Analysis of E-commerce Security

ECE 578 Final Project Report

Dr. Cetin Kaya Koc

Juthamas Pongnukit

Witit Tingthanathikul

Oregon State University

E-commerce business operators face many challenges in building

consumer trust and in providing e-security for their network. Securing e-

commerce business with 128 bit encryption has become the standard in network

security. Purchasing digital certificates provide the necessary validation e-

businesses need and also provide strong encryption.

This paper will discuss the various methods that are used in the e-

commerce such as Digital certificates, Digital signatures, Secure Socket Layer

(SSL), Secure Electronic Transactions (SET) and different kinds of data

encryption. Also, this paper will survey about threats, and vulnerabilities in E –

commerce in recently.

Introduction

Electronic commerce or e-commerce consists of the buying, selling,

marketing, and servicing of products or services over computer networks. The

information technology industry might see it as an electronic business application

aimed at commercial transactions. An alternative definition of e-commerce might

view it as the conduct of business commercial communications and management

through electronic methods, such as electronic data interchange and automated

data-collection systems. As business transaction move to electronic

marketplaces, most interactions will occur between strangers, due to billions of

internet users and the fact that most of them do not share a common security

domain. In order to conduct secure transactions, a sufficient level of mutual trust

potential. This requires properly implemented security services to help in

avoiding privacy invasion and economical losses. E-commerce success largely

depends on gaining and maintaining the trust and confidence of visitors. Thus, it

is possible to select right security technologies and process to technically provide

and improve security for the solution, at the same time, also win trust confidence

from customers.

This paper is including the e- business Network Architecture to protect and

explain the e-business network because the security for e-commerce is to make

customers and business partners feel safe and comfortable when performing

transactions. The basic principles is also important to make understanding about

how security e-commerce. Digital certificates, Digital signatures, Secure Socket

Layer (SSL), Secure Electronic Transactions (SET) and different kinds of data

encryption are the methods using in e-commerce to improve the security.

However, there are many threats and risk that happen in e-commerce. It is very

important to improve the security on e- commerce business according to the high

development and need on the internet business. Vulnerabilities in e–commerce

in recently are also the main interesting for case study to explain how much e-

commerce business security will be.

E-Business Network Architecture

E- Business network Architecture is designed for the e-commerce

business because companies, operators, and customers need to make a

reliable e-Business network can be guarantee for trust and confidence, not only

for customers, but also for service providers themselves. There should be three

divisions within a celled infrastructure: Internet Zone, Web Zone and

DB/Application Zone.

Internet Zone locates in the outside of the first firewall; the purpose of this

zone is to provide the entry point into the e-Business network cell. Normally, this

zone doesn’t have any protection from outside attacks, but using certain switches

can provide protection from SYN attacks and limit the number of SYN packets

that can enter from a single host without the corresponding SYN-ACK. The

definition of SYN Attack is that when an attacker sends a series of SYN requests

to a target (victim). The target sends a SYN ACK in response and waits for an

ACK to come back to complete the session set up. Since the source address was

fake, the response never comes, filling the victim's memory buffers so that it can

no longer accept legitimate session requests.

Web zone is built for the systems that need direct communication to users

on the Internet only. It is designed as the “gateway”, to allow communication

between insecure external hosts on the Internet and the data the application

provides. It is a web tier that surrounded by Internet zone and DB/application

zone, it allows the very close scrutiny of communications between the Internet

zone and the sensitive data and business logic contained in the DB/Application

Zone. The front-end firewall should provide the only HTTP and HTTPS

connections. IDS (Intrusion Detection System) provides the second level security
by providing sniffer that “watches” for any other traffic that wasn’t allowed by the

frond-end firewall.

Database/Application Zone provides any service that need to

communicate to the Web Zone systems. This zone is designed as a more

secured place for applications/DB that may contain the sensitive information. The

main purpose for this network is to have a point that isn’t directly accessed by the

insecure Internet, and thereby allowing specific systems to gather the data they

need in a very controlled manageable way. At the meanwhile, the communication

in and out of this zone should be predictable.

The following picture shows typical e-Business network architecture

design.

Fig1: E-Business Network Architecture

Most e-commerce merchants leave the mechanics to their hosting

company or IT staff, but it helps to understand the basic principles. Any system

has to meet four requirements:

• Privacy: information must be kept from unauthorized parties.

• Integrity: message must not be altered or tampered with.

• Authentication: sender and recipient must prove their identities to each

other.

• Non-repudiation: proof is needed that the message was indeed received.

