Henric Johnson1 Chapter 7 WEB Security Henric Johnson Blekinge Institute of Technology, Sweden

Slides:

Advertisements

Similar presentations

CP3397 ECommerce.

Advertisements

1 Lecture 17: SSL/TLS history, architecture basic handshake session initiation/resumption key computation negotiating cipher suites application: SET.

Cryptography and Network Security

Socket Layer Security. In this Presentation: need for web security SSL/TLS transport layer security protocols HTTPS secure shell (SSH)

7-1 Chapter 7 – Web Security Use your mentality Wake up to reality —From the song, "I've Got You under My Skin“ by Cole Porter.

Chapter 7 Web Security MSc. NGUYEN CAO DAT Dr. TRAN VAN HOAI.

SECURITY IN E-COMMERCE VARNA FREE UNIVERSITY Prof. Teodora Bakardjieva.

Electronic Transaction Security (E-Commerce)

Cryptography and Network Security Chapter 17

CSCE 790: Computer Network Security Chin-Tser Huang University of South Carolina.

Chapter 8 Web Security.

EE579T/6 #1 Spring 2003 © , Richard A. Stanley EE579T / CS525T Network Security 6: SSL and SET Prof. Richard A. Stanley.

Secure Electronic Transaction (SET)

1 Web Security Web now widely used by business, government, individuals but Internet & Web are vulnerable have a variety of threats –integrity –confidentiality.

E-Commerce Security Technologies : Theft of credit card numbers Denial of service attacks (System not availability ) Consumer privacy (Confidentiality.

Network Security Lecture 26 Presented by: Dr. Munam Ali Shah.

Cosc 4765 SSL/TLS and VPN. SSL and TLS We can apply this generally, but also from a prospective of web services. Multi-layered: –S-http (secure http),

Chapter 4 Getting Paid. Objectives Understand electronic payment systems Know why you need a merchant account Know how to get a merchant account Explain.

E-Commerce Security Professor: Morteza Anvari Student: Xiaoli Li Student ID: March 10, 2001.

Security Protocols and E-commerce University of Palestine Eng. Wisam Zaqoot April 2010 ITSS 4201 Internet Insurance and Information Hiding.

Chapter 18: Doing Business on the Internet Business Data Communications, 4e.

Chapter 18: Doing Business on the Internet Business Data Communications, 4e.

Secure Socket Layer (SSL) and Secure Electronic Transactions (SET) Network Security Fall Dr. Faisal Kakar

Cryptography and Network Security (CS435) Part Fourteen (Web Security)

Web Security : Secure Socket Layer Secure Electronic Transaction.

Cryptography and Network Security (SSL)

Internet Security. 2 PGP is a security technology which allows us to send that is authenticated and/or encrypted. Authentication confirms the identity.

1 SSL - Secure Sockets Layer The Internet Engineering Task Force (IETF) standard called Transport Layer Security (TLS) is based on SSL.

Web Security Web now widely used by business, government, individuals but Internet & Web are vulnerable have a variety of threats – integrity – confidentiality.

Gold Coast Campus School of Information Technology 2003/16216/3112INT Network Security 1Copyright © Griffith University, INT / 3112INT Network.

Network and Internet Security Prepared by Dr. Lamiaa Elshenawy

1 Chapter 7 WEB Security. 2 Outline Web Security Considerations Secure Socket Layer (SSL) and Transport Layer Security (TLS) Secure Electronic Transaction.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

Chapter 7 : Web Security Lecture #1-Week 12 Dr.Khalid Dr. Mohannad Information Security CIT 460 Information Security Dr.Khalid Dr. Mohannad 1.

Lecture 6 (Chapter 16,17,18) Network and Internet Security Prepared by Dr. Lamiaa M. Elshenawy 1.

Henric Johnson1 Chapter 8 WEB Security //Modified by Prof. M. Singhal// Henric Johnson Blekinge Institute of Technology, Sweden

Page 1 of 17 M. Ufuk Caglayan, CmpE 476 Spring 2000, SSL and SET Notes, March 29, 2000 CmpE 476 Spring 2000 Notes on SSL and SET Dr. M. Ufuk Caglayan Department.

