Chapter 3 Mohammad Fozlul Haque Bhuiyan Assistant Professor

Chapter 3 Mohammad Fozlul Haque Bhuiyan Assistant Professor CITI Jahangirnagar University

Security Issues in E-commerce A computer system composing of bare hardware and an OS responsible for safe guarding its data and applications resident in primary and secondary storage, proper management of other resources and establishing connection to other computer systems via the network. When the system is not hooked to the outside world, the computer system is only vulnerable to its bad users who abuse it with bad applications like virus, Trojan horses, etc. However, when it is open to outside world through networking, this becomes a major threat to the system. v Security Issues v Is E-commerce Secure? v Cryptography v Web security

v Security Issues q Operating System Security q Network Security q Internet Security q Middleware Security q Database Security q Others Fields of Computer System security

q. Operating System Security The security models are classified into two major groups: • Mandatory security model: – Control the access to information by individuals on the basis of classification of subjects (active element) and objects (data). Bell Lapadula model, Biba model, and Dion model. • Discretionary security model: – Control user access on the basis of user identity and some rules guiding what type of access relationship can be established between the user (subject) and object. Access matrix model, take-grant model, ant action entity model. • Lattice model: – Based on flow control

q. Operating System Security

q. Network Security

q. Network Security (Cont…) Ø As the network makes a computer system open to the world, communication becomes easy with the outside world at the cost of security. One of the major successes in tackling the distributed system security problem is Kerberos. Ø Kerberos uses encryption to enable secure communication. To be able to connect to the computers, users have to use programs that can use Kerberos. In order to authenticate to Kerberos, one needs to get ‘tickets’. Ø A ticket grants the user the right to use a service, such as accessing his/her files. A ‘ticket granting ticket’ is a ticket used to get other tickets.

q. Internet Security

q. Middleware Security • OSF’s DCE • OMG’s CORBA

q. Database Security Figure: Distributed Database Model

q. Other Fields of Computer System Security • E-cash

v. Is E-commerce Secure ? When viewing digital information from the network perspective, information security contains the following characteristics: § Confidentiality or message transmission security. § Integrity of data content § Authentication of sender and receiver § Non-repudiation by the sender and receiver § Anonymity or secrecy § Availability

v Cryptography q Single Key (Symmetric) Cryptography q Public Key (Asymmetric) Cryptography q Digital Signature q Certification Authority q Digital Certificates

q. Single Key (Symmetric) Cryptography

q. Public Key (Asymmetric) Cryptography

q. Public Key (Asymmetric) Cryptography (Cont. . )

q. Certification Authority

q. Digital Certificate The digital certificate is basically the digitally signed triple: • Identity of user • Public key of user • Other attributes

q. Digital Certificate (cont. . ) In addition to the signature, the public key certificate contains the following items: • • • version serial. Number signature Issuer validity • • subject. Public. Key. Info issuer. Uniqueidentifier extensions

Digital Signatures What is Digital Signature? • Hash value of a message when encrypted with the private key of a person is his digital signature on that e-Document –Digital Signature of a person therefore varies from document to document thus ensuring authenticity of each word of that document. –As the public key of the signer is known, anybody can verify the message and the digital signature Why Digital Signatures? To provide Authenticity, Integrity and Non-repudiation to electronic documents To use the Internet as the safe and secure medium for e-Commerce and e-Governance

Digital Signatures Each individual generates his own key pair [Public key known to everyone & Private key only to the owner] Private Key – Used for making digital signature Public Key – Used to verify the digital signature

Digital Signature: An application of public key cryptography

v. Web security q. Secure Socket Layer (SSL) q. Secure Electronic Transaction (SET)

q. Secure Socket Layer (SSL) The SSL protocol provides connection security that has three basic properties: The connection is private, Symmetric cryptography is used for data encryption (e. g. EDS, RC 4, etc. )

q. Secure Socket Layer (SSL) (cont…) Ø The peer’s identity can be authenticated using asymmetric, or public key, cryptography (e. g. RSA, DSS, etc. ) Ø The connection is reliable. Message transport includes a message integrity check using a keyed MAC. Secure hash function (e. g. SHA, MD 5, etc. )

q. Secure Socket Layer (SSL) (cont. . ) Figure: SSL 3. 0 information exchange between a client and a server

q. Secure Electronic Transaction (SET) The SET specification is designed to meet three main objectives. First, it will enable payment security for involved, authenticate card holders and merchants, provide confidentiality of payment data, and define protocols for potential electronic security service providers.

q. Secure Electronic Transaction (SET) (Cont…) Second, it will enable interoperability among applications developed by various vendors and among different operating systems and platforms. Third, it will strive to achieve market acceptance on a global scale.

Thank You