private monetary system, digital currency has wide
ranging impact11 on money and monetary system with implications extending far beyond more
transactional efficiency.

Types of payment

Payment system can be broadly categorized into two types.

3|Page RegBhandarie-COMMERCE
a) Traditional means of payment such as cash and cheque.

i) Cash payment and its features

Cash is a legal tender defined by a national authority to represent value. Cash is most common
form of payment in terms of number of transactions. Cash is instantly convertible into other
forms of value without intermediation of any kind. It is portable, requires no authentication,
and provides instant purchasing power. It is “Free” (no transaction fee), anonymous, low
cognitive demands. Cash is a king of payment till now. It’s limitations is that easily stolen,
limited to smaller transaction.

ii) Check and its features

Check is funds transferred directly via a signed draft or check from a consumer’s checking
account to a merchant or other individual. Check is most common form of payment in terms of
amount spent. It can be used for both small and large transactions. Check is not anonymous,
require third-party intervention (banks). Check has Introduced security risks for merchants
(forgeries, stopped payments), so authentication typically required.

b) Electronic payment system uses different types of payment system such as credit card,
stored value cards( debit, smart and prepaid), e-cash and e-check etc. These are also
know as online electronic commerce payment system.

i. Debit card:
Debit card is a plastic card which provides a alternative payment method to cash when making
purchases. Functionally, it can be called an electronic check, as the funds are withdrawn
directly from either the bank account, or from the remaining balance on the card. Immediately
debit a checking or other demand-deposit account. By name, debit means the amount is
debited immediately from your account once the payment is done. It is also known as BANK
CARD or CHECK CARD. Debit cards can also allow for instant withdrawal of cash, acting as
the ATM card for withdrawing cash and as a cheque guarantee card. Merchants can also offer
"cashback"/"cashout" facilities to customers, where a customer can withdraw cash along with
their purchase.
Features of debit card
• It is used instead of a check to make purchases, anywhere Visa is accepted
• It is used instead of a credit card to pay bills such as utilities, insurance and car payments
• Point-of-sale funds are drawn from primary checking account
• PIN-system security
• Change your PIN at any Merchants Bank branch

4|Page RegBhandarie-COMMERCE
ii. Smart card:

A smart card is a plastic card with an embedded microchip(integrated circuit chip) containing
information about you. A smart card can store about 100 times the amount of information that
a magnetic strip plastic card can store. A smart card contains private user information, such as
financial facts, private encryption keys, account information, credit card numbers, health
insurance information, etc. A smart card provides persistent, protected storage of data. It’s
memory capacity (4K - 32K is typical). It has computational capability and Processing power
(a small CPU). IT is Self-contained means doesn’t need to depend on potentially vulnerable
external resources
Today, smart cards are used by millions of cardholders worldwide and are at work in more
than 90 countries, primarily in Europe and the Far East, processing point-ofsale
transactions, managing records, and protecting computers and secure
facilities.

Uses of smart card

Smart card is used in different applications which require strong
security protection and authentication such as Identification card,
Medical card and Credit/debit bank card (as an electric wallet).
All require sensitive data to be stored on the card, such as:
• biometrics information
• personal medical history
• cryptographic keys for authentication
• Logging on to networks
Wirelessly smart card is public transport payments (tickets) etc.

Contact Vs Contactless smart card

5|Page RegBhandarie-COMMERCE
 CONTACT: CONTACTLESS:

Cards the size of a conventional credit or Cards containing an embedded antenna

debit card with a single embedded integrated instead of contact pads attached to the chip
circuit chip that contains just memory or for reading and writing information contained
memory plus a microprocessor. in the chip's memory.

Popular Uses: Popular Uses:

Network security, vending, meal plans, Student identification, electronic passport,
loyalty, electronic cash, government IDs, vending, parking, tolls, IDs
campus IDs, e-commerce, health cards

Mondex Smart Card is the one of the popular example of smart card, Holds and dispenses
electronic cash (Smart-card based, stored-value card). It was developed by MasterCard
International. It requires specific card reader, called Mondex terminal, for merchant or
customer to use card over Internet. It supports micropayments and works both online and off-
line at stores or over the telephone

iii. E-cash
Electronic cash is a consumer-oriented electronic payment. Though it replaces the cash but still
cash is quite dominant form of payment for three reasons:
1. Lack of trust in banking system
2. Inefficient clearing and settlement of non-cash transaction
3. Negative real interest rates paid on bank deposit
Advantages of cash over credit cards
• It is negotiable
• Cash is a legal tender
• Cash is a bearer instrument
• It need require bank account to operate
• No risk on the part of acceptor that the medium of exchange may not be good

Properties of e-cash
E-cash must have following four properties:
Monetary values:
Interoperability
Retrievability