Privacy is handled by encryption. In PKI (public key infrastructure) a

message is encrypted by a public key, and decrypted by a private key. The public

key is widely distributed, but only the recipient has the private key. For

authentication (proving the identity of the sender, since only the sender has the

particular key) the encrypted message is encrypted again, but this time with a

private key. Such procedures form the basis of RSA (used by banks and

governments) and PGP (Pretty Good Privacy, used to encrypt emails).

Unfortunately, PKI is not an efficient way of sending large amounts of

information, and is often used only as a first step — to allow two parties to agree

upon a key for symmetric secret key encryption. Here sender and recipient use

keys that are generated for the particular message by a third body: a key

distribution center. The keys are not identical, but each is shared with the key

distribution center, which allows the message to be read. Then the symmetric

keys are encrypted in the RSA manner, and rules set under various protocols.
Naturally, the private keys have to be kept secret, and most security lapses

indeed arise here.

Security protocol

In the today most e-business, many protocols are widely used such as

Secure Socket Layers (SSL) and Secure Electronic Transactions (SET). So we

would like to explore about these protocols. We will discuss the various methods

that are used in the e-commerce such as Digital certificates, Digital signatures,

Secure Socket Layer (SSL), Secure Electronic Transactions (SET).

1. Digital Signatures and Certificates

Digital signatures meet the need for authentication and integrity. To vastly

simplify matters (as throughout this page), a plain text message is run through a

hash function and so given a value: the message digest. This digest, the hash

function and the plain text encrypted with the recipient's public key is sent to the

recipient. The recipient decodes the message with their private key, and runs the

message through the supplied hash function to that the message digest value

remains unchanged (message has not been tampered with). Very often, the

message is also time stamped by a third party agency, which provides non-

repudiation.

In addition, digital certificate are also used for security purposes. The most

common use of a digital certificate is to verify that a user sending a message is

who he or she claims to be, and to provide the receiver with the means to encode

a reply.
 An individual wishing to send an encrypted message applies for a digital

certificate from a Certificate Authority (CA). The CA issues an encrypted digital

certificate containing the applicant's public key and a variety of other identification

information. The CA makes its own public key readily available through print

publicity or perhaps on the Internet.

The recipient of an encrypted message uses the CA's public key to

decode the digital certificate attached to the message, verifies it as issued by the

CA and then obtains the sender's public key and identification information held

within the certificate. With this information, the recipient can send an encrypted

reply.

The most widely used standard for digital certificates is X.509.

2. Secure Socket Layers (SSL)

The Secure Socket Layer (SSL) was developed by Netscape to provide

secure communication between Web servers and clients. Information sent over

the Internet commonly uses the set of rules called TCP/IP (Transmission Control

Protocol / Internet Protocol). The information is broken into packets, numbered

sequentially, and an error control attached. Individual packets are sent by

different routes. TCP/IP reassembles them in order and resubmits any packet

showing errors. SSL uses PKI and digital certificates to ensure privacy and

authentication. The procedure is something like this: the client sends a message

to the server, which replies with a digital certificate. Using PKI, server and client

negotiate to create session keys, which are symmetrical secret keys specially
created for that particular transmission. Once the session keys are agreed,

communication continues with these session keys and the digital certificates.

3. Secure Electronic Transactions (SET)

The SET Secure Electronic Transaction TM protocol is an open industry

standard developed for the secure transmission of payment information over the

Internet and other electronic networks.

SET uses a system of locks and keys along with certified account IDs for

both consumers and merchants. Then, through a unique process of "encrypting"

or scrambling the information exchanged between the shopper and the online

store, SET ensures a payment process that is convenient, private and most of all

secure.

There are some advantages of SET as shown below:

• Establishes industry standards to keep your order and payment

information confidential.

• Increases integrity for all transmitted data through encryption.

• Provides authentication that a cardholder is a legitimate user of a branded

payment card account.

• Provides authentication that a merchant can accept branded payment

card transactions through its relationship with an acquiring financial

institution.
 • Allows the use of the best security practices and system design

techniques to protect all legitimate parties in an electronic commerce

transaction.

Fig 2: Secure Electronic Transaction

The Threats to E-Commerce

E-commerce security strategies deal with two issues: protecting the

integrity of the business network and its internal systems; and with accomplishing

transaction security between the customer and the business. The main tool

businesses use to protect their internal network is the firewall. A firewall is a

hardware and software system that allows only those external users with specific

characteristics to access a protected network. The original design was supposed

to allow only specific services (e.g., email, web access) between the Internet and

the internal network. The firewall has now become the main point of defense in

the business security architecture. However, firewalls should a small part of the
business security infrastructure. There are hacker tools such as SMTP Tunnel

and ICMPTunnel that allow hackers to pass information through the allowed

ports.

