Secure Internet Transactions

1
Secure Internet Transactions

• CS555 Web Application Development

2
Internet Transactions

• E-commerce growth tremendous
• More and more sensitive information sent over
  Internet
• Original Internet protocols not designed for
  secure information exchange
• Data travels unencrypted, easy to intercept

3
Secure Protocols

• SSL (Secure Socket Layer)
• Intermediate layer between TCP/IP and HTTP
• Introduced by Netscape as an open protocol
• Very wide acceptance, today industry standard
• Originally 40-bit encryption, now 128-bit standard

4
SSL

• HTTP over SSL (HTTPS)
• Unlike HTTP, HTTPS works over port 443
• Encrypts data using public key encryption
• https//,
• Works in conjunction with X.509 standard for
  security certificates

5
Digital Certificates

• Issued by a trusted authority (e.g. Verisign,
  Thawte)
• Unique string of 1024 bits (current standard)
  identifying the owner
• Used to establish identity of internet entities
  (e.g. web servers, email senders, etc.)

6
Sample Certificate(https//www.amazon.com)
7
Public Key Encryption

• Most widely used encryption method today
• Extremely secure (2128 combinations)
• Keys are actually numbers, and they are used in
  pairs (one public and one private)
• Public key distributed, and used to encrypt
• Private key secret, used to decrypt

8
Public Key Encryption
1 A sends its public key to B
A
B
3 A uses private key to decrypt data
Data
Data
2 B uses public key to encrypt data
9
Case study Credit Card Transactions

• Usually a CARD PROCESSOR server receives requests
• Requests as HTTPS form POST
• Result POSTed back to indicated URL
• More recently XML replaces form data

10
Credit Card Facts

• Card numbers and the Luhn algorithm
• 4916 0504 4673 8262
• Valid major card numbers have 16 digits and start
  with 4 (Visa), 5 (MasterCard) or 6 (Discover)
• First 4 digits indicate the issuing bank (e.g.
  4828 First Union)
• Exception American Express (starts with 3, has
  15 digits)
• Other, less widespread card companies (Diners
  Club, JCB, etc.)

11
Secure Internet Transactions

• More Info

• http//techtarget.com
• Search for HTTPS, public key encryption

• http//authorize.net/support/dev_center.php
• Authorize.net documentationan interesting
  reading!