1 / 21

Secure Electronic Commerce

Secure Electronic Commerce. Ankur Teredesai amt6@cse.buffalo.edu. Which are the processes in B2B E- Commerce that need security?. Purchase Orders Materials acquisition Manufacturing Release Banking Loan Processing Stock Purchase Electronic Fund Transfer. Key Issues in Security.

susan
Download Presentation

Secure Electronic Commerce

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Secure Electronic Commerce Ankur Teredesai amt6@cse.buffalo.edu

  2. Which are the processes in B2B E- Commerce that need security? • Purchase Orders • Materials acquisition • Manufacturing Release • Banking • Loan Processing • Stock Purchase • Electronic Fund Transfer

  3. Key Issues in Security • Understanding Privacy vs. Security • Technology for Security • Trusted vs. Untrusted Systems • Network Security Management • Ten Commandments of Computer Ethics

  4. Privacy vs. Security • Confidentiality • Integrity • Availability Assets of computing system accessible by authorization ( Privacy ) Modification by authorization Deny Service if not authorized but provide it if authorized

  5. Some key terms Logic bomb : A change in the program, so that the program works well in most times but fails in specialized circumstances to produce and effect like alogic bomb. Trojan Horse : a program that overtly does one thing and covertly something else. Virus: a program that spreads infection from one computer to another Trapdoor: a program that has a secret entry point into the system

  6. Technology for Security A simple scenario : Suppose S (sender) wants to send a message to R ( receiver); where T is the Transmission Medium. An outsider O, wants the message and tries to access it so is an Interceptor or intruder. So O can block it , intercept it , modify it , fabricate it. To avoid this happening we will use :Encryption - Decryption : Substitution method or transposition method. All secure data transmission techniques fall under this general category of algorithms. E.g. are Symmetric ( secret key ) , Asymmetric (public key) , Data Encryption Standard, Rivest-shamir-Adelman Algorithms, SSL, etc.

  7. Various Encryption A) Symmetric Cryptosystem Plaintext Cyphertext Plaintext Decryption encryption Key B) Asymmetric Cryptosystem Plaintext Cyphertext Plaintext encryption Decryption Decryption Key Encryption Key

  8. Cryptography : Hidden writing. The practice of using encryption to conceal text. Monoalphabetic Ciphers : Caesar Cipher : ci = E(pi ) = pi + 3 Disadvantage : Frequency Distribution reflects the distribution of the underlying alphabet. Polyalphabetic Ciphers : Use ciphers that are flattened in frequency distribution, by mixing high and low distributions. Disadvantage : To break these, determine the number of alphabets used, break the ciphertext into pieces that were enciphered with the same alphabet, and solve each piece as a Monoalphabetic substitution.

  9. Kasiski Method for Repeated Patterns : If a message is encoded with n alphabets in cyclic rotation, and if a particular word or letter group appears k times in a plaintext message it should be encoded approximately k/n times the same alphabet. Index of Coincidence : How well does the plaintext distribution match the letters in English ? So measure the variation between frequencies in a distribution. With this variation we can determine if the encrypted message is Monoalphabetic or polyalbphabetic. The entire theory derives mathematically how good a particular encryption is. Some Famous Ciphers : Vernam Cipher - plaintext + some mathematical operation + addition of stream of random numbers . Long Book Sequences, Transpositions, etc.

  10. Several Useful Encryption Algorithms Merkle - Hellman Knapsacks :The use of the NP Hard knapsack problem. Encrypting Using Rivest - Shamir -Adelman (RSA) Algorithm :Incorporates results from number theory, combined with the difficulty of determining the prime factors of a target and the mod n function. Two keys e - encryption and d - decryption are chosen. Let P be plaintext, C be Cyphertext, then encryption is : C = (P e) mod n decryption is : P = (C d) mod n Advantage : e and d are interchangeable and ( P e ) d mod n = P

  11. Data Encryption Standard(DES) • U.S. Gov Standard for use by General Public. • Must provide a high level of security. • Must be completely specified and easy to understand. • Secure algorithm - Not secret algorithm. • Available, adaptable in diverse applications, economical, efficient. • Must be validated. • Exportable • uses substitution and permutation ciphers

  12. Protocols

  13. Information SecurityRisk Assessment and Intrusion Detection

  14. Risk Assessment : Are all the Doors and Windows Locked ? Using Network Probes : • easy to deploy • launch a simulated intrusion attempt to find potential vulnerability across the whole network. • Weak approach : Hacker tries to attack one weak computer at a time, and it is hard to detect the legitimate and illegitimate use of this type of product. • Information gathered about security holes may be heard while being transferred back to the central computer!!

  15. Using Intelligent Agents : • Agents reside on Individual computers. • Security policy that is self correcting. (learning component) • Scheduled and run on multiple computers in parallel. • Low overhead cost with regard to network traffic. • Agents encrypt the result of the assessment before transmission to central management interface. • Weakness : Even an Intelligent Agent is not as Intelligent as an INTRUDER !!

  16. Intrusion Detection : The Doors are locked. Where is the Security Guard Even if we take a stock of security holes, how do we know when we are attacked ? How do we catch the intruder ? Solutions involving identifying attempted break-ins while they are occurring are in development. Using Network Probes : • Monitor network activity. • Report suspicious behavior. • But even legitimate traffic may seem suspicious and vice versa. • Weakness : Intrusion attempt perpetrated across encrypted connection, e.g. Virtual private network, cannot be detected by probes.

  17. Using Intelligent Agents : • Check audit trails by deploying agents on the system generated by the OS, databases and applications. • Weakness : The first thing after intrusion will be to modify the audit trail, and the intrusion detection will depend on the frequency of the audit done by the agent. • Many administrators disable audit trail facilities because of the excessive CPU and disk space they require. • Agent tries to monitor the way users are logging in and notes any odd pattern. This method gives better satisfaction.

  18. Will we ever stop feeling insecure? www.digicrime.com Will we ever have secure server technology? http://nsi.org/Library/Internet/security.htm

  19. TRIP.com’sOnline Travel Solution : A case study in e-commerce • TRIP.com’s intelliTRIP is an online search tool for travel reservations and other additional services with the help of a web browser. • intelliTRIP is a tool that searches multiple travel and airline Web Sites, enabling users to compare fares, trip routes and airlines to find the most desirable flight plan. • It uses the BEA WebLogic server to implement its application tool. • BEA WebLogic uses Enterprise Java Beans technology and support of other Java and industry standards to provide a foundation of growth to the ever expanding business of TRIP.com Source : Java Developer Journal, Scott Davison

  20. Features of BEA WebLogic: • Enterprise JavaBeans ( EJBs ) for secure sharing of transactional business components • Servlets for supporting non-Java clients in using Web browsers • Connection pooling for databases and query caching • Authorization control lists for reliable security of access and transactions. • Built-in Secure Sockets Layer for transaction security over public networks. • Technical Specifications. • Three-tier, 100% Java-based architecture. • Sun Solaris 450 Enterprise Server, Sun Java Virtual Machines 1.1.7.05, Netscape Enterprise Server, BEA WebLogic Server. Source : Java Developer Journal, Scott Davison

More Related