Epayment System using Java
-
Upload
fuller-hatfield -
Category
Documents
-
view
41 -
download
1
description
Transcript of Epayment System using Java
Epayment System using JavaEpayment System using Java
April, 11. 2001Computer Security and Electronic Payment System
Cho won chul
Kim Hee Dae
Lee Jung Hwan
Yoon Won Jung
2
IndexIndex
1. Introduction
2. What is E-payment system ?
3. Comparison between SSL and SET(1)(2)
4. Secure Transmission Schemes in SSL and SET Protocol(1)(2)
5. The Player and essential security Requirements in SET
6. Entities of SET protocol in Cybershopping
7. Overview of main Messages in SET
8. Smart Card (Physical layout)
3
IndexIndex
9. Software Stack of a Java Card
10. Program Development Process
11. Cyberflex Access Cards(1)(2)
12. What should we implement in this Project
13. Java Card Security package
14. Java Layer in the Host Software Architecture
4
1. Introduction1. Introduction
Describe typical electronic payment systems for EC
Compare the relationship between SSL and SET protocols
Classify and describe the types of Smart Card used for payments
Describe the characteristics of Java Card
Implement Java Smart Card applying to SET
5
2. What is E-payment system?2. What is E-payment system?
E-payment system is the new payment methods with the emergence of electronic commerce on the Internet.
Secure payment systems are critical to the success of EC.
There are four essential security requirements for safe electronic payments.(Authentication, Encryption, Integrity, Non-repudiation)
The key security schemes adopted for electronic payment systems are encryption.
Security schemes are adopted in protocols like SSL and SET.
6
3. Comparison between SSL and SET(1)3. Comparison between SSL and SET(1)
A part of SSL (Secure Socket Layer) is available on customers’ browsers it is basically an encryption mechanism for order taking, queries
and other applications it does not protect against all security hazards it is mature, simple, and widely use
SET ( Secure Electronic Transaction) is a very comprehensive security protocol it provides for privacy, authenticity, integrity, and, or Non
repudiation it is used very infrequently due to its complexity and the need for
a special card reader by the user it may be abandoned if it is not simplified/improved
7
3. 3. Comparison between SSL and SET (2)Comparison between SSL and SET (2)
Secure Electronic Transaction(SET) Secure Socket Layer (SSL)Complex Simple
SET is tailored to the credit card payment to the merchants.
SSL is a protocol for general-purpose secure message exchanges (encryption).
SET protocol hides the customer’s credit card information from merchants, and also hides the order information to banks, to protect privacy. This scheme is called dual signature.
SSL protocol may use a certificate, but there is no payment gateway. So, the merchants need to receive both the ordering information and credit card information, because the capturing process should be initiated by the merchants.
8
4. Secure Transmission Schemes 4. Secure Transmission Schemes in SSL and SET Protocol(1) in SSL and SET Protocol(1)
Sender’s Computer1. The message is hashed to a prefixed length of message digest.
2. The message digest is encrypted with the sender’s private signature key, and a digital signature is created.
3. The composition of message, digital signature, and Sender’s certificate is encrypted with the symmetric key which is generated at sender’s computer for every transaction. The result is an encrypted message. SET protocol uses the DES algorithm instead of RSA for encryption because DES can be executed much faster than RSA.
4. The Symmetric key itself is encrypted with the receiver’s public key which was sent to the sender in advance. The result is a digital envelope.
9
Sender’s Private Signature Key
Sender’s Certificate
++
Message+
Digital Signature
Receiver’s Certificate
Encrypt
Symmetric Key
Encrypted Message
Receiver’sKey-Exchange Key
EncryptDigital
Envelope
Message
Message Digest
Sender’s ComputerSender’s Computer
10
4.Secure Transmission Schemes 4.Secure Transmission Schemes in SSL and SET Protocol (2) in SSL and SET Protocol (2)
Receiver’s Computer5. The encrypted message and digital envelope are transmitted to receiver’s computer via the Internet.
6. The digital envelope is decrypted with receiver’s private exchange key.
7. Using the restored symmetric key, the encrypted message can be restored to the message, digital signature, and sender’s certificate.
8. To confirm the integrity, the digital signature is decrypted by sender’s public key, obtaining the message digest.
9. The delivered message is hashed to generate message digest.
10. The message digests obtained by steps 8 and 9 respectively, are compared by the receiver to confirm whether there was any change during the transmission. This step confirms the integrity.
