Security And Use Of The Digital Cash example essay topic

Methods of Payment used on the Internet Credit Cards Internet credit card transaction processing can be done in three ways: Manual offline processing (secure credit card capture) - You can collect the orders via snail mail, fax, phone, or credit card capture in your shopping cart (options provided by Etherlinx carts). Using your cart's built-in encryption, you can securely download your customers' credit card information and process the payment offline, using the virtual merchant terminal you already have. Real-time online processing - This method automatically processes the credit card purchase in real time, with online authorization and settlement of transactions. If you choose to accept payments in real time over the Internet, the first step is to apply for an Internet merchant account. You will also require a secure payment processing gateway. The Etherlinx shopping carts are compatible with many payment gateways.

See complete list. Paypal, Internet secure or Devil net (UK). These are viable alternatives for low volume merchants who don't have a merchant account. Digital Cash Digital cash is "virtual" money, which is stored on your computer system and allows you to purchase stuff over the Internet. There are several commercial approaches to digital cash on the Web. Among these are cash from Digi Cash and Cybercash.

Digital cash can also be stored on an electronically sensitive card. This is very new technology and will allow "micro-charging" because people will be able to buy very small amounts of goods. As would-be currency providers should note, there are ten key elements to a successful, private digital cash system. This section compares and contrasts true digital cash to paper cash, as we know it today. Each of the following key elements of digital cash "token" will be defined and explored within the bounds of electronic commerce. Secure.

The transaction protocol must ensure that a high-level security is maintained through sophisticated encryption techniques For instance, Alice should be able to pass digital cash to Bob without either of them, or others, able to alter or reproduce the electronic token. Anonymous. Anonymity assures the privacy of a transaction on multiple levels. Beyond encryption, this optional un traceability feature of digital cash promises to be one of the major points of competition as well as controversy between the various providers Transactional privacy will also be at the heart of the government's attack on digital cash because it is that feature which will most likely render current legal tender irrelevant Both Alice and Bob should have the option to remain anonymous in relation to the payment. Furthermore, at the second level, they should have the option to remain completely invisible to the mere existence of a payment on their behalf. Portable.

The security and use of the digital cash is not dependent on any physical location. The cash can be transferred through computer networks and off the computer network into other storage devices. Alice and Bob should be able to walk away with their digital cash and transport it for use within alternative delivery systems, including non-computer-network delivery channels. Digital wealth should not be restricted to a unique, proprietary computer network. Two-way. The digital cash can be transferred to other users.

Essentially, peer-to-peer payments are possible without either party required to attain registered merchant status as with today's card-based systems. Alice, Bob, Carol, and David share an elaborate dinner together at a trendy restaurant and Alice pays the bill in full. Bob, Carol, and David each should then be able to transfer one-fourth of the total amount in digital cash to Alice. Off-line capable. The protocol between the two exchanging parties is executed off-line, meaning that neither is required to be host-connected in order to process.

Availability must be unrestricted. Alice can freely pass value to Bob at any time of day without requiring third-party authentication. Divisible. A digital cash token in a given amount can be subdivided into smaller pieces of cash in smaller amounts. The cash must be fungible so that reasonable portions of change can be made. Alice and Bob should be able to approach a provider or exchange house and request digital cash breakdowns into the smallest possible units.

The smaller the better to enable high quantities of small-value transactions Infinite duration. The digital cash does not expire. It maintains value until lost or destroyed provided that the issuer has not debased the unit to nothing or gone out of business. Alice should be able to store a token somewhere safe for ten or twenty years and then retrieve it for use. Wide acceptability. The digital cash is well known and accepted in a large commercial zone.

Primarily a brand issue, this feature implies recognition of and trust in the issuer. With several digital cash providers displaying wide acceptability, Alice should be able to use her preferred unit in more than just a restricted local setting. User-friendly. The digital cash should be simple to use from both the spending perspective and the receiving perspective. Simplicity leads to mass use and mass use leads to wide acceptability.

