1 pertemuan 12 authentication, encryption, digital payments, and digital money matakuliah:...
TRANSCRIPT
1
Pertemuan 12 Authentication, Encryption,
Digital Payments, and Digital Money
Matakuliah : M0284/Teknologi & Infrastruktur E-Business
Tahun : 2005
Versi : <<versi/revisi>>
2
Learning Objectives
• Determine how and why encryption is important for e-commerce.
• Understand how security applies to e-mail, the Web, the intranet, and the extranet.
• Appreciate how virtual private networks are relevant to the future of e-commerce.
• Plan for strategies to fend-off security threats.
• List and understand various e-commerce modes of payment.
3
Confidentiality
• Confidentiality has two aims:– To use the digital signature or encrypted hash
function to authenticate the identity of the sender.
– To protect the content of the message from eyes other than those of the intended recipient.
• Cryptography is used to implement privacy– Encoded message has no apparent meaning
4
Confidentiality
• Two steps involved:– In the first step, a clear message is encrypted.– The reverse aspect is the deciphering by the
recipient.
• Secure Socket Layer (SSL)– Developed by Netscape for transmitting
private documents via the Internet
5
Confidentiality
• Organizations– Government– Industry Self-Regulation
• Platform for Privacy Preferences Project (P3P).
• TRUSTe• Better Business Bureau Online
6
Authentication
“Authentication is the process of identifying an individual or a message
usually based on a user name and password or a file signature.”
Authentication is distinct from Authorization
7
Authentication
• Log-in Passwords
• Weak method with short passwords
8
Authentication
• Features commonly used to identify and authenticate an user:– Something the user knows (e.g. password).– Something the user has (e.g. token,
smartcard).– Something that is part of the user (e.g.
fingerprint).
9
AuthenticationDigital Signature
“A digital signature is a code attached to an electronically transmitted message
to identify the sender.”
10
AuthenticationDigital Signature
1. The sender composes the document.2. The sender uses a hash algorithm to
create a “one-way” hash.3. The user uses his or her private part of a
public key system to encrypt the one-way hash to create the digital signature.
4. The sender then combines the original document with the digital signature to create a new signed document and send it to the receiver
11
AuthenticationDigital Signature
1. The receiver separates the document from its signature.
2. The receiver decrypts the digital signature using the sender public key.
3. The receiver applies the hashing algorithm to the original electronic document to produce a new one-way-hash.
12
AuthenticationDigital Signature
13
Authorization
“Gives someone permission to do or have something.”
• Role or privileges based system.
• Access lists to hardware, programs, data
14
Integrity
• Control Redundancy Check (CRC)
• Secure Hash Algorithm (SHA-1)
• RSA’s Message Digest (MD5)
15
Auditing
“As no system will ever be completely secure, policies need to be devised where unauthorized usage will not
occur.”
16
Non-repudiation
“Nonrepudiation is a proof that a message has been sent or received.”
“Nonrepudiation is specially important for the secure completion of online
transactions.”
17
Non-repudiation
• Digital Certificates can be used to verify the identity of a person, website or JavaScript/ Java applet.
• The certificate always include:– Public key.– The name of the entity.– Expiration date.– The name of the certification authority (CA).– The digital signature of the CA.
18
Non-repudiation
19
Non-repudiation - PKI
20
E-mail and Internet Security
• Secure Sockets Layer (SSL).• Secure Electronic Transactions (SET).• Password Authentication Protocol/
Challenge Handshake Authentication Protocol (PAP/CHAP).
• Private Communications Technology (PCT).
• S/MIME• Pretty Good Privacy (PGP).
21
E-mail and Internet Security
• Secure Sockets Layer (SSL).– Created by Netscape– Widely used– Uses RSA’s encryption system.– Uses temporary keys– Implement Certificate Authorities (CA)– Client and server certificates
22
E-mail and Internet Security
• Secure Electronic Transactions (SET)– Enables the use of electronic payment
methods and provides assurance about the identification of customers, merchants and banks.
– Industry protocol.
23
E-mail and Internet Security
• PAP/CHAP– Commonly used with PPP connections.– With PAP the password is sent as open text,
with CHAP is encrypted.– With CHAP the authentication is repeated
every 10 minutes, with PAP only at connection time.
24
E-mail and Internet Security
• Private Communications Technology.– Microsoft Initiative.– Symmetric encryption.– Authenticates of server to client via
certificate or CA.– Verifies message integrity with hash function
message digests– Can be implemented with HTTP and FTP.– Allows a stronger encryption
25
E-mail and Internet Security
• Secure MIME.– Secure method of sending e-mails.– An IETF standard – RFC 1521
26
E-mail and Internet Security
• Pretty Good Privacy (PGP)– World’s de facto standard.– Freeware (There is also a commercial
version).
27
Virtual Private Network
“A virtual private network (VPN) is a network available when the user
needs it.”
• IP Security Protocol (IPSec)
• Layer Two Tunneling Protocol (L2TP)
• Transport Layer Security (TLS)
28
Virtual Private Network – L2TP
29
Encryption Export Policy
• Regulations affect the global use of encryption techniques.
• Companies are allowed to export encryption items (but with weak encryption)
• Encryption classified as a weapon
30
Payment Systems
• Cash
• Checks
• Money Orders
• ORDER/INVOICE – bank transfer– (feasible for B2B)
• Credit Card Payments– (used most for B2C e-commerce)
31
Electronic Money
• Not widely adopted • Cybercash• VeriFone• Stored-Value Smart Cards.• Digital Cash
– Visa Cash– Mondex– Digicash
• Micropayment