Towards a Secure and Complete Protocol for Electronic Commerce

As security practitioners, there is a tendency to neglect performance issues. The Secure Electronic Transaction (SET) protocol is proposed as the transactional electronic commerce protocol of choice, yet it has been criticised for its complexity and denseness. This paper reports on a performance analysis of SET conducted through the development of a queueing model. The purpose of modelling SET was to predict its performance and determine which stages in the protocol are likely bottlenecks and points for optimisation when doing SET implementations. Results reveal that existing infrastructures will generally suffice for SET, financial network authorization delay directly affects performance and that transaction times are strongly dependent on the merchant and gateway processing time.KeywordsPerformanceSETElectronic commerce

Security of electronic transaction over insecure communication channel is a challenging task that includes many critical areas as secure communication channel, strong data encryption technique and trusted third party to maintain the electronic database. The conventional methods of encryption in Secure Electronic Transaction can only maintain the data security. The confidential information of customer could be accessed by the unauthorized user for malicious purpose. Therefore, it is necessary to apply effective encryption methods to enhance data security as well as authentication of data communication. The multiple encryption technique provides sufficient security for electronic transactions over wireless network. In this research paper, the needs of multiple encryption technique in Secure Electronic Transaction are proposed to enhance the security of confidential data. This technique increases the data security in such a manner that unauthorized user can not access any part of information over wireless network as internet.

Payment transactions in the SET (Secure Electronic Transaction) protocol are described. Requirements for SET are discussed and formally represented in a version of NPATRL (the NRL Protocol Analyzer Temporal Requirements Language). NPATRL is language for expressing generic requirements, heretofore applied to key distribution or key agreement protocols. Transaction vectors and other new constructs added to NPATRL for reasoning about SET payment transactions are described along with properties of their representation.KeywordsCryptographic ProtocolAction SymbolPurchase AmountInitialization MessagePayment TransactionThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

In this paper, we define a language for specifying security protocols concisely and unambiguously. We use this language to formally specify the protocol for payment transactions in Secure Electronic Transaction (SET), which has been developed by Visa and MasterCard.In our language, a protocol is specified as a collection of processes. Each process expresses the role of a participant. In the role-based specification, the components that a participant sees in a message can be stated explicitly. This is important in specifying protocols like that for the SET payment transactions because in such protocols some message components are encrypted and invisible to some participants.We simplify the SET payment transaction protocol into the exchanges of six messages. Because our future goal is to formally analyze the security properties that Meadows and Syverson discussed, we make the simplified protocol contain the parameters used in their security properties. And we also refrain from excessive simplification. For example, we use dual signature in the payment request message as it is specified in the SET specification books, while most of the other works do not use it. Our specification can serve as a starting point for a formal analysis of the protocol.KeywordsFormal methodssecurity protocolselectronic commerce

The wide spread of using handheld devices offers an opportunity for mobile devices to be used as a universal payment method. However, some issues impede the widespread acceptance of mobile payment; for example: privacy protection, limited capability of mobile devices, and limited bandwidth of wireless networks. In ecommerce payment, Secure Socket Layer (SSL) protocol has been used to establish a secure channel between customers and merchants to secure the payment and the order information. SSL has some disadvantages regarding customer privacy that the customer payment information is revealed to the merchant. Secure Electronic Transaction (SET) has resolved SSL protocol disadvantages by dividing order message into: 1) order information which is revealed to merchant M, 2) payment information which is revealed to Payment Gateway (PG). Both SSL and SET assume the existence of Public Key Infrastructure (PKI) where extensive computations are carried out. In mobile payment, the same protocols of ecommerce payment are used but their application is limited due to heavy computations over wireless and GSM networks. A Modified Secure Electronic Transaction (MSET) protocol is proposed to minimize the extensive computations of SET protocol through replacing time consuming public key encryption and decryption algorithms by symmetric key cryptography.

The Secure Electronic Transaction (SET) protocol is a protocol designed to conduct safe business over Internet. We present formal verification of the Payment Authorization in SET by using ENDL (extension of non-monotonic logic) [1]. The analysis uncovers some subtle defects that may incur malicious attacks. To overcome these vulnerabilities, some feasible countermeasures are proposed accordingly.KeywordsAuthentication ProtocolSecurity ProtocolReplay AttackMalicious AttackDual SignatureThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

SET (Secure Electronic Transactions) is a credit payment protocol on the Internet. The SET specification has open parts in order to flexibly cope with various users' business requirements. Security requirements are also a kind of business requirements. Due to such open parts of the SET specification, the currently provided compliance is not sufficient for assuring interoperability, though this test can verify whether the implementation of products complies with the SET specification. However, the ideal is not practical. Thus, an informal but practical validation called a step-wise prototyping method, is proposed to solve these problems through prototyping for various business applications. This method can validate the interoperability of products complying with the SET specification, or it can validate the SET specification itself, through a supplementary compliance test. As a conclusion, the validation of business protocols on the Internet, such as SET, whose specification is frequently revised and has a large degree of open parts, has a serious problem which needs to be solved. Our proposed method can give a solution to that problem.