Henric Johnson1 Secure Electronic Transactions An open encryption and security specification. Protect credit card transaction on the Internet. Companies.

Chapter 7 - Secure Socket Layer (SSL)

Cryptography and Network Security

Visit for more Learning Resources

Cryptography and Network Security

Cryptography and Network Security

Secure Electronic Transaction (SET) University of Windsor

Chapter 7 WEB Security.

CSCE 815 Network Security Lecture 16

The Secure Sockets Layer (SSL) Protocol

Chapter 7 WEB Security.

Network Security 4/21/2019 Raj Rajarajan.

Electronic Payment Security Technologies

Cryptography and Network Security

Presentation transcript:

Henric Johnson1 Chapter 7 WEB Security Henric Johnson Blekinge Institute of Technology, Sweden

Henric Johnson2 Outline Web Security Considerations Secure Socket Layer (SSL) and Transport Layer Security (TLS) Secure Electronic Transaction (SET) Recommended Reading and WEB Sites

Henric Johnson3 Web Security Considerations The WEB is very visible. Complex software hide many security flaws. Web servers are easy to configure and manage. Users are not aware of the risks.

Henric Johnson4 Security facilities in the TCP/IP protocol stack

Henric Johnson5 SSL and TLS SSL was originated by Netscape TLS working group was formed within IETF First version of TLS can be viewed as an SSLv3.1

Henric Johnson6 SSL Architecture

Henric Johnson7 SSL Record Protocol Operation

Henric Johnson8 SSL Record Format

Henric Johnson9 SSL Record Protocol Payload

Henric Johnson10 Handshake Protocol The most complex part of SSL. Allows the server and client to authenticate each other. Negotiate encryption, MAC algorithm and cryptographic keys. Used before any application data are transmitted.

Henric Johnson11 Handshake Protocol Action

Henric Johnson12 四阶段 1 建立安全能力，确定： SSL 版本，密钥交换、信息验证、加密的算法，压缩方法，有关密钥生成的两个随机数 2 服务器密钥的交换和验证，客户验证了服务器，如果需要，客户要知道服务器公钥 3 用户密钥的交换和验证，客户要由服务器进行验证，客户和服务器都知道预备主密钥 4 终结与完成，客户和服务器都做好了交换数据的准备

Henric Johnson13 Transport Layer Security The same record format as the SSL record format. Defined in RFC Similar to SSLv3. Differences in the: –version number –message authentication code –pseudorandom function –alert codes –cipher suites –client certificate types –certificate_verify and finished message –cryptographic computations –padding

Henric Johnson14 Secure Electronic Transactions An open encryption and security specification. Protect credit card transaction on the Internet. Companies involved: –MasterCard, Visa, IBM, Microsoft, Netscape, RSA, Terisa and Verisign Not a payment system. Set of security protocols and formats.

Henric Johnson15 SET Services Provides a secure communication channel in a transaction. Provides tust by the use of X.509v3 digital certificates. Ensures privacy.

Henric Johnson16 SET Overview Key Features of SET: –Confidentiality of information –Integrity of data –Cardholder account authentication –Merchant authentication

Henric Johnson17 SET Participants

Henric Johnson18 Sequence of events for transactions 1.The customer opens an account. 2.The customer receives a certificate. 3.Merchants have their own certificates. 4.The customer places an order. 5.The merchant is verified. 6.The order and payment are sent. 7.The merchant request payment authorization. 8.The merchant confirm the order. 9.The merchant provides the goods or service. 10.The merchant requests payments.

Henric Johnson19 Dual Signature

Henric Johnson20 Payment processing Cardholder sends Purchase Request

Henric Johnson21 Payment processing Merchant Verifies Customer Purchase Request

Henric Johnson22 Payment processing Payment Authorization: –Authorization Request –Authorization Response Payment Capture: –Capture Request –Capture Response

Henric Johnson23 Recommended Reading and WEB sites Drew, G. Using SET for Secure Electronic Commerce. Prentice Hall, 1999 Garfinkel, S., and Spafford, G. Web Security & Commerce. O’Reilly and Associates, 1997 MasterCard SET site Visa Electronic Commerce Site SETCo (documents and glossary of terms)