11
Decrypt
Symmetric Key
Encrypted Message
Sender’s Certificate
+
+
Message
compare
DigitalEnvelope
Receiver’s Private Key-Exchange Key
Decrypt
Message DigestDigital Signature
Sender’s Public Signature Key
Decrypt
Message Digest
Receiver’s ComputerReceiver’s Computer
12
5. The Player and essential security 5. The Player and essential security Requirements in SET Requirements in SET
The player Cardholder Merchant (seller) Issuer (your bank) Acquirer (Merchant’s financial institution, acquires the sales slips) Brand (Visa, Master Card) Payment Gateway (e-payment infra-structure)
Essential Security Requirements in SET Authentication Encryption Integrity Non-repudiation
13
6.Entities of SET protocol in 6.Entities of SET protocol in Cybershopping Cybershopping
IC CardReader Customer x
Customer y
With Digital WalletsCertificateAuthority
Electronic Shopping Mall
Merchant A Merchant B
Credit CardBrand
ProtocolX.25
Payment Gateway
14
7.Overview of main Messages in SET7.Overview of main Messages in SET
CardholderRegistration
PurchaseRequest
PaymentAuthorization
PaymentCapture
MerchantRegistration
Authorization
RequestResponse
Capture Request
Response
Capture Request
Certificate
Certificate Request
Certificate
Request to Verity the information
Response
Response
Authorization
Request
Clearing Request
Authorization
Request
Response
Acquirer
Card Holder CA Issue
Merchant CA
Payment Gateway
Card Reader
Purchase Response
Purchase Request
:Over the Internet :Over Financial Network
15
8. 8. Smart Card (Physical layout) Smart Card (Physical layout)
ROM(16K)- OS- Com- Security
CPU- 8 bit- 5 MHz- crypto-coprocessor
RAM- 4 kb
EEPROM(16K)- File System- Program files- Keys- Passwords- Applications
16
9. 9. Software Stack of a Java CardSoftware Stack of a Java Card
FrameWork provide Java Card API JVM executes the bytecode of the applet and of the library functions Applet is a small program developed by
application designer.
17
10. 10. Program Development ProcessProgram Development Process
18
11.Cyberflex11.Cyberflex(TM(TM)) Access Cards(1)Access Cards(1)
Manufacture : Schlumberger
General Characteristics : - Communication protocol : ISO T=0
- Data transmission baud rate :
9600 bit/sec by default, up to 55,800 bit/sec
- Nonvolatile memory :
16 KB of EEPROM (13.5 KB available for cardlet, keys, and
certificate )
- APDU buffer : 255 + 5 bytes
- Access control structure :
As many as 8 identities per directory/program
- Fast native file system
19
CyberflexCyberflex(TM(TM)) Access Cards(2) Access Cards(2)
Cryptographic Features
- Host system generation of DES keys and RSA keys(512, 768, 1024 bits)
- Enciphering and deciphering data with DES or 3DES keys in CBC mode
- External Authentication with DES or 3DES keys
- Internal Authentication with DES or 3DES keys in EBC mode, or with RSA digital signatures
- SHA-1 and MAC hashing(carried out by Java APIs, not by APDUs)
20
12. 12. What should we implement in thisWhat should we implement in this Project Project
Cardholder Registration - Certificate Request to CA Read from Card reader (Authentication) Purchase Request (simultaneously) - to Issuer to get the certificate - to Merchant Design the protocol using DES-3,RSA,etc.
Purchase Response to ClientAuthorization Request to gatewayCapture Request to gatewayResponse processing - to Client, Payment, CA
Request to Verify the Certificate - Response from Card Holder - Request to IssueMerchant Registration - Authorization Request (to Acquirer) - response to Merchant
Authorization process - request to Issue - response to MerchantCapture process - request to Issue
Merchant Authorization process - response to CA
Verify Card Holder information - send confirm to CAAuthorization process - response to Gateway Capture process - clearing request from gateway - bill to client
Client
Merchant
PG
CA
ISSUE
Acquirer
21
13. Java Card Security package needed 13. Java Card Security package needed in this projectin this project
Key SecretKey DESKey PrivateKey PublicKey RSAPrivateKey RSAPrivateCrtKey RSAPublicKey
DSAKey DSAPrivateKey DSAPublicKey KeyBuilder MessageDigest Signature RandomData CrytoException
22
14.Java Layer in the Host Software 14.Java Layer in the Host Software ArchitectureArchitecture