6|Page RegBhandarie-COMMERCE
Security E-cash
in Action
• E-cash based on cryptographic systems called “digital signature”
• This method involves pair of two numeric keys (very large number or integer) that work in
tandem (cycle): one for encoding and another for decoding.
• Message encoded with one numeric key can only be decoded with other numeric key and
none other.
• The encoding key is kept private while the decoding key is made public.
iv. E-checks
• E-checks are another form of electronic tokens.
• A new electronic version of paper check. E-check is an instruction to a financial institution to
pay a given amount of money to the payee.
• It is a specially formatted email message sent over the Internet. It contains as the same
information as on paper based check.
• Check service providers
PayByCheck (http://www.paybycheck.com)
CyberSource (http://cybersource.com)
Transaction Payment Sequence in E-check system

v. Credit cards-based e-payment system

Credit Cards
A credit card is a small plastic card issued to users dealing in e-commerce. Most credit cards
are the same shape and size, as specified by the ISO 7810 standard. A credit card is different
to a debit card in that it does not remove money from the user's account after every
transaction. In the case of credit cards, the issuer lends money to the consumer (or the user) to
be paid to the merchant.
Credit cards-based e-payment system : Customers who purchase any goods send their
credit card details to the service provider involved and the credit card organization will
handle this payment.
Online credit card payment has following categories:
1. Payment using plain credit card details
2. Payments using encrypted credit card details 3. Payment using third-
party verification Entities involved in Credit card Transaction

7|Page RegBhandarie-COMMERCE
Consumer (Buyer or Card holder)
Merchant (Seller)
Card Issuer (Consumers’ Bank)
Acquirer or Principal (Merchant’s Bank)
Card Association (Visa, Master Card etc)
Third party processor
How an Online Credit Transaction Works

Encryption and Credit cards

Encryption process starts when credit card information is entered into a browser and sent
securely over network between buyer to seller.
Encryption process includes following steps:
1. Customer presents his credit card information securely to merchant.
2. Merchant validates the authenticity of card holder
3. Merchant relays this information to its bank or on-line card processor.
4. The bank relays the information to customer’s bank for authorization approval 5. The
customer’s bank returns
the credit card , charge
authentication and
authorization to the
merchant Processing
Payment with
Encrypted

8|Page RegBhandarie-COMMERCE
Third-party authorization and Credit cards
In third party processing, consumer register with third party on the internet to verify
emicrotransaction. The companies providing third party payment service on internet are:
• http://www.fv.com ( First
Virtual)
• http://www.openmarket.com
• http://www.2checkout.com/
• http://www.paypal.com/
Payment can be made by credit card via clearing house.
Online Third-Party Processor (OTPPs) has following steps for buying information online.
1. Consumer registers for an OTPP a/c that is backed by credit card.
2. To purchase customer request merchant by her OTPP account no.
3. Merchant then contact the OTPP payment server with customer’s account no.
4. OTPP payment server verifies the customer’s account no. for vender (merchant) & checks
for sufficient funds.
5. OTPP server send a message to buyer that can be responded back by buyer as ; yes/agree;
No/disagree; fraud.
6. If OTPP gets ‘Yes’ from customer, merchant is informed & then customer is allowed to
download material.
Online Payment Processing using a Third-party Processor

Risk in using Credit cards

• Customer uses a stolen card or account number to fraudulently purchase goods or service
online.
• Many people who will be on the Internet have not even had their first Web experience.

9|Page RegBhandarie-COMMERCE
• Hackers find the ways into an e-commerce merchant’s payment processing system and then
issue credits to hacker card account numbers.
• Many users are also likely to be younger and have less access to credit and debit cards
• Many purchases they make will be micropayments.
• Credit cards cannot be used for large sums of B2B transactions
• Customer falsely claims that he or she did not receive a shipment
Limitations of Online Credit Card Payment Systems
• Security – neither merchant nor consumer can be fully authenticated.
• Cost – for merchants, around 3.5% of purchase price plus transaction fee of 20-30 cents per
transaction.
• People living in rural areas don’t have same access to computers and Internet that others do.
• Social equity – many people do not have access to credit cards (young and old age), disabled,
individuals who are not computer savvy and individuals who cannot afford cards ( poor credit
risk).

10 | P a g e RegBhandarie-COMMERCE
11 | P a g e RegBhandarie-COMMERCE
Advantages of E-Payment a) Increase payment efficiency
– Reduce transaction costs
– Enable trade in goods and services of very low value
b) Increase convenience of making payments
– Payment can be made swiftly and remotely using various devices
c) Can be used for
– e-commerce / e-Trade
– For other purposes like paying bills, taxes, etc

Design of E-payment system

 Despite cost and efficiency, hurdles remain to the spread of E-payment systems. These
includes several factors, many non-technical in natures, that must addressed before any
new payment method can be successful:
 A) Privacy: A user expects to trust in a secure systems, just as the telephone is a safe
and private medium free of wiretape and hackers, e-communication must merits equal
trust.
 Security: A secure system verifies the identity of two-party transaction through “user
authetication” and reserve flexibility to restrict inforation/services through access
controls. Tomorrow’s bank robbery will need no gateway cars- just computer
terminals.
 Intuitive Interface: The payment Interface must be easy to use as a telephone.
Generally speaking, users value conveniences more than any things.