Alice and Bob should not require an advanced degree in cryptography, as the protocol machinations should be transparent to the immediate user. Unit-of-value freedom. The digital cash is denominated in market-determined, non-political monetary units. Alice and Bob should be able to issue non-political digital cash denominated in any defined unit, which competes with governmental-unit digital cash.

Electronic Cheques For Example: - Internet bank Egg has launched a digital payment system that it hopes will begin to allay fears of sending money via the web. Egg Pay allows Egg customers to digitally transfer money via e-mail to anybody in the UK with a bank account. Research from Egg and MORI has found that a third of all British adults are interested in digital payment services but security remains a big issue for many. To use Egg Pay customers send an e-mail stating which account they wish the money to come from, providing the recipient's e-mail address and a choice of two security questions. No cheque book Any amount between lb 1 and lb 200 can be sent.

Recipients receive an e-mail with a web link to access the Egg site where they answer the security question and tell Egg which account to credit. Egg is hopeful the service will catch on for small transactions such as repaying loans from friends. "It offers a quick and easy alternative to traditional payment methods which could see the cheque book banished forever", said Marketing Director of Egg Patrick Muir. People are losing interest in paper cheques, according to government industry body A PACS (Association for Payment Clearing Services).

It predicts a 41% decline by 2009. Three-quarters of the cheques sent in the UK are for lb 100 or less. Brand importance In the US web-based banking is proving popular and new companies are threatening traditional banks by acting as brokers between individuals. In Europe, people are more suspicious of companies they do not know although firms like Nochex are running email payment systems. "In the US it is simpler to create a relationship with customers but in Europe people prefer to go with well-known brands", explained IDC analyst Daniele Bonfanti.

Some European banks are jumping on the bandwagon and offering such services but Egg is the first in the UK. According to Mr Bonfanti others may be slow to follow in Egg's footsteps. "Banks are profiting from traditional payment systems and they may not want to change it", he said. EFT and EDI EFT - Electronic Funds Transfer provides for electronic payments and collections. EFT is safe, secure, efficient, and less expensive than paper check payments and collections. Terms used in Securing Payments over the Internet SET - Secure Electronic Transaction.

Visa and MasterCard have jointly developed the Secure Electronic Transaction (SET) protocol as a method to secure bankcard transactions over open networks. In an SET transaction, the electronic processing of the transaction begins with the cardholder. Cardholders can visit Web pages, selecting items for inclusion on an order. Once the cardholder finishes shopping, the merchant's Web server can send a completed order form for the cardholder to review and approve.

Once the cardholder approves the order and chooses to use a bankcard for payment, the SET protocol provides the mechanisms for the cardholder to securely transmit payment instructions as well as for the merchant to obtain authorization and receive payment for the order. In SET, message data will initially be encrypted using a randomly generated symmetric encryption key. This key, in turn, will be encrypted using the message recipient's public key. This is referred to as the "digital envelope" of the message and is sent to the recipient along with the encrypted message itself. After receiving the digital envelope, the recipient decrypts it using his or her private key to obtain the randomly generated symmetric key and then uses the symmetric key to unlock the original message. SET uses a distinct public / private key pair to create a "digital signature".

Authentication is further strengthened by the use of certificates issued by a trusted third party "Certificate Authority". Within SET, dual signatures are used to link an order message sent to the merchant with the payment instructions containing purchaser account information sent to the Acquirer. SSL - Secure Sockets Layer. A security protocol that provides privacy over the Internet The goal of the SSL Protocol is to provide privacy and reliability between two communicating applications. The protocol is composed of two layers. At the lowest level is the SSL Record Protocol.

The SSL Record Protocol is used for encapsulation of various higher-level protocols. One such encapsulated protocol, the SSL Handshake Protocol, allows the server and client to authenticate each other and to negotiate an encryption algorithm and cryptographic keys before the application protocol transmits or receives its first byte of data. The SSL protocol provides connection security that has three basic properties: The connection is private. Encryption is used after an initial handshake to define a secret key.

