INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues1 Lecture 9: E-commerce & Business r E-Commerce r Security Issues m Secure Transaction m Secure Network

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues2 1. E-Commerce r refers to all commercial transactions conducted over the Internet, may include: m Banking m Sending orders m Investing r E-Business Models Store Front Shopping-Cart Technology Auction Model

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues3 1. E-Commerce Models r Storefront m What many people would think when they hear “e-commerce.” m Enable merchant to sell products online Organize product catalogs through their websites Take orders through the web Accept payment Manage customer information r Shopping-cart m Allows customers to accumulate items they wish to buy as they browse the website. m Eg, Amazon.com r Auction Model m Web offers a wide variety of auction sites that act as forums for Internet to assume the role of sellers and buyers. m Eg, eBay

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues4

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues5

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues6 1. E-Commerce & security r Security Made E-Commerce Possible m The most common form of e-commerce transaction consists of a retail purchase from a catalog. m Provides a way for user to: Purchase the item Manipulate a shopping cart Select a payment method

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues7 1. Secure Sockets r A browser keeps messages private by using encryption technology. m Encryption process is entirely hidden from users. m Browser handles the details m Encrypts the message before sending it m Technology used: SSL (Secure Socket Layer) m With SSL, a browser can encrypt messages so that the content remain private

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues8 2. Cryptography r 2 categories of cryptography based on key used: m symmetric key crypto: sender, receiver keys identical m public-key crypto: encrypt key different from decrypt key plaintext ciphertext K A K B

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues9 2. Cryptography Concepts plaintextciphertext Encryption Decryption Cryptosystem Secret Key System Public Key System This is a plaintext gH*lbz Cryptography process data into unintelligible form idea of encryption

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues10 2. Cryptographic Algorithms r Secret key algorithms m DES (Data Encryption Standard) m IDEA (International Data Encryption Algorithm) r Public key algorithms m RSA (Rivest, Shamir, and Adlerman) r Message Digest (cryptographic checksum) m MD5

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues Secret (Symmetric) Key r Encrypting and decrypting a message using the same key m Sender sends message and key to receiver r Problems: m Key must be transmitted to receiver m Different key for every receiver m Key distribution centers used to reduce these problems Generates session key and sends it to sender and receiver encrypted with the unique key r Example of encryption algorithms: m Dunn Encryption Standard (DES), Triple DES, Advanced Encryption Standard (AES)

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues Secret Key (DES) Symmetric plaintextciphertext Encrypt This is a plaintext gH*lbz Decrypt plaintext This is a plaintext secret key

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues Public (Asymmetric) Key r Encrypting and decrypting a message using different keys m Asymmetric – two inversely related keys Private key Public key m Each party has both a public and a private key m Either the public key or the private key can be used to encrypt a message m If public key encrypts only private can decrypt and vice versa m Encrypted with private key Proves identity while maintaining security r Example: RSA public key algorithm

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues Public Key (RSA) plaintextciphertext Encrypt This is a plaintext gH*lbz Decrypt plaintext This is a plaintext Asymmetric private key public key

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues Message Digest r Although secret codes cannot be decrypted, hackers can intercept it, add a few bits and change the message completely r How to prevent this to happen? m Send a message digest together with the message r What is a message digest? m a hashed message and has very few bits (typically between bits) Document One-way hashing function Message digest

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues Message Digest r Message Digest m MD5 (cryptographic checksum) m Hash algorithm (one-way function) m input: variable length message (or a document) m output: fixed length cryptographic checksum (eg 128 bits) m result also called the hash or message digest m protect message integrity (eg, against deliberate and accidental tampering)

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues Message Digest r A simple example of hashing function using remainder m e.g. Let a = 1, b = 2,..., z = 26 r to hash ‘apple’ into a number between 0-9 m add up the letters m apple = = 50 m divide the sum by 10 m the remainder is the hashed value (= 50/10 = 0) m send ‘apple’ together with the hash value 0 r if apple is changed to opple, you can detect it because the hash code is different m o=15, o+p+p+l+e = 64, hash code = 4

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues Security Services & Cryptography Security Cryptography algorithms Public key (e.g., RSA) Secret key (e.g., DES) Message digest (e.g., MD5) Security services AuthenticationPrivacyMessage integrity

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues Security Services & Cryptography r Security services m Privacy: preventing unauthorized release of information m Authentication: verifying identity of the remote participant m Integrity: making sure message has not been altered r Functions provided by cryptography m Privacy: only those who know the (private & public) keys can encrypt and decrypt the message m Authentication: Use a digital signature (a code that can be generated only by a participant, eg using his/her private key) m Integrity: A message integrity code (MIC) is added to the message; MIC as a kind of checksum

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues Digital Signatures r Digital signature m The electronic equivalent of written signatures. m Authenticates sender’s identity Sender (Bob) digitally signs document, establishing he is document owner/creator. Verifiable, nonforgeable: recipient (Alice) can verify that Bob, and no one else, signed document. m Digital signature combines public-key algorithm with message digest. Digital signature = signed message digest Sender used its private key to sign the message.

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues Digital Signatures r Bob sends digitally signed message: r Alice verifies signature and integrity of digitally signed message:

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues Transaction Security Protocols r Secure Sockets Layer (SSL) m Uses public-key technology and digital certificates to authenticate the server in a transaction m Protects information as it travels over Internet Without using SSLWhen using SSL

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues Transaction vs. Network Security r Transaction security protocols protects information as it travels over Internet m It does not protect once stored on receiver servers m Need to protect the servers: protect the network - network security protect the building where the servers are located r Network security m Allow authorized users access m Prevent unauthorized users from obtaining access m Example: firewall

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues24 3. Firewalls r A specially programmed router between a site and the rest of the Internet r connects to 2 or more networks r forward and filter packets r Denial-of-service m filters packets based on source IP address m protect hosts within a site from unwanted flooding of external packets r 2 categories m filter-based m proxy-based Rest of the InternetLocal siteFirewall

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues25 3. Firewalls r Filter-Based Solution m table of entries (source IP addr, source port, dest. Ip addr., dest. Port) m example filter all packets from port 1234 on host addressed to well-known port 80 on host ( , 1234, , 80 ) Filter all packets addressed to port 80 on (*,*, , 80 ) only allow access to port 25 (eg mail server) (*,*, , 25) m how dynamic? Install new filters as firewall is running patterns extended to include new ports as new TCP connections are established (may not know port number in advance)

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues26 3. Firewalls r Problem: complex policy r Example: to make certain pages of a web server available to all external users r unable to express policy as filters Company net Firewall Web server Random external user Remote company user Internet

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues27 3. Firewalls r Solution: put HTTP proxy on firewall r proxy: a process between a client & a server r remote user establish connection to proxy r If requested page is allowed establish connection to server else return error r Policy embodied in application specific proxy External client External HTTP/TCP connection Proxy Firewall Internal HTTP/TCP connection Local server

INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues28 Further Readings r Reading assignment: chp 30, text book r This lecture is intended to provide a brief introduction of network and transactional security, students who wish to invest more time on studying security issues are referred to the following resources: r Security Issues: m Davis Chapter 8. r A master-level course IEG 7006: System Administration and Network Security, explore in-depth issues of security