12 | P a g e RegBhandarie-COMMERCE
  Database Integration: With home banking, for example, a customer wants to play with
all his accounts. To date, separate account have been stored in separate database. The
challenge before banks is to tie these databases together and to allow customers access
to any of them while keeping the data up-to-date and error free.
 Pricing: One fundamental issue is how to price payment system. For example, should
subsidies be used to encourage users to shift from one form of payment to another
form, from cash to bank payments, from paper-based to e-cash. The problem with
subsidies is the potential waste of resources, as money be invested in the system that
will not be used.
 Standards: Without standars, the welding of different payment users into differnet
networks and different system is impossible. Standards enables interoperability, giving
users the ability to buy and receives information, regardless of which bank isn
managing their monye.
 None of these hurdles are insurmountable. Most will be jumped within the next few
years. These technical problems, experts hopes, will be solved as technology is
improved and experience is gained. The question concerns how customers will take to
a paperless and (if not cashless) less-cash world. Nepal: State of the e payment First
results:
A real need of e e—payment mechanisms
 Interest in developing Nepal payment -Priority sectors:
 Tourism
 Banks
 Utility services
 Export
 IT Industry
Key facts
 e--payment systems are at earlier stage of development in Nepal
 E-commerce activity is concentrated in urban areas and tourism, banks and retails are
the sectors where it is developed
 E-commerce companies such as «are offering e-payment services
 Domestic trade: methods of payment are cash on delivery, credit direct payment
through internet bank account .
 Market for national transfers
 Products: money orders, pension transfers and student grants
 Positive reactions to the development of services
 Market for international transfers (inward)--High interest in money transfer from the
expatriate community
 Transfers of funds to relatives
 The pioneer of money transfer, the Western Union and others are developing
theirs networks. Banking started in Nepal in 1937 by ‘Nepal
Bank Limited’ (Government
Key facts on banking sectors
Sector)
History of e-Banking in Nepal Evolution
of Banking Evolution of Joint Venture (JV) Banks
and e-Banking Establishment of first

13 | P a g e RegBhandarie-COMMERCE
Joint Venture Bank, Nepal Arab Bank Internet-Banking was first
Limited introduced by Kumari Bank Limited in
2002.
(now NABIL Bank), in 1984
Laxmi Bank Limited was the first bank
Introduction of Credit Cards in to introduce SMS-Banking (or Mobile
Nepal in early 1990 (by NABIL Bank) Banking) in Nepal in the year 2004.
Automated Teller Machine (ATM) was
first introduced by another JV Bank, Third party payment service
Himalayan Bank Ltd. In 1995. providers: e-Sewa.com.np
Paybill.com.np Payway.com.n
Himalayan Bank Limited was also the www.ipay.com.np
first bank to introduce TeleBanking
(Telephone Banking) in Nepal. Barriers in E-payment
 Legal and Infrastructure Issues
Evolution of Private Sector Banks and e-  Financial Issues  Economic
Banking Issues
Kumari Bank Limited was established in  Culture issues
the year 2001.
Communities Expectation
 At Government level
Legal and Infrastructure Issues  At Associations level
 Cyber laws : Lack of bylaws on  At Business Community
ETA (Electronic transaction act),
 PKI(Public Key Infrastructure) Economical Issues
:Certification Authority made Market issues
operational
 Real needs of potential users not yet
 Infrastructure : Insufficiency at all
analyzed
levels (access, effective
connections and solutions,  Market with highest potential not
security systems) clearly identified
Market identified
Financial issues
Financial  Undeveloped environment for
investors
 Limitation for transfer abroad in
 Lack of incentives including tax
terms of amount and in terms of
Exemption
administrative procedures
 Complicated financial administrative
 Low access for users to information
procedures related to international
available and effective
payment mechanism
Financial Institutions
Cultural Issues
 Lack of an effective network Culture
banking system
 Lack of unpredictability of the  Culture of cash payment.
«rules of the game>>  Little confidence in e--payment on
Internet as an alternative methods of
payment
Communication

14 | P a g e RegBhandarie-COMMERCE
  Lack of synchronized approach

15 | P a g e RegBhandarie-COMMERCE
Government expects: Government expects that government initiatives are clearly understood
and shared by the business community in the setting up of a legal environment for e-
commerce transaction.
- To have the support of the business community
- To learn of experiences of other
- That donors private sectors will react positively on will initiatives

Associations want: Associations wan to be involved in the process of formulation of policies,

regulations, and Implementation on e-payment. And association wants to be involved in the
training on e-payment technology for IT professionals.