Symmetric cryptography is used for data encryption. The connection can be authenticated using asymmetric, or public key, cryptography. The connection is reliable. Message transport includes a message integrity check using a keyed Message Authentication Code (MAC). Secure hash functions are used for MAC computations. JEPI - Joint Electronic Payment Initiative JEPI, the Joint Electronic Payment Initiative, is a joint project between the World Wide Web Consortium (W 3 C) and Commerce Net with a number of industry partners to explore the process that takes place, typically, after shopping and before actual payment begins.

This is the point in time where the exact payment instrument (credit card, debit card, electronic check, electronic cash, etc) must be agreed upon between the browsing client and the merchant server, and then the transaction can take place. The Benefits of Encryption Digital encryption allows you to transmit confidential information electronically while resting assured that your information will not be viewed by an unauthorized third party. In combination with digital signatures, digital encryption offers maximum protection and security in the transmission of electronic data and in electronic communication. With encryption, you can ensure that a message can only be read by someone who has the appropriate decryption key. With a digital signature, you can assure the recipient that the message hasn't been changed or corrupted since you signed it, and that you do indeed possess the private key that corresponds to the public key used to verify the signature. However, neither offers any proof of your identity.

Digital IDs offer proof of your identity. They establish who owns a particular public key, providing an electronic means of verifying that the individual or organization with whom you are communicating is who they claim to be. By providing proof of a user's identity, a Digital ID prevents Tom from falsely claiming that he is Jane. A Digital ID does this by binding an identity to a pair of electronic keys that can be used to encrypt and sign digital information. By binding a public key with its owner's identity, a Digital ID provides assurance that the key actually belongs to the person or organization specified. A certification authority (CA), such as VeriSign, attests to an individual's or organization's right to use the public key by digitally signing the Digital ID after verifying the owner's identifying information contained in the ID.

To accept consumer Digital IDs a site must have a server Digital ID and the end-user must have a browser with a consumer Digital ID. Digital IDs are used to authenticate, or verify the identity of, both the end-user and the server. A server with a Digital ID ensures visitors of the site's authenticity and allows the session with the end-user to be encrypted. A server Digital ID provides users with third-party evidence of the server's authenticity - it identifies that the server is operated by an organization with the right to use the name associated with the server's Digital ID. This safeguard's users from trusting unauthorized sites. Web browsers generally perform server authentication automatically - the user only is only notified if: .

The certification authority that issued the site's Digital ID is not in the user's list of approved certification authorities. The URL (for example, web) does not match the URL in the server Digital ID. The server Digital ID has expired or is otherwise invalid. To authenticate an end-user, the server requests a Digital ID from the end-user's browser. The user then chooses from a list of Digital IDs to present to the server and the server checks the validity of the Digital ID presented.

Once assured of its validity, the server reads the fields in the Digital ID, establishing the identity of the holder and giving appropriate access to site resources (through an access control list or similar database). This exchange between the client and server is performed using the Secure Sockets Layer (SSL). SSL 2.0 supports server authentication only; SSL 3.0 supports both client and server authentication. Public key cryptography is used only for mutual verification and to encrypt the session key between the browser and server. SSL uses symmetric key encryption to encrypt the session. A different session key is used for each client / server connection, and the session key automatically expires in 24 hours.

Even if a session key is intercepted and decrypted (very unlikely), it cannot be used to eavesdrop on subsequent sessions. Comparison of encryption methods A digital code that can be attached to an electronically transmitted message that uniquely identifies the sender. Like a written signature, the purpose of a digital signature is to guarantee that the individual sending the message really is who he or she claims to be. Digital signatures are especially important for e-commerce and are a key component of most authentication schemes. To be effective, digital signatures must be unforgeable. There are a number of different encryption techniques to guarantee this level of security.