A formal specification of the purchase phase in the SET protocol (Secure Electronic Transaction), an e-commerce protocol by Visa and MasterCard, is presented. It is modelled by means of a True Concurrency Timed Process Algebra called BTC which takes into account that the (limited amount of) available resources in a system have to be shared by all the processes. We have considered heterogeneous resources and we extend the algebra with the intention of representing the actions which use the shared resources and how many resources of each type the system has at its disposal.

While software agents have been employed in payment protocols, they are largely passive entities, i.e., they participate in the payment protocol but do not make decision. In this paper, we propose an agent-assisted payment protocol called LITESET/A+ that empowers the payment agent (PA) to perform encryption operation for its owner. This is realized by introducing a Trusted Third Party (TTP) in the payment system based on the SET protocol (Secure Electronic Transaction) and a novel signcryption-threshold scheme. In LITESET/A+, the PA and TTP collaborate together to ensure the same level of security as the SET specification. At the same time, with the signcryption-threshold scheme, the PA is more flexible and autonomous during trading.KeywordsMobile AgentSecret ShareOrder InformationTrust Third PartyProxy SignatureThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

A variety of techniques and tools exist to parallelize software systems on different parallel architectures (SIMD, MIMD). With the advances in high-speed networks, there has been a dramatic increase in the number of client/server applications. A variety of client/server applications are deployed today, ranging from simple telnet sessions to complex electronic commerce transactions. Industry standard protocols, like Secure Socket Layer (SSL), Secure Electronic Transaction (SET), etc., are in use for ensuring privacy and integrity of data, as well as for authenticating the sender and the receiver during message passing. Consequently, a majority of applications using parallel processing techniques are becoming synchronization-centric, i.e., for every message transfer, the sender and receiver must synchronize. However, more effective techniques and tools are needed to automate the clustering of such synchronization-centric applications to extract parallelism. The authors present a new clustering algorithm to facilitate the parallelization of software systems in a multiprocessor environment. The new clustering algorithm achieves traditional clustering objectives (reduction in parallel execution time, communication cost, etc.). Additionally, our approach: 1) reduces the performance degradation caused by synchronizations, and 2) avoids deadlocks during clustering. The effectiveness of our approach is depicted with the help of simulation results.

Although various European Union (EU) directives have established the proper legal framework for the provision of a trustful, legally accepted cross border transaction via electronic means, the consumers are still hesitant to use e-commerce. Lack of confidence with regard to the protection of privacy and security of electronic transactions is among the main reasons. This article attempts to form the appropriate confidence framework describing a set of privacy and security requirements that must be taken into account for e-ordering systems. In addition, it presents a trustful e-ordering architecture (TOES) that achieves to address these requirements based on extensible markup language (XML), XML cryptography, public key infrastructure (PKI), Web services policy language (WSPL), and Web services. TOES is an open, secure, interoperable, and affordable e-ordering system that respects the EU legislation.

Security of Computer Networks

The oxygen society

Electronic commerce, commonly known as eCommerce is trade in products using the internet. Security at the e-commerce becomes more and more important. Electronic transaction security is a challenging task because of the insecure communication channel. In this paper, we proposed a new algorithm to make an e commerce transaction more secure. In this work we are using AES to encrypt data and this data is embedded to image edges to perform Stenography in this paper target on compress the time of encryption and decryption adopting parallel processing on which AES will be applied freely. In the results show the comparison between our work and previous work and we found that parallel processing and multi threading on the AES algorithm our results are quite improved, our proposed algorithm is taking much less time in encrypt and embedding or decrypt and extraction.

Because many current payment systems are poorly implemented, or of incompetence, private data of consumers such as payment details, addresses and their purchase history can be compromised. Furthermore, current payment systems do not offer any non-repudiable verification to a completed transaction, which poses risks to all the parties of the transaction — the consumer, the merchant and the financial institution. One solution to this problem was SET, but it was never really a success because of its complexity and poor reception from consumers. In this paper, we introduce a third party payment system that aims to preserve privacy by severing the link between their purchase and payment records, while providing a traceable transaction that maintains its integrity and is non-repudiable. Our system also removes much of the responsibilities placed on the merchant with regards to securing sensitive data related to customer payment, thus increasing the potential of small businesses to take part in e-commerce without significant investments in computer security.