Business Community expects support of government incentives on e-business and e-

payment extension information and incentives facilitation on abroad money transfer
mechanism.
In summary, There is a real interest to develop an effective e-payment gateway BUT Nepal
has to solve important e-payment issues.
Tasks to be done from gov level: Top priorities for the government are:

• To create an effective legal environment for e-commerce transactions and epayment

mechanisms
• To act as facilitator for e-payment systems
• To create the conditions for infrastructure development
• To have a coordinated approach in finding funds for developing e-payment systems
Business communities sides: Top priorities for the business community are:

• To initiate and lead of commercial ventures in the area of payments

• To assess correctly the market and focus on the highest potential users
• To trust and join in government development efforts
• An effective infrastructure must be in place

16 | P a g e RegBhandarie-COMMERCE
Information Security

Information security means protecting information and information systems from

unauthorized access, use, modification, or destruction. The terms information security,
computer security and information assurance are frequently used interchangeably. These
fields are interrelated and share the common goals of protecting the confidentiality, integrity
and availability of information.

With the introduction of the computer, the need for automated tools for protecting the files
and other information stored on the computer became evident. This is especially the case for a
shared system as like internet. Thus, computer security is the generic name for the collection
of tools designed to protect data and to prevent hackers.

Goals of Information Security

 Confidentiality: Confidentiality is the concealment of information or resources.

Cryptography can be the better choice for maintaining the privacy of information,
which traditionally is used to protect the secret messages. Similarly, privacy of
resources, i.e. resource hiding can be maintained by using proper firewalls.
Confidentiality is sometimes called secrecy or privacy.

 Data Integrity: Integrity service address the issues of unauthorized or accidental

modification of data. This includes data insertion, deletion, and modification. When the
receiver receives the data S/he has to absolutely certain that the data has not been
modified in any way, intentionally or accidently during its transmission. A System
must be able to detect the data modification. The receiver of the data should be able to
verify that the data has not been altered using any cryptographic mechanism.

 Non-repudiation: It is a service which prevents an entity from denying previous

commitments and actions. When disputes arise due to any entity denying that certain
actions were taken, a means to resolver the situation is necessary, for example, one
entity may authorized the purchase of property by another entity and later deny that
such authorization was granted.

 Authorization: This service establish the validity of a transmission, message and its
originator.

Security threats and attack

• Data on PC and Palm devices
• Data on server

17 | P a g e RegBhandarie-COMMERCE
A threat to a computing system is a circumstance that has a potential to cause loss or harm.
It is potential violation of security means that is possible danger that might exploit
vulnerability.

Attack is an assault on system security that derives from intelligent threat i.e. attack is an
intelligent act that is an intentional attempt to evade security services and violet the security
policy of a system.

Attack can be classified into two types

a) Active attack: The attacker is actively involved in deleting, adding, modifying data. For
example Alice sends a message to Bob saying: ‘meet me today at 5pm’ Carl intercepts
the message and modify it as, ‘meet me tomorrow at 5pm’ and sends it to Bob.

b) Passive Threats: The attacker does not modify the data but only monitors the
communication. For example listen to communication between Alice and Bob, and if it
is encrypted try to decrypt it.

CLIENT – SERVER NETWORK SECURITY

E-commerce (electronic commerce or EC) is the buying and selling of goods and services on
the Internet.
The security concerns in e – commerce can be divided into two categories:
1. Client-Server Security
2. Data and Transaction Security

Client/server describes the relationship between two computer programs in which one
program, the client, makes a service request from another program, the server, which fulfills
the request.

Client–server model of computing is a distributed application structure that partitions tasks or

workloads between service providers, called servers, and service requesters, called clients.

Client devices are typically PCs with network software applications installed that request and
receive information over the network.
A server device typically stores files and databases including more complex applications like
Web sites.

18 | P a g e RegBhandarie-COMMERCE
Client-Server Applications
 A client computer and a server computer are usually two separate devices, each
customized for their designed purpose.
 Clients make requests to a server by sending messages, and servers respond to their
clients by acting on each request and returning results.
 One server generally supports numerous clients.

Client/server computing comprises three building blocks:

1. The client
2. The server
3. The network

Client-Server Network Security

• The distribution of services in client/ server increases the susceptibility of these systems
to damage from viruses, fraud, physical damage and misuse than in any centralised
computer system.
• The cost and inconvenience (to the users) associated with security must be balanced
against the cost and inconvenience of corrupted or insecure data.

19 | P a g e RegBhandarie-COMMERCE
Client-Server Network Security Problems
There are four major security problems in client-server network:
1. Physical Security Holes
2. Software Security Holes
3. Inconsistent Usage Holes
4. Choosing a suitable security philosophy and maintaining it

1. Physical Security Holes

 where the potential problem is caused by giving unauthorised persons physical access to
the machine
 where this might allow them to perform things that they shouldn't be able to do.

2. Software Security Holes

 Where the problem is caused by badly written programs or "privileged"
software which can be compromised into doing things which they shouldn't
ought to.

3. Incompatible Usage Security Holes

 where the problem is caused through lack of experience, or no fault of system manager’s
own
 Here, the System Manager assembles a combination of hardware and software which
when used as a system is seriously flawed from a security point of view

4. Choosing a suitable security philosophy and maintaining it

• The fourth kind of security problem is one of perception and understanding
• Perfect software, protected hardware, and compatible components don't work unless you
have selected an appropriate security policy and turned on the parts of your system that
enforce it

Some of the protection methods are:

1. Trust-based security
2. Security through obscurity
3. Password schemes
4. Biometric system

1. Trust-based security:
• Trust everyone and do nothing extra for protection.
• Not to provide access restrictions of any kind.
• Assumes that no one ever makes and expensive breaches such as getting root access and
deleting all files.
• Today, this is no longer the case.

