1. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues1 Lecture 9: E-commerce & Business r E-Commerce r Security Issues m Secure Transaction m Secure Network

2. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues2 1. E-Commerce r refers to all commercial transactions conducted over the Internet, may include: m Banking m Sending orders m Investing r E-Business Models Store Front Shopping-Cart Technology Auction Model

3. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues3 1. E-Commerce Models r Storefront m What many people would think when they hear “e-commerce.” m Enable merchant to sell products online Organize product catalogs through their websites Take orders through the web Accept payment Manage customer information r Shopping-cart m Allows customers to accumulate items they wish to buy as they browse the website. m Eg, Amazon.com r Auction Model m Web offers a wide variety of auction sites that act as forums for Internet to assume the role of sellers and buyers. m Eg, eBay

4. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues4

5. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues5

6. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues6 1. E-Commerce & security r Security Made E-Commerce Possible m The most common form of e-commerce transaction consists of a retail purchase from a catalog. m Provides a way for user to: Purchase the item Manipulate a shopping cart Select a payment method

7. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues7 1. Secure Sockets r A browser keeps messages private by using encryption technology. m Encryption process is entirely hidden from users. m Browser handles the details m Encrypts the message before sending it m Technology used: SSL (Secure Socket Layer) m With SSL, a browser can encrypt messages so that the content remain private

8. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues8 2. Cryptography r 2 categories of cryptography based on key used: m symmetric key crypto: sender, receiver keys identical m public-key crypto: encrypt key different from decrypt key plaintext ciphertext K A K B

9. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues9 2. Cryptography Concepts plaintextciphertext Encryption Decryption Cryptosystem Secret Key System Public Key System This is a plaintext xMa%@1 gH*lbz Cryptography process data into unintelligible form idea of encryption

10. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues10 2. Cryptographic Algorithms r Secret key algorithms m DES (Data Encryption Standard) m IDEA (International Data Encryption Algorithm) r Public key algorithms m RSA (Rivest, Shamir, and Adlerman) r Message Digest (cryptographic checksum) m MD5

11. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues11 2.1 Secret (Symmetric) Key r Encrypting and decrypting a message using the same key m Sender sends message and key to receiver r Problems: m Key must be transmitted to receiver m Different key for every receiver m Key distribution centers used to reduce these problems Generates session key and sends it to sender and receiver encrypted with the unique key r Example of encryption algorithms: m Dunn Encryption Standard (DES), Triple DES, Advanced Encryption Standard (AES)

12. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues12 2.1 Secret Key (DES) Symmetric plaintextciphertext Encrypt This is a plaintext xMa%@1 gH*lbz Decrypt plaintext This is a plaintext secret key

13. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues13 2.2 Public (Asymmetric) Key r Encrypting and decrypting a message using different keys m Asymmetric – two inversely related keys Private key Public key m Each party has both a public and a private key m Either the public key or the private key can be used to encrypt a message m If public key encrypts only private can decrypt and vice versa m Encrypted with private key Proves identity while maintaining security r Example: RSA public key algorithm

14. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues14 2.2 Public Key (RSA) plaintextciphertext Encrypt This is a plaintext xMa%@1 gH*lbz Decrypt plaintext This is a plaintext Asymmetric private key public key

15. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues15 2.3 Message Digest r Although secret codes cannot be decrypted, hackers can intercept it, add a few bits and change the message completely r How to prevent this to happen? m Send a message digest together with the message r What is a message digest? m a hashed message and has very few bits (typically between 128 - 256 bits) Document One-way hashing function Message digest

16. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues16 2.3 Message Digest r Message Digest m MD5 (cryptographic checksum) m Hash algorithm (one-way function) m input: variable length message (or a document) m output: fixed length cryptographic checksum (eg 128 bits) m result also called the hash or message digest m protect message integrity (eg, against deliberate and accidental tampering)

17. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues17 2.3 Message Digest r A simple example of hashing function using remainder m e.g. Let a = 1, b = 2,..., z = 26 r to hash ‘apple’ into a number between 0-9 m add up the letters m apple = 1 + 16 + 16 + 12 + 5 = 50 m divide the sum by 10 m the remainder is the hashed value (= 50/10 = 0) m send ‘apple’ together with the hash value 0 r if apple is changed to opple, you can detect it because the hash code is different m o=15, o+p+p+l+e = 64, hash code = 4

18. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues18 2.4 Security Services & Cryptography Security Cryptography algorithms Public key (e.g., RSA) Secret key (e.g., DES) Message digest (e.g., MD5) Security services AuthenticationPrivacyMessage integrity

19. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues19 2.4 Security Services & Cryptography r Security services m Privacy: preventing unauthorized release of information m Authentication: verifying identity of the remote participant m Integrity: making sure message has not been altered r Functions provided by cryptography m Privacy: only those who know the (private & public) keys can encrypt and decrypt the message m Authentication: Use a digital signature (a code that can be generated only by a participant, eg using his/her private key) m Integrity: A message integrity code (MIC) is added to the message; MIC as a kind of checksum

20. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues20 2.5 Digital Signatures r Digital signature m The electronic equivalent of written signatures. m Authenticates sender’s identity Sender (Bob) digitally signs document, establishing he is document owner/creator. Verifiable, nonforgeable: recipient (Alice) can verify that Bob, and no one else, signed document. m Digital signature combines public-key algorithm with message digest. Digital signature = signed message digest Sender used its private key to sign the message.

21. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues21 2.5 Digital Signatures r Bob sends digitally signed message: r Alice verifies signature and integrity of digitally signed message:

22. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues22 2.6 Transaction Security Protocols r Secure Sockets Layer (SSL) m Uses public-key technology and digital certificates to authenticate the server in a transaction m Protects information as it travels over Internet Without using SSLWhen using SSL

23. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues23 2.6 Transaction vs. Network Security r Transaction security protocols protects information as it travels over Internet m It does not protect once stored on receiver servers m Need to protect the servers: protect the network - network security protect the building where the servers are located r Network security m Allow authorized users access m Prevent unauthorized users from obtaining access m Example: firewall

24. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues24 3. Firewalls r A specially programmed router between a site and the rest of the Internet r connects to 2 or more networks r forward and filter packets r Denial-of-service m filters packets based on source IP address m protect hosts within a site from unwanted flooding of external packets r 2 categories m filter-based m proxy-based Rest of the InternetLocal siteFirewall

25. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues25 3. Firewalls r Filter-Based Solution m table of entries (source IP addr, source port, dest. Ip addr., dest. Port) m example filter all packets from port 1234 on host 192.12.13.14 addressed to well-known port 80 on host 128.7.6.5 ( 192.12.13.14, 1234, 128.7.6.5, 80 ) Filter all packets addressed to port 80 on 128.7.6.5 (*,*, 128.7.6.5, 80 ) only allow access to port 25 (eg mail server) (*,*, 128.19.20.21, 25) m how dynamic? Install new filters as firewall is running patterns extended to include new ports as new TCP connections are established (may not know port number in advance)

26. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues26 3. Firewalls r Problem: complex policy r Example: to make certain pages of a web server available to all external users r unable to express policy as filters Company net Firewall Web server Random external user Remote company user Internet

27. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues27 3. Firewalls r Solution: put HTTP proxy on firewall r proxy: a process between a client & a server r remote user establish connection to proxy r If requested page is allowed establish connection to server else return error r Policy embodied in application specific proxy External client External HTTP/TCP connection Proxy Firewall Internal HTTP/TCP connection Local server

28. INE1020: Introduction to Internet Engineering 6: Privacy and Security Issues28 Further Readings r Reading assignment: chp 30, text book r This lecture is intended to provide a brief introduction of network and transactional security, students who wish to invest more time on studying security issues are referred to the following resources: r Security Issues: m Davis Chapter 8. r A master-level course IEG 7006: System Administration and Network Security, explore in-depth issues of security