Digital signatures provide integrity, signature assurance and non-repudiatability over Web data. Such features are especially important for documents that represent commitments such as contracts, price lists, and manifests. In view of recent Web technology developments, the proposed work will address the digital signing of documents (any Web resource addressable by a URI) using XML syntax. This capability is critical for a variety of electronic commerce applications, including payment tools. Public Key Encryption A cryptographic system that uses two keys -- a public key known to everyone and a private or secret key known only to the recipient of the message. When John wants to send a secure message to Jane, he uses Jane's public key to encrypt the message.

Jane then uses her private key to decrypt it. An important element to the public key system is that the public and private keys are related in such a way that only the public key can be used to encrypt messages and only the corresponding private key can be used to decrypt them. Moreover, it is virtually impossible to deduce the private key if you know the public key. Public-key systems, such as Pretty Good Privacy (PGP) are becoming popular for transmitting information via the Internet. They are extremely secure and relatively simple to use. The only difficulty with public-key systems is that you need to know the recipient's public key to encrypt a message for him or her.

What's needed, therefore, is a global registry of public keys, which is one of the promises of the new LDAP technology. Public key cryptography was invented in 1976 by Whitfield Diffie and Martin Hellman. For this reason, it is sometime called Diffie-Hellman encryption. It is also called asymmetric encryption because it uses two keys instead of one key (symmetric encryption). PGP is a public key based encryption scheme.

Each user creates a public and private key pair. The private key is protected by a pass phrase that the user chooses when creating the pair. This pass phrase may be arbitrarily long and may have any alpha-numeric characters. It is VERY important that the pass phrase is not forgotten. Encrypted messages can not be deciphered without the private key pass phrase.

Keys may be either 512,768, or 1024 bits. Longer keys take longer to use, but offer higher levels of security. The public key is used to encrypt messages for other users and to authenticate messages. A message for another user is encrypted using their public key. Once encrypted, the file can only be deciphered using their corresponding private key and pass phrase. In this way, files can be encrypted for only specific users to read.

PGP can also encrypt local user files. When used this way, the key pair is not used, but rather a pass phrase is created for each encrypted file. Digital signatures allow messages to be authenticated to verify who created the file, and if it was modified. A user puts a signature on a file by using her private key and pass phrase. Then anyone with the corresponding public key is able to verify that the message came from that user.

The signature process also checks if the file has been modified at all. When a message is encrypted, PGP first creates a random session key for the message. Using the IDEA algorithm with the session key, the message is encrypted. Next, the session key is encrypted with the RSA algorithm and the recipient's public key. The encrypted message and session key is then bundled together and ready to be mailed or stored.

The use of digital certificates A Digital Certificate is like an electronic passport that is used to ensure that digital communications can be carried out securely. Communications using a Digital Certificate will be at least as secure as paper-based systems, possibly even more so. A Digital Certificate is an electronic document that contains identity details of the holder, including name, location and e-mail address, and also contains what are known as 'security keys'. There are two security keys in a certificate: the 'public key' (made freely available to other people or organisations) and the matching 'private key' (which only you have). If I send you encrypted information, I will do so by using your public key. You will decrypt the information using your private key.

You can also use your private key to digitally sign a message. In that case I will use your public key to verify your signature on the signed message that you sent to me. The identity details in a Digital Certificate are used to prove that the holder is who they say they are, whilst the 'public key' is used to encrypt information to ensure that it remains confidential. A holder's Digital Certificate is freely distributed to other people or organisations to prove their identity and to be able to undertake confidential communications. The holder's corresponding 'private key' file must be kept completely confidential. A trusted third party, usually known as a Certificate Authority, digitally signs the document and issues the security keys.

This digital signature not only 'certifies' that the details in the Digital Certificate are correct, but also ensures that they cannot be changed without this being detected. A second type of Digital Certificate is the Secure Cert certificate that can be used for conducting business electronically in situations where a lower level of personal identification is acceptable.