20 | P a g e RegBhandarie-COMMERCE
 2. Security through obscurity (STO)
 The notion that any network can be secure as long as nobody outside its management
group is allowed to find out anything about its operational details and users are provided
information on a need basis.
 Hiding account passwords in files or scripts.
 The presumption that “nobody will ever password” (somewhat like hiding the house key
under the doormat and telling only family and friends).
 Mean lifelong trust of a small group of people.
 Knowledge goes with employee.
 Ok in operating systems such as IBM MVS of CMS and DEC VAX.
 Networking necessitates greater need for detail of how the system works, rendering STO
less effective.

3. Password Schemes

 A first-level barrier to accidental intrusion.

 Deliberate attack when common words or proper names are selected as passwords.
 Most used hacking method is dictionary comparison.
 This scheme often works because users tend to choose relatively simple or familiar words
as passwords.
 Passwords in a remote log in session usually pass over the network in unencrypted form;
any eavesdropper on the network can simply record the password any time it is used.
 Suggested for creating one-time passwords, including smart cards, randomized tokens,
and challenges-response schemes.
 These devices use one-key symmetric cryptographic algorithms or two-key algorithms
with public and private keys.

4. Biometric Systems
 The most secure level of authorization involves some unique aspects of a person’s body.
 Based on comparisons on fingerprints, palm prints, retinal patterns, or on signatures
verification or voice recognition.
 Expensive and system takes 10 to 30 seconds to verify an access request.
 Users see such systems as unduly intrusive; people are reluctant to stick a finger or a hand
into a slot, or sign their name, or still while an optical system scans their eyeball.
 Now such systems recognize keyboard-typing patterns or read infrared facial pattern.

Emerging Client-Server Security Threats

1. Software Agents and Malicious Code Threat
2. Threats to Server

Software Agents and Malicious Code Threats

21 | P a g e RegBhandarie-COMMERCE
 The major threats to security is from clients software results because of the nature of the
Internet. Client programs interpret data downloaded from arbitrary servers on the internet.
clients threats mostly arise from malicious code.
Virus
• Code segment that replicate by attaching copies of itself to existing executable(.exe
files).
• It is because users executes host program.
Trojan horse
• It is a program that perform a desired task but also includes unexpected function.
• It deletes or modifies users files.
Worm
• Self replicating program that is self-contained and does not require a host program.
• It utilizes network services to propagate to other host systems

Threats to Servers

Examples are:
• Hackers have potentials access with security holes are particularly vulnerable.
• Hackers could use a password guessing program in which multiple computer systems are
used simultaneously for comparison purposes.
• Hackers can use electronic eavesdropping to trap user names and unencrypted passwords
sent over network.

Servers can also be attacked with threats such as denial of services. The two most
common forms are: Service overloading:
•
One can easily overload a WWW server by writing a small loop that sends requests
continually for a particular file .i.e. an infinite loop.
Message overloading:
• Occurs when someone sends a very large file to a message box every minutes.
• Occupy all the space on the disk and causing disk crash.
• It can be avoid by separating areas for different programs.

Method Definition

Virus Secret instructions inserted into programs (or data) that are innocently ordinary tasks.
The secret instructions may destroy or alter data as well as spread within or between
computer systems
Worm A program that replicates itself and penetrates a valid computer system. It may spread
within a network, penetrating all connected computers.

22 | P a g e RegBhandarie-COMMERCE
Trojan horse An illegal program, contained within another program, that ‘’sleep' until some
specific event occurs then triggers the illegal program to be activated and cause
damage.
Salami slicing A program designed to siphon off small amounts of money from a number of larger
transactions, so the quantity taken is not readily apparent.

Super zapping A method of using a utility ‘’zap’’ program that can bypass controls to modify
programs or data
Trap door A technique that allows for breaking into a program code, making it possible to insert
additional instructions.
Logic bomb An instruction that triggers a delayed malicious act

Denial of Too many requests for service, which crashes the site
services

Sniffer A program that searches for passwords or content in packet of data as they pass through
the Internet
Spoofing Faking an e-mail address or web-page to trick users to provide information instructions

Password A password that tries to guess passwords (can be very successful)

cracker

War dialling Programs that automatically dial thousands of telephone numbers in an attempt to
identify one authorized to make a connection with a modem, then one can use that
connection to break into databases and systems

Back doors Invaders to a system create several entry points, even if you discover and close one,
they can still get in through others

Malicious Small Java programs that misuse your computer resource, modify your file, send fake
applets e-mail, etc

Introduction to cryptography

Cryptography is the science of using mathematical tools and techniques to encrypt and
decrypt the data. A cryptographic algorithm s a mathematical function used in the
encryption and decryption process.

