A REVIEW: ELECTRONIC PAYMENT
GATEWAY SYSTEM
Er.Jaspreet Kaur1,Er.Shiwani Aggarwal2, Gurpreet Kaur3
1
CSE.LCET,KATANI KALAN
Email Address
1raijaspreet@gmail.com
2
IT.LCET,KATANI KALAN
Email Address
2shiwani.aggarwal20@gmail.com
3
IT,PCTE Group of Institutes
Email Address
3gurpreetrai1990@gmail.com
ABSTRACT – This paper discusses a secure and
protected system of electronic payment for
transactions over the Internet. A service provider or
a merchant is paid online with electronic payments.
The online transaction payment system offers a
gateway that utilizes different security tools to
protect the customer’s information of credit or debit
card; it is a channel between the payment
processors and the users. Although the information
or customer’s data is not totally hidden or protected
as the merchant has access to some of the
customer’s information. Trust towards the online
system is imperative for the success of e-commerce.
This paper signifies the perceptions of security and
privacy on online transactions. Customer’s trust is
very important in addition to other known factors.
Keywords: Payment Gateways, Online Payment
Systems, Safe Electronic Transaction, electronic
commerce, Dual Signatures, online trust.
commerce industry, which engages the flow of money that is to
be obtained in electronic form for the products or services
provided. In contrast, internet is also known to be the fake,
fraudulent,
unsecure
and
an
untrustworthy
mode
of
communication for the online payment system. As the frauds and
scams are increasing in the e-commerce online payments
different reliable gateways are also coming into the picture of
internet community. Critical issues involvements in the
transaction security system all over the global world in methods
of securing a financial transaction are conveyed over different
stages of a transaction. Some financial institutions like banks are
in the process of making and providing an proficient and secure
means for online sales and purchase. They are also trying to
motivate the people towards e-commerce.
E-commerce and payment transactions handling in a vigorous,
strong and effective payment system are necessary; this
guarantees the legitimacy and authorization of users and the
payments. A user can conduct online transactions if only he/she
I INTRODUCTION
haves an online account over the system and a valid debit/ credit
card. While taking the responsibility of an online monetary
Advancement in the e- commerce has made the online
transactions as the most convenient, easy and reliable form of
doing payments in the financial transactions. E-commerce
transaction there is always a sense of uncertainty and lack of
confidence to give information details over the internet. The
system guarantees the authentication of the privacy level of the
industry plays a foremost and imperative role in refurbishing the
user’s information to all the delivery channels. The privacy is to
online business i.e. performing online sales and purchase of
be kept of the transaction details and the customer’s personal
different products over the internet. Internet has provided a
descent and vast platform for the revolution of electronic
information.
Internet and different online systems are now incrementally
commerce application service source that approves payments for
developed making the customers easy to use it. More suitable
online
and convenient ways are now available for the conductance of e-
Payment gateways shield the details by encrypting susceptible
commerce. Secure payment gateways must be ensured for the
information, such as card and account numbers, to guarantee
financial transactions to protect and private the delivery of the
that information is conceded securely amid the customer, the
information details.
trader and the payment processor.
Various methods are available to encrypt and decrypt the
A Working of the payment gateways
transaction and personal details that are exchanging in between
A gateway assists the transmitting of information amid a
the users and the merchant in a secure payment gateway
payment portal (e.g. a website, cell phone or an IVR service)
technology. For a transaction, occurring over the internet,
and acquiring bank or the Front End Processor. When a
through a secure channel includes a total of three parties i.e. a
customer orders a product or service variety of tasks is
user who is paying, a service provider/ merchant to whom the
performed by the online payment gateway to continue process
money is paid via a system and the financial organization like
the transaction.
retailers, e-businesses, bricks
and
clicks.
banks or any other payment processing subsidiaries such as
payza, paypal, etc. In such situation, all of the three are
2.1.1) Placement of order takes place by the customer on
associated
pressing the 'Submit Order' or any other comparable button.
through
a
safe
and
protected
means
of
communication. The persons interfering the network traffic
Credit card details are also entered using any authentic service.
gains access to the sensitive information of the customers such
as credit/ debit card nos. account information, identity numbers
2.1.2) Encryption of the information by user’s browser to send
and many more. To secure the information the gateways in the
to the merchant's web server is the next step. Several methods
online system utilizes different encryption algorithms and
are available for encryption in which one of them is
cryptographic techniques.
