1. Application Fields of the Austrian Citizen Card in e-Commerce Diploma thesis of Christoph Baumann Institute for Applied Information Processing and Communications (IAIK) Graz University of Technology, Austria

2. Application Fields of the Austrian Citizen Card in e-Commerce or How to use smartcards for secure payment in Internet B2C e-Commerce

3. ● Introduction ● Current situation in B2C e-Commerce ● Concept of a secure payment model with smartcards ● Overview of an Implementation ● Demonstration ● Summary Overview of the presentation

4. About the citizen card ● Concept for e-Government ● for every citizen ● Smartcard providing secure electronic signatures ● based on European Community framework for secure electronic signatures Introduction

5. Problems of Internet B2C e-Commerce: ● no confidence in Security Standards (65%) ● no personal consulting (50%) ● appropriate offers difficult to find (35%) ● no „real“ shopping experience (30%) Source: Summary of Studies on e-Commerce, E-Business, Franz-Joachim Kauffels Current situation in B2C e-Commerce 1/ 2

6. Current situation in B2C e-Commerce Common payment methods ● Credit Card ● Pay on delivery Payment usually involves sending sensitive data like the credit card number to the shop 2/2

7. Concept of a secure payment model Payment from the customers view should be ● anonymous ● secure ● with the help of a trusted third party ● simple 1/4

8. Concept of a secure payment model Payment from the shops view should be ● easy to integrate ● secure ● contracted out (Outsourcing) 2/4

9. Concept of a secure payment model Secure Payment per electronic bank-transfer ● like traditional bank transfer ● Payment involves a trusted 3 rd party (Bank) ● secure through digital signatures 3/4

10. Concept of a secure payment model Principle 4/4 CustomerShop Bank (1) (2) (3) (1) prefilled money order form (2) signed money order (3) money order receipt

11. Overview of an Implementation Outline of the Implementation 1/ 2 Bank Portal Shop 1 Shop 2Shop x Customer (1) (2) (3) (4) (1) order data (2) prefilled, signed order form (3) signed money order (4) signed money order receipts

12. Overview of an Implementation Bank –> Shop (money order receipt) 2/2 Bank UDDI Registry Shop Step 1 UDDI Step 2WSDL Step 3SOAP-SEC premised on secure Webservices Service location Service description Service invocation

13. Demonstration Let's go shopping... http://demoportal.buergerkarte.at 1/5

14. Demonstration The order is confirmed... http://demoportal.buergerkarte.at 2/5

15. Demonstration The prefilled money order form... http://demoportal.buergerkarte.at 3/5

16. Demonstration Signing the money order form with the card... http://demoportal.buergerkarte.at 4/5

17. Demonstration The money order receipt for the customer http://demoportal.buergerkarte.at 5/5

18. Summary Secure Payment by bank-transfer ● involving secure electronic signatures in every step ● employing standard technology (HTTPS, HTML, XML / XML-DSIG, UDDI, WSDL, SOAP-SEC) ● secure and transparent for the customer ● easy and secure for the shop

19. Questions