Uploaded by bipinshukla


Security is an essential part of any transaction that takes place over the internet. Customers
will lose his/her faith in e-business if its security is compromised. Following are the essential
requirements for safe e-payments/transactions −
Confidentiality − Information should not be accessible to an unauthorized person. It
should not be intercepted during the transmission.
Integrity − Information should not be altered during its transmission over the network.
Availability − Information should be available wherever and whenever required within
a time limit specified.
Authenticity − There should be a mechanism to authenticate a user before giving
him/her an access to the required information.
Non-Repudiability − It is the protection against the denial of order or denial of
payment. Once a sender sends a message, the sender should not be able to deny
sending the message. Similarly, the recipient of message should not be able to deny
the receipt.
Encryption − Information should be encrypted and decrypted only by an authorized
Auditability − Data should be recorded in such a way that it can be audited for
integrity requirements.
Security Protocols in Internet
Secure Socket Layer (SSL)
It is the most commonly used protocol and is widely used across the industry. It meets
following security requirements −
"https://" is to be used for HTTP urls with SSL, where as "http:/" is to be used for HTTP urls
without SSL.
Secure Hypertext Transfer Protocol (SHTTP)
SHTTP extends the HTTP internet protocol with public key encryption, authentication, and
digital signature over the internet. Secure HTTP supports multiple security mechanism,
providing security to the end-users. SHTTP works by negotiating encryption scheme types
used between the client and the server.
Secure Electronic Transaction
It is a secure protocol developed by MasterCard and Visa in collaboration. Theoretically, it is
the best security protocol. It has the following components −
Card Holder's Digital Wallet Software − Digital Wallet allows the card holder to make
secure purchases online via point and click interface.
Merchant Software − This software helps merchants to communicate with potential
customers and financial institutions in a secure manner.
Payment Gateway Server Software − Payment gateway provides automatic and
standard payment process. It supports the process for merchant's certificate request.
Certificate Authority Software − This software is used by financial institutions to
issue digital certificates to card holders and merchants, and to enable them to register
their account agreements for secure electronic commerce.
Digital signatures are used to authenticate the identity of the sender. It is like signing a message in
electronic form. A digital signature is a protocol that produces the same effect as a real signature. It
is a mark that only the sender can make and other people can easily recognize that it belongs to the
sender. A digital signature is also used to confirm agreement to a message. A digital signature must
be unforgeable and authentic. In a digital signature process, the sender uses a signing algorithm to
sign the message. The message and the signature are sent to the receiver. The receiver receives the
message and the signature and applies the verifying algorithm to the combination. If the result is
true, the message is accepted otherwise it is rejected.
A conventional signature is like a private key belonging to the signer of the document. The signer
uses it to sign documents. The copy of the signature on a file is like a public key so anyone can use
it to verify a document to compare it to the original signature. In digital signature the signer uses
her private key applied to a signing algorithm to sign the document. The verifier uses the public key
of the signer applied to verifying algorithm to verify the sign. When a document is signed anyone
her public key to sign the document because anyone could forge her signature. Digital signatures
have assumed great significance in the modern world of web-commerce. Many countries have
made provisions for recognizing digital signature as a valid authorization mechanism like paperbased signatures
Digital Certificate
A digital certificate, also known as a public key certificate, is used to cryptographically link
ownership of a public key with the entity that owns it. Digital certificates are for sharing public
keys to be used for encryption and authentication.
Digital certificates include the public key being certified, identifying information about the entity
that owns the public key, metadata relating to the digital certificate and a digital signature of
the public key the certificate issuer created.
The distribution, authentication and revocation of digital certificates are the primary functions
of the public key infrastructure (PKI), the system that distributes and authenticates public keys.
Public key cryptography depends on key pairs: one private key to be held by the owner and
used for signing and decrypting and one public key that can be used for encrypting data sent
to the public key owner or authenticating the certificate holder's signed data. The digital
certificate enables entities to share their public key so it can be authenticated.
Digital certificates are used in public key cryptography functions most commonly for initializing
Secure Sockets Layer (SSL) connections between web browsers and web servers. Digital
certificates are also used for sharing keys used for public key encryption and authentication
of digital signatures.
All major web browsers and web servers use digital certificates to provide assurance that
unauthorized actors have not modified published content and to share keys for encrypting and
decrypting web content. Digital certificates are also used in other contexts, online and offline,
for providing cryptographic assurance and data privacy.
Digital certificates that are supported by mobile operating environments, laptops, tablet
computers, internet of things (IoT) devices, and networking and software applications help
protect websites, wireless networks and virtual private networks.
Digital certificates vs. digital signatures
Public key cryptography supports several different functions, including encryption and
authentication, and enables a digital signature. Digital signatures are generated using
algorithms for signing data so a recipient can irrefutably confirm the data was signed by a
particular public key holder.
Digital signatures are generated by hashing the data to be signed with a one-way
cryptographic hash; the result is then encrypted with the signer's private key. The digital
signature incorporates this encrypted hash, which can only be authenticated, or verified, by
using the sender's public key to decrypt the digital signature and then running the same oneway hashing algorithm on the content that was signed. The two hashes are then compared. If
they match, it proves that the data was unchanged from when it was signed and that the
sender is the owner of the public key pair used to sign it.
A digital signature can depend on the distribution of a public key in the form of a digital
certificate, but it is not mandatory that the public key be transmitted in that form. However,
digital certificates are signed digitally, and they should not be trusted unless the signature can
be verified.
Encryption is the process of taking plain text, like a text message or email, and
scrambling it into an unreadable format — called “cipher text.” This helps protect the
confidentiality of digital data either stored on computer systems or transmitted
through a network like the internet.
When the intended recipient accesses the message, the information is translated
back to its original form. This is called decryption.
To unlock the message, both the sender and the recipient have to use a “secret”
encryption key — a collection of algorithms that scramble and unscramble data back
to a readable format.