via SSL (Secure Socket Layer)
2.1.3) Direct payment to the merchant bypassing the merchant's
II HISTORY
To establish an online transaction, one needs to form a payment
systems from the user’s web browser. This lessens the
gateway on the e-commerce site that enables online shopping
merchant's PCI-DSS conformity obligations without redirecting
and offers the customers to pay by debit or credit card. Choosing
the user away from the site.
the secure and authentic payment gateway is one of the most
difficult steps. The channel takes the billing information
2.1.4) Forwarding of details by the merchant/ trader to the
submitted by the user’s computer, through a protected server,
payment gateway occurs. This is another connection of
and towards the service provider account that is present in the
encryption to a payment server that is hosted by the gateway.
financial institution. The entry transaction is invisible and
flawless to the customer, but to those worried about the
sanctuary,
An
it
is
online payment
no
matter
which
gateway system
but
invisible.
is
an
e-
2.1.5) Payment processor receives the transaction details by the
payment gateway used by the merchant's obtaining bank.
2.1.6) The card association (i.e. Visa/ Master Card) receives the 2.1.16)
The total of the approved funds is deposited in to the
merchant’s nominated account through bank after a day or so. It
details from the payment processor.
may be on the same bank as if the merchant do banking with the
2.1.7) The arrival of the authorization request by a credit card
same bank.
issuing bank and fraud occurs then the debit or credit checks and 2.1.17) It takes almost 3 days to complete the process from
send a rejoinder to the processor (via same method) with a authorization to settlement.
response code [such as: approved or denied].
2.1.8)
Some gateways also provide their customers various tools to
A response code is utilized at the time of failure of a
transaction and defines it why it happens such as it can occur
because of unavailable bank link or insufficient funds. In the
meantime, the card issuer holds an agreement linked with that
detect fraud and to calculate tax on the payment. Geo-location,
velocity analysis on patterns, blacklist lookups, computer finger
print technology, list of OFAC and other such tools are used to
detect fraud.
merchant and customer for the approved amount. This impact
III SECURE PAYMENT GATEWAY SYSTEM
the consumer's ability as it decreases the line of credit available
INFRASTRUCTURE: REUIREMENT ISSUES
to the customer.
2.1.9)
The payment gateway receives the authorization reply
Acceptance and trust of the clients plays a significant role in ecommerce world as online transactions are concerned. Most of
from the processor.
2.1.10) The payment gateway then forwards it to the website or
any other interface that is utilized to process the payment. There
it is inferred as an applicable response then relayed back to the
card holder and the merchant; it is the Authorization or "Auth"
the customers pays for the thing before seeing it in the concrete
form, as the payment is done electronically. Integrated software
and hardware is used to pay for the goods and services through
online system. This system is called EPS and its main objectives
are to increase security of payment, customer satisfaction and its
2.1.11) This process will take approximately 2 to 3 seconds.
2.1.12) The merchant then assures that all the orders are
completed and then the whole process is repeated but that time
consumed is termed as Clear. The word Clear is initiated when
the merchant had accomplished the transaction. After this
convenience and to enhance efficiency. These type of systems
are not matured yet abut some appreciable improvements have
been done in this field. There are many other methods and
functions through which we can enable the implementation of
EPS.
procedure the issuing bank clears the auth and then it prepares
to settle the deal with the merchant acquiring bank.
2.1.13)
The
merchant
then
offers
all
the
approved
authorizations in a batch that may be the end of the day to the
acquiring bank for the settlement through its processor.
2.1.14)
The batch settlement request of the credit card issuer is
made by the acquiring bank.
2.1.15)
The next day the acquiring bank makes a settlement
payment with the credit card issuer.
Figure 1 Electronic payment scheme
access it to make it inconveniencing for him or to have some
A EPS SECURITY MODEL
other impact. Just for an example, if anyone breaks any website
CIA triad is one of the widely applicable security models but it
of a specific search engine its rival will get more opportunity to
is very simple. There are three main and key principles, which
become popular.
should be present in any secure system, they are availability,
confidentiality and integrity. The whole subject of Security
3.1.4) Public Key Cryptography: Two keys are used in public
analysis is applicable through these principles. Its security
key cryptography; the first key is used publicly and the second
should be from encrypted data on internet to the user’s internet
one is used privately in order to encrypt and decrypt data. It is
history. Breach in any of the three principles can cause great in-
the process through which, we can assure the integrity, security
convenience and consequences for the all parties concerned. To
and accuracy of the data; by changing it to an unreadable form
have a secure electronic funds transfer is more crucial to e-
for the user called cipher text. The one who have the private key
commerce. To assure the integrity and security of every
can decrypt the data into the plain form to make it useable for
electronic transaction all the described security measures or
him. Public key cryptography is a method in which two keys are
some of them directly relates to EPS. These technologies are
used, one is public and second is private but in contrast to this
digital signatures, authentication, certificate and public key
system, private key cryptography uses one key for encryption.
cryptography.