23 | P a g e RegBhandarie-COMMERCE
There are generally two approaches to securing communication occurring between different
partners. These two approaches are the conventional cryptography and public key
cryptography along with the setup of public key Infrastructure.

Data that can be read and understand without any special measures is called plaintext. The
method of distinguishing plaintext in such a way as to hide its substances and meaning is
called Encryption. After encryption, the plaintext turns into an unreadable gibberish called
cipher text. The process of reverting the cipher text back to the plaintext is called decryption.

Specially, Encryption algorithm is used during encryption process and decryption algorithm is
used during decryption process.

Let M denotes the plaintext, C denotes the cipher text, E denotes the Encryption algorithm , D
denotes the Decryption algorithm. Then in mathematical notation, the process of encryption can
be written as:

E(M) = C
The process of decryption can be written as:
D(C) = M
Since the whole point of Encrypting and then Decrypting a message is to recover the original
plaintext, the following relationship must be true in all cases:
D(E(M))= M
Visually, all the above process can related by using the next figure:

There are generally two types of cryptographic techniques available using digital data. They are
as follows:
a) Conventional cryptography
b) Public Key cryptograph

a) Conventional Key cryptography

Conventional Key cryptography can be divide into two types one is “Restricted Algorithm”
cryptography and another is “symmetric key” cryptography.
24 | P a g e RegBhandarie-COMMERCE
i) Restricted Algorithm Cryptography
Restricted Algorithm Cryptography achieves its desired objectives of data security be hiding
the processor steps of the cryptographic algorithm used. In other words, if the algorithm is
compromised in any way, then all the data that was ever encrypted using that algorithm is
compromised as well. One of the simplest example of restricted algorithm cryptography is
known as the “Caeser’s cipher”. In this techniques the set of characters used for the
communication is substituted 3 places up the order. For example, if the set of characters used
during the communication was the English alphabets, then the substitution would be as
follows:
English Alphabet: ABCEDFGHIJKLMNOPQRSTUVWXYZ
After Substitution: DEFGHIJKLMNOPQRSTUVWXYZABC
Thus, if the message sent was “WAR”, then using the above substitution table, the message
would be encrypted as “ZDU”
Though Restricted algorithm is very easy to understand and it is very insure as well.

ii) Symmetric key cryptography:

Symmetric key cryptography is also known as conventional / private-key / single-key
cryptography. Symmetric key cryptography The sender and recipient share a common key in
Symmetric key cryptography. All classical encryption algorithms are private-key was only type
prior to invention of public-key in 1970’s and by far most widely used (still) is significantly
faster than public-key cryptography.

A simple symmetric key cryptography can be implemented by using XOR operation. A XOR
operation can be defined by the following truth table:
11=0
10=1
01=1
00=0
25 | P a g e RegBhandarie-COMMERCE
WAR 01010111 01000001 01010010
MAD 01001101 01000001 01000100
Cipher text 00011010 00000000 00010110
Key MAD 01001101 01000001 01000100
Plain text 01010111 01000001 01010010
WAR

Public-Key Cryptography
• probably most significant advance in the 3000 year history of cryptography
• uses two keys – a public & a private key
• asymmetric since parties are not equal
• uses clever application of number theoretic concepts to function
• complements rather than replaces private key crypto
Will now discuss the radically different public key systems, in which two keys are used.
Public-key cryptography provides a radical departure from all that has gone before. The
development of public-key cryptography is the greatest and perhaps the only true revolution
in the entire history of cryptography. It is asymmetric, involving the use of two separate
keys, in contrast to symmetric encryption, that uses only one key. Anyone knowing the
public key can encrypt messages or verify signatures, but cannot decrypt messages or create
signatures, counter-intuitive though this may seem. The use of two keys has profound
consequences in the areas of confidentiality, key distribution, and authentication. It works by
the clever use of number theory problems that are easy one way but hard the other. Note that
public key schemes are neither more nor less secure than private key (security depends on
the key size for both), nor do they replace private key schemes (they are too slow to do so),
rather they complement them. Both also have issues with key distribution, requiring the use
of some suitable protocol.

The concept of public-key cryptography evolved from an attempt to attack two of the most
difficult problems associated with symmetric encryption: key distribution and digital
signatures. The first problem is that of key distribution, which under symmetric encryption
requires either (1) that two communicants already share a key, which somehow has been
distributed to them; or (2) the use of a key distribution center. This seemed to negated the
very essence of cryptography: the ability to maintain total secrecy over your own
communication. The second was that of "digital signatures." If the use of cryptography was

26 | P a g e RegBhandarie-COMMERCE
to become widespread, not just in military situations but for commercial and private
purposes, then electronic messages and documents would need the equivalent of signatures
used in paper documents.

The idea of public key schemes, and the first practical scheme, which was for key
distribution only, was published in 1976 by Diffie & Hellman. The concept had been
previously described in a classified report in 1970 by James Ellis (UK CESG) - and
subsequently declassified [ELLI99]. Its interesting to note that they discovered RSA first,
then Diffie-Hellman, opposite to the order of public discovery! There is also a claim that the
NSA knew of the concept in the mid-60’s [SIMM93].

