Q. Explain security concerns in E-Commerce with solutions.
Ans. Essential security requirement for safe electronic payments are:
1. Confidentially: Information should be protected from eyes of unauthorized internal users,external hackers and from being intercepted during transmission on communication networks by making it unintelligible to the attacker.
2. Integrity: Ensuring that information will not be accidentally and maliciously altered or destroyed during transmission. On retrieval or receipt at the other end of a communication network the Information should appear exactly as was stored or sent. It should be possible to generate an alert on any modification, addition or deletion to the original content.
3. Availability: The Information that is being stored or transmitted across communication networks should be available whenever required and to whatever extend as desired within pre-established time constraints.
4. Authenticity: Authenticity is a method to verify the buyer’s identity before payment is authorized. It should be possible to prevent any person or object from masquerading as some other person or object. When a message is received it should therefore be possible to verify whether it has indeed been sent by the person or object ciming to be the originator.
5. Non-Repudiability: It is the protection against customer’s denial of orders placed and against merchant’s denial of payment mode. After sending/ authorizing a message, the sender should not be able to, at a later date, deny having done so. Similarly, the recipient of a message should not be able to deny receipt at a later date.
6. Encryption: Encryption is a process of making messages indecipherable except by those who have an authorized decryption key.
7. Auditability: Audit data must be recorded in such a way that all specified confidentiality and integrity requirements are met.
Security Schemes (or Security Solution): Main security schemes for electronic payment systems are :
1. Encryption
2. Digital Signature
3. Security Certificates
1. Encryption:
Control against Network Threats (Encryption): An effective and practical way to safeguard data transmitted over networks is by encryption. The process required an encryption device (key) for converting the original message into a code, as well as decryption device (key) for translating the code back into recognizable text. In business data processing, this can be accomplished by using specialized computer software. There are two types of encryption:
(i) Symmetric encryption or secret key cryptography: Secret key encryption is beased on a single key. In this scheme, the same key is used by a sender (for encryption) and a receiver (for decryption). The most widely accepted algorithm for secret key encryption is the Data Encryption Standard (DES). Essentially, therefore, for every period of partners engaging in secure communications, a new key has to be generated and securely maintained.
(ii) Asymmetric encryption or public key cryptography: Public key cryptosystems are built around the possession of a pair of keys - a public key and a private key by each entity washing to engaged in secure communications. While, as the name suggests, the public key is known to everyone, the private private key is known only the owner. The algorithm used to generate these keys is such that if either of these keys is used to encrypt a message, only the corresponding key in the key pair will be able to decrypt it. The most popular algorithm with public key cryptography is the RSA (Rivest, Shamir and Adelman) algorithm. This algorithm has never been broken by hackers so it is seen as the safest encription method known to date. This scheme is used to provide both the services of confidentiality and authentication. RSA algorithm is usually used to transmit the secret key of DES algorith because DES algorithm is more efficient and faster in handling encryption and decryption.
2. Digital Signatures: The digital signatures are a means of ensuring authentication of electronic information. Digital signature is an electronic signature whose authenticity is guaranteed through encryption and a password.
The digital signature technology involves:
(i) Private Key: A unique combination known only do the signer. It is a used to encrypt the message.
(ii) Message Digest: The encrypted message that is created with the help of private key.
(iii) Public Key: A code sent to the receiver separately to enable the decryption of the message digest. It is also available on the website of the certification authority.
In this scheme, a message is encrypted with the sender’s private key to generate the ‘signature’. The message is then sent to the destination along with the signature. The recipient decrypts the signature using the sender’s public key, and if the result matches with the copy of the message received, the recipient can be sure that the message was sent by the claimed originator and that the message has not been modified during transmission, since only the originator is in possession of the corresponding encryption key.
The RSA algorithm is widely used to implement digital signatures. The other popular algorithm is the Digital Signature Algorithm (DSA) developed by the US National Institute of Standards and Technology.
3. Security Certificates: Just as a passport is a universal way to establish your identity and gain entry to another country, a digital or security certificate provides identification in the electronic world. Certificate authorities (CAs) are organizations that issue security certificates. Much like the role of the passport office, the role of the CA is to validate ate the certificate holder’s identity and to “sign” the certificate so that it cannot be forged or tampered with. Once a CA has signed a certificate, the holder can present the certificate to people, websites, and network resources.
A certificate is a unique digital ID that can be used to verify the identity of an individual. The certificate always includes a public key, the name of the entity it identifies, an expiration date, the name of the certificate authority (CA) that issued the certificate.
These certificates use public key cryptography to sign and authenticate signatures and are protect protected by public and private key pairs linked by cryptographic algorithms. These keys have the ability to encrypt and decrypt information. The digital signature component of a security certificate is your electronic identity card. The digital signature tells the recipient that the information actually came from you and hasn not been forged or tampered with.

