1. E-Commerce Security

2. E-Commerce
Buying and selling, and marketing and servicing of products and services, and information via computer networks.

3. E-Commerce Models 1. Storefront model: b2c 2. Auction model: e-Bay
Shopping cart, on-line shopping mall
2. Auction model: e-Bay
3. Portal model: yahoo.com
4. Dynamic pricing: name-your-price, comparison-pricing, bartering(exchange items),
5. B2B & EDI (Electronic Data Interchange)
6. Etc.

4. M-Business E-Business enabled by wireless communication.
WI-FI: Wireless local area network (WLAN) based on the IEEE specifications.
Hotspot: A person with a Wi-Fi device, such as a computer, cell telephone, or personal digital assistant (PDA) can connect to the Internet when in proximity of an Access Point. The region covered by one or several access points is called a hotspot.

5. Location Based Services
Location-Identification Technologies:
Global Positioning System (GPS)
Cell phone
Angle of Arrival (AOA)
Location Based Services:
B2E (Employee)
B2C

6. Internet Security
Authenticity: Is the sender of a message who they claim to be?
Privacy: Are the contents of a message secret and only known to the sender and receiver?
Integrity: Have the contents of a message been modified during transmission?
Nonrepudiation: Can the sender of a message deny that they actually sent the message?

7. Encryption (Cryptography)
Plain text: the original message in human-readable form.
Ciphertext:the encrypted message
Encryption algorithm: the mathematical formula used to encrypt the plain text.
Key: the secret key used to encrypt and decrypt a message.

8. Encryption Example Digits: 0-9, Encryptor: Decryptor:
Replace each digit by Mod(Digit + Key, 10)
Key’s value is from 0 to 9
If Key = 7, then:
0 -> 7, 1->8, 2->9, 3->0, 4->1, 5->2
Decryptor:
Replace ach digit byMod(Digit + (10-Key), 10)
If key=7, then
7->0, 8->1, 9->2, 0->3

9. Encryption Algorithms
Private key encryption
Public key encryption
Digital signature
Digital certificate

10. Private Key (secret Key) Encryption
The same key is used by a sender (for encryption) and a receiver (for decryption)
The key must be transmitted to the receiver.
Example:
DES (Data Encryption Standard) algorithm with 56-bit key

11. Public Key Encryption
Uses two different keys: a public and a private key.
Receiver’s public key must be delivered in advance.
Sender uses receiver’s public key to encrypt the message and receiver uses private key to decrypt the message (Sender can be sure the receiver is the true receiver)
Example:
RSA (Rivest, Shamir, and Adelman) algorithm with 512-bit to 1024-bit key.
Note: Although the two keys are mathematically related, deriving one from the other is “computationally infeasible”.

12. Digital Signature
It is used for the authentication and nonrepudiation of senders by applying public key encryption in reverse.
How digital signature works:
Sender:
Create message digest: Hash(original message)
Digital signature: Encrypt(Message digest, Sender’s private key)
Encrypted message: Encrypt(Original message, Receiver’s public key)
Send the hash function, digital signature, and the encrypted message to receiver.
Receiver:
Use receiver’s private key to decrypt the encrypted message to reveal the original message.
Use the sender’s public key to decrypt digital signature and reveal the message digest.
Apply the hash function to the original message. If the hash value matches the message digest in the digital signature, the message is intact.

13. Ceritificate
A certificate is a digital document issued by a trusted third-party certificate authority (CA).
A certificate contains records such as a serial number, user’s name, owner’s public key, name of CA, etc.
Example of CA: VeriSign, U.S. Postal Service.

14. Online Transaction Security Protocol
Secure Sockets Layer (SSL)
Developed by Netscape
SSL implements public key technology using the RSA algorithm and digital certificate to authenticate the server in a transaction and protect private information

15. Cookies Designed to hold information about a user.
Created by a web site and saved on the visitor’s machine.
It contains:
Web site that sets the cookie.
One or more pieces of data.
Expiration date for this cookie.
Cookies directory:
Browser sends cookie with the URL when you visit the site that issued the cookie.