Fig: Public-Key Cryptography

Figure “Public-Key Cryptography”, shows that a public-key encryption scheme has six
ingredients:

• Plaintext: the readable message /data fed into the algorithm as input.

• Encryption algorithm: performs various transformations on the plaintext.

• Public and private keys: a pair of keys selected so that if one is used for encryption, the other
is used for decryption. The exact transformations performed by the algorithm depend on the
public or private key that is provided as input.

27 | P a g e RegBhandarie-COMMERCE
• Ciphertext: the scrambled message produced as output. It depends on the plaintext and the
key. For a given message, two different keys will produce two different ciphertexts.

Decryption algorithm: accepts the ciphertext and matching key and produces the original
plaintext.

Consider the following analogy using padlocked boxes: traditional schemes involve the
sender putting a message in a box and locking it, sending that to the receiver, and somehow
securely also sending them the key to unlock the box. The radical advance in public key
schemes was to turn this around, the receiver sends an unlocked box (their public key) to the
sender, who puts the message in the box and locks it (easy - and having locked it cannot get
at the message), and sends the locked box to the receiver who can unlock it (also easy),
having the (private) key. An attacker would have to pick the lock on the box (hard).

Difference between conventional vs public key encryption

Public key uses:

28 | P a g e RegBhandarie-COMMERCE
  can classify uses into 3 categories:

◦ encryption/decryption (provide secrecy)

◦ digital signatures (provide authentication)

◦ key exchange (of session keys) some algorithms are suitable

for all uses, others are specific to one

RSA

RSA is the best known, and by far the most widely used general public key encryption
algorithm, and was first published by Rivest, Shamir & Adleman of MIT in 1978
[RIVE78]. The Rivest-Shamir-Adleman (RSA) scheme has since that time reigned
supreme as the most widely accepted and implemented general-purpose approach to
public-key encryption. It is based on exponentiation in a finite (Galois) field over
integers modulo a prime, using large integers (eg. 1024 bits). Its security is due to the
cost of factoring large numbers.

Note: When information are in the transit then we have to use cryptography (encryption
and decryption) to make the information secure.

Firewall

In our common sense, the term "firewall" originally

meant, and still means, a fireproof wall intended to
prevent the spread of fire from one room or area of a
building to another.

In computer science, the term “firewall” is a kind of

gateway that restricts and controls the flow of traffic
between networks, typically between an internal
network and the Internet. It is inserted between your
network and the outside network to build up a
controlled link and an outer security wall.
29 | P a g e RegBhandarie-COMMERCE
 Characteristics of the firewall

• All the traffics between the inside and outside network must pass through and be
checked by the firewall.
• Only authorized traffics, as defined in the local security policy, are allowed to pass the
firewall.
• The firewall itself is immune to penetration.
Capabilities of the firewall

• A firewall should keeps unauthorized users out of the protected network, prohibits
potentially vulnerable services from entering or leaving the network, and provides
protection from various kinds of IP spoofing and routing attacks.
• A firewall should provide a location for monitoring, auditing and alarming security-
related events.
• A firewall should be a convenient platform for some Internet functions that are not
security related. These included a network address translator, which maps local address
to Internet address, and a network management function that audits or logs Internet
usage.

Types of firewall
Basically there are two types of firewall.
a)Firewall: Packet Filtering
b)Firewall: Application Gateway Packet Filtering firewall

 Packets that get passed through the intranet can be restricted based on the IP address and
the port number. All most all routers come with this function.

Advantages

 A low cost firewall can

be built using existing
routers  It is transparents
Disadvantages
• The security level is
relatively low
• It is difficult to
maintain

30 | P a g e RegBhandarie-COMMERCE
Application gateway firewall

For external communication, a machine that works as a firewall communications with the
target server on behalf of the client. Relay application are available for each services.
Without supporting applications, it will not relayed.

Advantages
• The security level is
relatively high
Disadvantages:
• The CPU is loaded
with processes b relay
application
• It is relatively costly

Fig: Application gateway

In computer networks, a proxy server is a server (a computer system or an application

program) which services the requests of its clients by forwarding requests to other servers. A
client connects to the proxy server, requesting some service, such as a file, connection, web
page, or other resource, available from a different server. The proxy server provides the
resource by connecting to the specified server and requesting the service on behalf of the
client. A proxy server may optionally alter the client's request or the server's response, and
sometimes it may serve the request without contacting the specified server. In this case, it
would 'cache' the first request to the remote server, so it could save the information for later,
and make everything as fast as possible.

