E-commerce Security System

8.2 E-commerce Security System

In the above e-commerce infrastructure, the security issue in e-commerce is not discussed in detail. But it does not mean that the consideration of security in e-commerce system could be neglected or is in the minor position. Oppositely, the e-commerce system built on the basis of Internet not only needs to handle various security issues, but also must meet some specific security control requirements in e-commerce interaction. Therefore, in the transition process from traditional trade mode based on the paper to the electronic trade mode, how to keep the electronic trade mode secure as the traditional mode is the focus, and also is one of key problems in the widely application of e-commerce.

This section will discuss the security issue in the e-commerce infrastructure, and detail the solution of security issue in e-commerce through analyzing noumenal security architecture of network and the specific security factors and control methods of e-commerce.

1. OSI security architecture

OSI security architecture instituted by ISO is an academic basis for study and design computer network system and for estimating and improving existing systems. OSI security architecture defines functions of security services, security mechanism and security management, and presents the logical relations among OSI network layers, security service and security mechanism. OSI prescribes five standard security services:

Object authentication security service: both sides of communication authenticate the validity and authenticity of each other, to prevent cheat.

Access control service: used to prevent unauthorized users to use the system resources illegally.

Data secrecy service: used to prevent information to be intercepted or betrayed by illegal entities.

Data integrity service: used to prevent the change, insert, delete exchanged data form illegal entities and lost of data.

Preventing denying security service: used to prove occurred operations, and prevent the denying of the happened behaviors.

Security service is implemented by security mechanism. OSI defines eight types of security mechanisms: encryption mechanism, signature mechanism, access control mechanism, data integrality mechanism, authentication exchange mechanism, business flow filling mechanism, route control mechanism and notarization mechanism. The relation of security mechanism and security service is shown in Table 8.1.

8 E-commerce Architecture and System Design

Table 8.1 The relation of security mechanism and security service

Data Deny Mechanism

Security Object

Access

Data of

Authentication Control Secreting Integrality Preventing

Encryption

Ĝ Signature

Ĝ Ĝ Access Control

Data Integrality Ĝ Ĝ Authentication

Exchange

Business Flow Fill

Route Control

Notarization Ĝ

2. E-commerce security factor

(1) Validity: Controlling and preventing the hidden threat caused by network failure, operation error, application error, hardware failure, system software error and computer virus, to guarantee trade data valid at certain time and in certain place.

(2) Confidentiality: E-commerce is built on the open Internet environment, and maintaining business confidentiality is an important safeguard for widely spreading e-commerce application. Therefore, it’s necessary to prevent illegal access of information and to prevent information from to be wiretaped in the transmission.

(3) Integrality: E-commerce system should prevent to generate, update and delete information arbitrarily, avoid losing and repetition of information and guarantee the order of information transmission.

(4) Reliability: It’s impossible to distinguish handwriting signature and seal in the non-paper e-commerce mode, so reliable identifiers are needed for individuals, enterprises or countries involved in information transmission in an e-commerce transaction.

The security factors and security service of various e-commerce and network are all implemented by security technologies. The e-commerce security technologies based on Internet mainly include: data encryption, authentication and digital signature and firewall.

PKI is used as core technology of information security in the security subsystem of e-commerce infrastructure. The detailed process and data flow are briefly explained below, taking example mutual authentication between e-commerce entities as example.

Assuming that e-commerce entity A and B adopt RSA public key to authenticate each other, the protocol is shown as follows:

A sends its identity to B.

B chooses a random number R D , and encrypts it with A’s public key to get y1, then sends y1 and y2 which is generated by encrypted y1 with its private key to A.

Introduction to E-commerce

Figure 8.19 Mutual Authentication Process of e-commerce Entities Based on PKI

8 E-commerce Architecture and System Design

After A receives y1 and y2, it validates y2 with B’s public key. If the result is the same as y1, then B is confirmed.

A decrypts y1 with its private key to obtain R D ; at last, A encrypts R D with B’s public key to obtain y3, and sends y3 to B. After B receives y3, it decrypts it with its private key. If obtain R D , it assures that the other party is A, otherwise a hacker. After that a cycle of authentication process is finished.

We can see that, the above simple protocol model has four behavior bodies: Entity A, Entity B, hacker and management organization adopted PKI framework. The hacker could cheat A or B, entities such as CA and certificate database in PKI take charge of work such as distributing and protecting public key. The flow chart of the protocol is shown as Fig. 8.19.

The whole mutual authentication process could be described with PASCAL-like language as the following:

Program Authentication_Process //Description of sub-process and function; Procedure Send_To(Message_Sender,Message_Receiver,Message); //Function of

authentication entity sending information; Procedure Show_Message(Message: String); //Display system prompt information; Procedure Authentication_Terminated(); //Authentication error, system exits

abnormally; Procedure Authentication_Finished(); //Authentication is finished, exit

normally; Function Encrpt(Key,Message): Message; //Encrypt Message with Key; Function Decrpt(Key,Message): Message; //Decrypt Message with Key; Function Get_Public_Key(Entity): Key; //Get public key of Entity; Function Get_Private_Key(Entity): Key; //Get private key of Entity;

Begin //Body of authentication process; Send_To(A,B,IdentifierOfA); //A sends its identifier to B Y1:=Encrpt(Get_Public_Key(A),Random()); //B encrypt random number with

A's public key; Y2:=Encrpt(Get_Private_Key(A),Y1); //B encrypts Y1 with its private key; Send_To(B,A,Y2); If (Y1<>Decrpt(Get_Publc_Key(B),Y2))Then

Begin Show_Message("Cracker Imitates B")˗ Authentication_Terminated(); //Authentication error, abort protocol

End Else Begin R D :=Decrpt(Get_Private_Key(A),Y1);

Y3:=Encrpt(Get_Public_Key(B),R D );

Send_To(A,B,Y3);

If (R D <>Decrpt(Get_Private_Key(B),Y3))Then

Begin Show_Message("Cracker Imitates A");

Introduction to E-commerce

Authentication_Terminated(); End Else Begin Show_Message("Authentication is Finished"); Authentication_Finished();

End End End

In terms of Petri net theory, the specific data flow and information flow in the mutual authentication protocol could be analyzed in detail. The more detailed analysis is omitted here, we refer the interested readers to related resources.