Transaction security is critical to bolstering consumer confidence in a

particular e-commerce site. Transaction security depends on the organization’s

ability to ensure privacy, authenticity, integrity, availability and the blocking of

unwanted intrusions. Transaction privacy can be threatened by unauthorized

network monitoring by software devices called sniffer programs. These programs

are most likely found at the endpoints of the network connection. There are a

number of defenses against this threat such as encryption and switched network

topologies. Transaction confidentiality requires the removal of any trace of the

actual transaction data from intermediate sites. Records of its passage are a

different thing and are required to verify the transaction actually took place.

Intermediate nodes that handle the transaction data must not retain it except

during the actual relaying of the data. Encryption is the most common method of

ensuring confidentiality. Transaction integrity requires methods that prevent the

transactions from being modified in any way while it is in transit to or from the

customer. Error checking codes are an example of such a method.

Encryption techniques such as secret-key, public-key and digital

signatures are the most common method of ensuring transaction privacy,

confidentiality and integrity. The common weakness of these techniques is that

they depend on the security of the endpoint systems to protect the keys from

modification or misuse.
Threats to e-commerce servers fall into two general categories:

- Threats from an actual attacker. The intent is to garner personal

information from people for the sheer purposes of exploitation (such obtaining

Credit Card and Bank Account information; Phishing schemes, obtaining

usernames and passwords, etc.).

- Technological failure. Anything related to the Internet can cause

problems. This can be anything from a network not configured properly to data

packets being lost, especially in a wireless access environment. Even poorly

written programming code upon which your e-commerce site was developed can

be very susceptible to threats.

Most e-commerce Servers utilize a Windows Operating System

(such as Windows 2000 and 2003 Server), a Web Server Software to host the e-

commerce Site (such as Internet Information Services, or IIS), and a database

(such as Access 2000 or SQL Server 2000) which contains your customer

information and transaction history. These platforms have had various security

flaws associated with them, which has made them wide open to threats and

attacks. As a result, there has been a move in the business community to adopt

more robust and secure platforms. A prime example of this is the use of Linux as

the operating system, Apache as the Web Server Software, and either

PostGRESql or My SQL as the database (these are database languages created

from the Structured Query Language, or SQL). These latter platforms will be

explored in much more detail in subsequent articles.

commerce servers. Also, we will look at some threats posed to your customers

who use your e-commerce server to buy goods and services.

The direct threats to e-commerce servers can be classified as

- Malicious Code Threats

- Transmission Threats.

With the former, malicious, or rogue programming code is introduced into

the server in order to gain access to the system resources. Very often, the intent

of Malicious Code Attacks is to cause large scale damage to the e-commerce

server. With the latter, the threats and risks can be classified as either as active

or passive. With passive threats, the main goal is to listen (or eavesdrop) to

transmissions to the server. With active threats, the intent is to alter the flow of

data transmission or to create a rogue transmission aimed directly at the e-

commerce server

Conclusion

E-commerce business operators face many challenges in building

consumer trust and in providing e-security for network. Not only is this important

for the future success of your e-commerce, but customers will demand a safe

and secure site on which to do business. To build consumer confidence in your

ecommerce business, a secure site on business is conducted. Many protocols is

used to gain the security and trust on business. Secure Socket Layers (SSL)

and Secure Electronic Transactions (SET) are protocols that are using on e-
commerce business now. Also, Digital certificates and Digital signatures are the

principle that is used to authenticate the parties that are using shared network.

However, there are many threats that happen on network. It is possible for

threat to happen according to an actual attacker, and technological failure.

[1] http://www.secure-sale.net/

[2] http://e-comm.webopedia.com

[3] http://www.webopedia.com

[4] http://www.moneymuseum.com/standard_english/raeume/geld_machen/bank/

praxis /ecommerce/einfuehrung/set/set.html

[5] http://www.veteransearch.com/ssl_set_info.htm#digicert

[6] http://www.ecommerce-digest.com/ecommerce-security-issues.html

[7] G. Lian, “Customer Confidence and Security”, 2001.

[8] R. E. Smith, “Electronic Commerce Security”, http://www.smat.us/crypto/

docs/ecom-handouts.pdf, 1999.

[9] E-Commerce Security Issues and online shopping, http://www.tees.ac.uk/

itresponse/whitepapers/Ecommerce%20Security%20Issues.pdf

[10] R. Das, “Threats to E-Commerce Servers-Part 1”, http://www.technology

executivesclub.com/Articles/artThreatstoEcommerceServers.htm