Firewall functions
Access Restriction Function
 Packet Filtering
 Application Gateway Function
Other Security function
 User authentication
 Encryption
Other support function
 Logging
 Alert Function
 Monitoring

31 | P a g e RegBhandarie-COMMERCE
Firewall product: The product of firewall can be software and Hardware
Software
• Firewall -1 (Check Point)
• Safegate (Fujitsu)
• netGUARDIAN(netGuard)
• Mac OS Firewall
• MS-Windows Firewall, etc
Dedicated devices
• NetGAIA Security (Fujitsu) etc
• Netgean
• Juniper Firewall devices
• Cisso Router Firewall

Secured Socket Layer (SSL)

SSL was Originally developed by Netscape. SSL allows secure communications between
browser and a Web server. SSL Has become the accepted standard for Web security. The
rst version of SSL was never released. In 1994,Netscape created SSLv2 and In 1995,
SSLv3.

 The main role of SSL is to provide security for Web traffic (condentiality, message
integrity, and authentication)
 Achieves these elements of security through the use of Cryptography, Digital Signatures,
and Certicates.
 Cryptography (Condentiality) : Symmetric Cryptography and Asymmetric Cryptography
 Digital Signatures (To ensure message integrity) : each message exchanged in SSL has a
digital signature attached to it
 Certicates: Trusted third party

SSL Architecture

 SSL works in terms of

Session
Connection
The SSL Handshake Protocol
1. Authenticate the server to the client
2. Negotiation of common cryptographic
algorithms, that both server and client
support.
3. Authenticate the client to the server
(optional).
32 | P a g e RegBhandarie-COMMERCE
 4. Using public-key encryption to exchange cryptography parameters (shared secrets).
5. Establish an encrypted SSL connection.

SSL Change Cipher Spec Protocol

It is used in the last stage of the SSL Handshake protocol to let the parties know to move
from the pending state to the current state i.e. the parties finishes using the keyexchange
algorithm and moves on to use the encryption and MAC algorithms, which were defined in
the Handshake protocol. This message has one byte with content of ‘1’ and is encrypted and
compressed under the current CipherSpec.

SSL Alert protocol

It is responsible for informing errors that occur during connection.
There are two levels of alerts:
a fatal alert or
a warning alert.

SSL record protocol

SSL encapsulates all data into an object called a record; It consists of a header and data. The
header has information about the record and is transmitted before the record data.

Third party authentication

 Third party authentication is a server itself .i.e. authentication server.

 In this, the password or encryption key never travels over the network.
 The authentication server maintains obscure facts about each registered user.
 The user types in a user name and password directly to the external mechanism.
 But at log-on time, the server demands a entry of randomly chosen fact.
 Instead a token is computed from the along with other data.
 Then an encrypted message containing the token is transmitted which can be only
decoded with user key.
 Users can tell the authentication server with which remote computer they want to
converse with.
 For this, the server sends two encrypted token to the user.
 One for the user and another to send to the remote computer.
 User sends the second which is doubly encrypted to the remote computer after peeling off
the one layer of encryption

KERBEROS
 Kerberos is an encryption-based system that uses secret key encryption designed to
authenticate users and network connections.

33 | P a g e RegBhandarie-COMMERCE
 The assumption of Kerberos is that the distributed environment is made up of
unsecured workstations, moderately secure servers, and highly secure key
management machines.
 Kerberos provides a means of verifying the identities of requestor on a unprotected
network.
The goal is to accomplish security without relying on authentication by the host computer,
without basing trust on the IP addresses, without requiring physical security of all the hosts
on the network, and under the assumption that IP packets on the network can be read,
modified and inserted at will.

Authentication process
1. Client A sends request to Kerberos Authentication Server (KAS) requesting certificate
for a given server B.
2. KAS responds with:
 A ticket from the server which contains B’s Key.  A temporary encryption key
called session key.
3. A then sends the client’s identity and a copy of session key, both encrypted with B’s key
to B
4. 4. Now the session key is used to authenticate the client and used to authenticate server
in future transaction.

How about attacks from third party?

To verify the identity in a transaction, the client transmits the ticket to the server. This
information is encrypted in a session key and includes a timestamp. The timestamp proves that
the message was recently generated and is not a reply from some stored value.

Digital signature

A digital signature is a mathematical scheme for demonstrating the authenticity of a digital

message or document. A signature provides authentication of a message. A valid digital
signature gives a recipient reason to believe that the message was created by a known sender
and that it was not altered in transit. So, a digital signature is an authentication mechanism
that enables the creator of a message to attach a code that acts as a signature.

Digital signature scheme typically consists of three algorithm:

 A key generation algorithm

 A signing algorithm
 A signature verifying algorithm

34 | P a g e RegBhandarie-COMMERCE
Uses of digital signature

 Authentication and

 Integrity

Digital certificate

 A program embedded in a Web page that

◦ Verifies that the sender or Web site is who or what it claims to be

 Signed code or messages

◦ Provide proof that the holder is the person identified by the certificate

 Certification authority (CA)

◦ Issues digital certificates

Fig: Amazon.com’s Digital Certificate

35 | P a g e RegBhandarie-COMMERCE
Components of Digital certificate

Main elements
 Certificate owner’s identifying information
 Certificate owner’s public key
 Dates between which the certificate is valid
 Serial number of the certificate
 Name of the certificate issuer
 Digital signature of the certificate issuer

36 | P a g e RegBhandarie-COMMERCE