The benefit of using two key techniques is to allow the
businesses to give away the public key to anyone who wants to
3.1.1)
Confidentiality:
To
hide
information
from
the
send a message to them. The sender has the ability to encrypt
unauthorized users and people is known as confidentiality. It is
the data and can send it to the receiver through internet or any
the most obvious aspect of the CIA triad when we talk about the
public network. Then the receiver who has the private key can
security. But it is also correspondingly one of the main thing
decrypt the data and it is clearly that the private key is not
that is most often attacked. There are many methods through
publicly known.
which confidentiality could be ensured; like encryption and
cryptography. These methods use to transfer the data from one
3.1.5) Digital Signature: The digital signature is the electronic
computer to another safely.
one that is used to authenticate some message or any document
rather than the written signature by the individuals. The latest
3.1.2) Integrity: To ensure that the data transferred is accurate
and it is not changed from the original text is the ability that is
known as integrity. It should be the representation of the
original source; it is attacked in such a manner that it is often
changed before sending it to the receiver computer.
3.1.3) Availability: The administration should also make the
data and information accessible to all the authorized users all the
time. Very important factor should be considered. The attack on
this principle is done by not allowing the authorized user to
technology of E-check also enables the digital signature to only
applied for document blocks rather than the whole document.
This allows the user to separate the part of the document from
the original one without compromising the integrity of the
digital signature. This helps the businesspersons to transfer the
legal documents over the web in a safer way. A digital signature
is not a very complex system it is just an electronic message,
which is encrypted with a private key.
IV KEY THREATS TO INSECURE ONLINE
TRANSACTION SYSTEM
4.6.2) Chosen Plaintext and Chosen Cipher text Attacks: A
chosen plaintext attack is in which a cryptanalyst encrypt the
Almost every computer either they are government/personal or
plaintext of the chosen and studies the consequential ciphertext.
belongs to an organization they are severely affected by the
This is against the asymmetric cryptography, in which a
security threats. The security threats while making the
cryptanalyst accesses to a public key.
authentication requirements are described below:
An attack where a cryptanalyst prefers a cipher text and put
A Online Guessing: An unauthorized person connects to the
effort to establish a matching plaintext is a chosen ciphertext
verifier via any network; and tries to achieve a secret token that
attack. This is done with a decryption oracle that is a machine
may be password etc in the attack. He has the goal to affect the
capable of decrypting without revealing the keys. This is often
legal user.
executed on attacks vs. the public key encryption; it commences
B Session Hijacking: Hijacking is the security attack in which
with a ciphertext and investigates for corresponding publicly
the person tries to attempt to take over the application user
situated plaintext data.
session. Session hijacking is done with the technique that the
V EMERGING ISSUES WHILE ERFORMING
session may be protected with initial authentication transaction
ONLINE TRANSACTIONS
in the beginning of the session but not thereafter.
A Do I need to upgrade my online accounts to use Extended
C Phishing: This is also called verifier impersonation attack in
Validation (EV) certificates?
which the attacker behaves to fool the user into exposing the
EV certificates don’t require the updating of online account and
secrets.
information details; some mails trick the individual into giving
D Replay: In replay attack, the attacker replays and record a
financial and personal details by saying that it is needed to
few parts of a preceding successful authentication protocol
upgrade the account. They trick by saying that it is need to
operation to the verifier to gain access to susceptible data.
secure the account with an EV certificate. Internet Explorer, a
E Exploit attack: The exploit attacker knows a security
web browser, supports the EV certificate natively and there is no
problem of an operating system and influences that knowledge
additional need other than to visit a website. If bank uses an EV
by utilizing the vulnerability.
certificate, the address bar at the browser will be green and if
F Cryptographic Attack Methods: These are six attack
green bar is not available, then the website does not utilize an
methods, comprising three ciphertext-based plaintext-based and
Extended Validation certificate.
three plaintext-based methods:
4.6.1) Known Plaintext &Ciphertext: Only Attacks
A plaintext attack is where a cryptanalyst has right of use to a
plaintext and to the analogous ciphertext. It seeks to determine
an association between the two. A ciphertext-only attack is one
in which a cryptanalyst accesses to a ciphertext but do not has
access to the equivalent plaintext. The Caesar Cipher frequency
study uses to split the cipher.
