1. Electronic Commerce

2. On-line ordering---an e-commerce application On-line ordering assumes that: A company publishes its catalog on the Internet; Customers view the catalog and: select the merchandise that they want to buy select a form of payment (usually credit card) Send this information to the company via the Internet (How?) Finally, the company receives the order and ships the merchandise;

3. E-commerce scope & benefits E-commerce is not limited to on-line ordering, but it encompasses a variety of activities including: Online banking Business-to-business transactions Bill paying E-commerce benefits: Automated order management Low costs (rent, sale people salaries,…) Quick response

4. E-commerce explosion Between 1993 and 2000 e-commerce grew from an insignificant novelty to mainstream business; Now, many large and small businesses provide for buying on the Internet. Retail e-commerce sales (billions of dollars)

5. Security and e-commerce E-commerce became feasible only when secure mechanism were in place that guaranteed the authenticity and privacy of a message; When a browser sends a message containing confidential information (credit card number), it: Encrypts the message, or If the form does not require secure transfer, it notifies the client that the message is sent in clear  it is up to the user to decide whether to proceed or not;

6. Certificates Certificates are used to disseminate the public key of a person or an organization. Certificates are statements encrypted (signed) by trusted parties which contain information, like public key: Ex: certificate=encrypt(priv T,{Columbia, public key of Columbia}) Certificates are stored by well known organizations When a browser needs to obtain or verify a public key it retrieves the company certificate from one of the organizations mentioned above.

7. SSL The most widely-used protocol devised for secure communication is SSL (Secure Socket Layer) built on top of TCP/IP. Allows to verify the authenticity and ensure the privacy of a message; When a message is sent by an enterprise E, the receiver needs to know that it is authentic: the message is encrypted with the private key of E; The public key of E is verified by obtaining a certificate

8. SSL (cont.) When a message is sent by a customer to E, it needs to remain confidential It is encrypted with the public key of E  only E has the correspondent private key, so only it can read the message Note that a browser needs to know only few public keys: the public keys of the trusted organizations that sign certificates; However, based on them a far wider web of trust is created.

9. Digital Money Digital cash---the electronic equivalent of cash Like cash, digital cash is not-traceable to the client that used it to make a purchase; Cash is a special kind of printed paper, that banks recognize to held a certain value Like cash, digital cash is (usually) a statement, containing a certain amount, digitally signed (encrypted) by a bank.

10. How Digital Money Should Work A person X, transfers electronically a certain amount from their bank account into a digital wallet; When making a purchase, X: specifies the digital wallet as the source of payment, and gives the vendor an authorization to deduct the amount of purchase from the digital wallet; Finally, the vendor goes with the authorization and the digital money to the bank and requests a transfer of funds.

11. Digital Cash is Expensive In order to pay with digital cash, the bank and the vendor have to: perform many computations required to encrypt/decrypt messages Communicate with each other;  digital cash becomes expensive to use, especially if the price to be paid is small Ex: if you make a purchase of 5c, and the cost of processing your transaction is 10c, your business is not profitable. Conclusion: digital cash is still not used

12. Another problem If we have a private company that would like the following: Make some services available within the company such as Telnet, FTP, HTTP between the company's hosts. Disallow outside users from gaining access to the company's internal hosts via Telnet, FTP, etc. Allow users from the Internet to visit the company's WWW home pages. Allow the exchange of e-mail with others on the Internet.

13. And another solution It is impossible to restrict traffic, using the security mechanisms discussed so far. What we need is a “gatekeeper” that can distinguish what services to allow and which to block. The general term for this is a firewall.

14. Firewalls A firewall is a dedicated computer placed between the Internet and the company’s computers.

15. Firewalls (cont.) The firewall acts as a packet filter: It contains special software that examines the packets and selectively blocks or allows access. Example: Drop any TCP/IP packets coming from the Internet to port 23 (Telnet) of any internal host. Firewalls also filter packets going from the company to the Internet, to prevent Trojan horse attacks