B If a website offers secure transactions, does it mean that a
website is safer to use?
It is not necessary that if a website practices a secure financial
transaction than the website is also a safe page to visit; the
secure and encrypted connection is not an assurance for a safer
use. A safe connection only promises the identity of a website,
supported on the information offered by the certifying
organization. Consideration should only be giving to a personal
information to a secure and trusted website.
C How can I increase the safety of my online transactions?
that the user does not have to install any additional software
In the absence of certification of safety on website, you can
to get digital certificate.
reduce online privacy or the different security problems of
utilizing a website that you are acquainted with and trust.
Internet Explorer cannot identify if an owner of a website is
trustworthy or not. It is always recommended to use the sites
that are previously used by you and the trusted family and
friends. Phishing Filter of Internet Explorer helps identify the
fraudulent and fake websites
ACKNOWLEDGEMENT
It is our pleasure that we have such seniors, research fellows
and other committee members that we like to thank them. It
would be not be possible to complete this paper without their
help and guidance. Want to give special thanks to Mr.Pankaj
Singh as he inspired us and motivated us with their vast
D What does it mean to have a mixed content?
experience in this field. Lastly, we would also like to thank
Mixer content comprises of secure and the non-secure content,
God for his showers of blessings on us.
that identifies that a webpage is on the way to display the secure
and non-secure elements web server connections (HTTPS/SSL
REFERENCES
[1] Jiangtao Li and Ninghui Li. OACerts : Oblivious Attribute
and HTTP. This occurs with financial transactions occurring in
Certificates, CERIAS and Department of Computer Science, Purdue
the stores or other sites that depicts banners, images, scripts or
University
anything receiving from a unsecure network. The mixed content
[2] Mohamed Nabeel, Elisa Bertino. CloudMask Private Access
display is at a risk that a non-secure webpage may be capable of
accessing the information from the secure content.
Control in the Cloud, Purdue University, West Lafayette, Indiana,
USA
[3] Ning Shang, Mohamed Nabeel, Federica Paci, Elisa Bertino. A
Privacy-Preserving Approach to Policy-Based Content
CONCLUSION
We have to examine the security measures of various
Dissemination, Purdue University,West Lafayette, Indiana, USA
companies before choosing a payment method as the
H. Hussmann. Touch me once and I know it’s you!: implicit
reputation of our business depends upon it. The provider
authentication based on touch screen patterns. In Proceedings of the
should have proper arrangements and security techniques.
128-bit digital certificate is the way through which the data
[4] De Luca, A. Hang, F. Brudy, C. Lindner, and
2012 ACM annual conference on Human Factors in Computing
Systems, CHI ’12, pages 987–996, New York, NY, USA, 2012.
[5] R. Biddle, S. Chiasson, and P. van Oorschot. Graphical
could be secured. The warehouse where data is stored and
passwords: Learning from the first twelve years. Technical report
payment gateway services are housed should have proper
TR-11-01, School of Computer Science, Carleton University,
physical and informational security arrangements. Firewall
January 2011.
and intrusion detection systems should have been installed
[6] Ajeet Singh, Gurpreet Kaur, M.H Khan, Manik Chandra,
Shahazad,
National Conference on Information, Computational Technologies and e-
on the providers operating system. It should also have
Governance (NCICTG 2010) in Laxmi Devi Institute of Engineering &
database security and transaction security in that place. The
Technology, Alwar (Raj), India ,”The Secure Electronic Payment System Using
data cryptography and authenticity checking is the benefit
SET Protocol Approach. 19 to 20 Nov- 2010.
of the online transactions. The merchant is not allowed to
see the payment information and customer can use the
system easily. Another advantage of using this system is
[7] Ajeet Singh, M.H Khan, Manik Chandra, Shahazad “Implementation of
Payment System for Internet Transaction” International conference on
concurrent Techno and Environ search-in Bhopal, India, 4th-5th Dec. 2010.