Protocols for Secure Electronic Commerce, Second Edition

Note: Supplemental materials are not guaranteed with Rental or Used book purchases.

ISBN: 9780849315091 | 0849315093
Cover: Hardcover
Copyright: 11/24/2003

Rent

(Recommended)

$119.87

Term

Due

Price

Semester

Dec 13

$126.18

Quarter

Aug 16

$119.87

Short Term

Jul 15

$113.56

*This item is part of an exclusive publisher rental program and requires an additional convenience fee. This fee will be reflected in the shopping cart.
Buy New

Usually Ships in 3-5 Business Days

$172.39
eBook

Available Instantly

Online: 180 Days

Downloadable: 180 Days

$40.20

The continued growth of e-commerce mandates the emergence of new technical standards and methods that will securely integrate online activities with pre-existing infrastructures, laws and processes. Protocols for Secure Electronic Commerce, Second Edition addresses the security portion of this challenge. It is a full compendium of the protocols for securing online commerce and payments, serving as an invaluable resource for students and professionals in the fields of computer science and engineering, IT security, and financial and banking technology.The initial sections provide a broad overview of electronic commerce, money, payment systems, and business-to-business commerce, followed by an examination of well-known protocols (SSL, TLS, WTLS, and SET). The book also explores encryption algorithms and methods, EDI, micropayment, and multiple aspects of digital money.Like its predecessor, this edition is a general analysis that provides many references to more technical resources. It delivers extensive revisions of previous chapters, along with new chapters on electronic commerce in society, new e-commerce systems, and the security of integrated circuit cards.

1 Overview of Electronic Commerce

Abstract

(1)

1.1 What Is Electronic Commerce?

(2)

1.2 Categories of Electronic Commerce

(5)

1.2.1 Examples of Business-to-Business Commerce

(1)

1.2.2 Examples of Business-to-Consumer Commerce

(2)

1.2.3 Examples of Neighborhood Commerce and Payments to Automatic Machines

(1)

1.2.4 Examples of Peer-to-Peer Commerce

(1)

1.3 The Influence of the Internet

(5)

1.3.1 Some Leading Examples

(1)

1.3.2 Internet and Transactional Security

(2)

1.3.3 Putting the Internet in Perspective

(2)

1.4 Infrastructure for Electronic Commerce

(2)

1.5 Network Access

(6)

1.5.1 Wireline Access

(1)

1.5.2 Wireless Access

(1)

1.5.3 Traffic Multiplexing

(4)

1.6 Consequences of E-Commerce

(4)

1.6.1 Clients

(1)

1.6.2 Suppliers

(1)

1.6.3 Substitutes

(1)

1.6.4 New Entrants

(1)

1.6.5 Banks

(1)

1.6.6 Role of Governments

(1)

1.7 Summary

(1)

Questions

(2)

2 Money and Payment Systems

Abstract

(1)

2.1 The Mechanisms of Classical Money

(2)

2.2 Instruments of Payment

(17)

2.2.1 Cash

(2)

2.2.2 Checks

(4)

2.2.3 Credit Transfers

(3)

2.2.4 Direct Debit

(1)

2.2.5 Interbank Transfers

(1)

2.2.6 Bills of Exchange

(1)

2.2.7 Payment Cards

(4)

2.3 Types of Dematerialized Monies

(3)

2.3.1 Electronic Money

(1)

2.3.2 Virtual Money

(1)

2.3.3 Digital Money

(1)

2.4 Purses and Holders

(4)

2.4.1 Electronic Purses and Electronic Token (Jeton) Holders

(1)

2.4.2 Virtual Purses and Virtual Jeton Holders

(1)

2.4.3 Diffusion of Electronic Purses

(2)

2.5 Transactional Properties of Dematerialized Currencies

(2)

2.5.1 Anonymity

(1)

2.5.2 Traceability

(1)

2.6 Overall Comparison of the Means of Payment

(2)

2.7 The Practice of Dematerialized Money

(8)

2.7.1 Protocols of Systems of Dematerialized Money

(5)

2.7.2 Direct Payments to the Merchant

(1)

2.7.3 Payment via an Intermediary

(3)

2.8 Banking Clearance and Settlement

(4)

2.8.1 United States

(1)

2.8.2 United Kingdom

(1)

2.8.3 France

(1)

2.9 Summary

(1)

Question

(1)

3 Algorithms and Architectures for Security

Abstract

(1)

3.1 Security of Commercial Transactions

(1)

3.2 Security of Open Financial Networks

(1)

3.3 Security Objectives

(2)

3.4 OSI Model for Cryptographic Security

(3)

3.4.1 OSI Reference Model

(1)

3.4.2 Security Services: Definitions and Locations

(3)

3.5 Security Services at the Link Layer

(1)

3.6 Security Services at the Network Layer

(3)

3.7 Security Services at the Application Layer

(1)

3.8 Message Confidentiality

(3)

3.8.1 Symmetric Cryptography

(1)

3.8.2 Public Key Cryptography

(2)

3.9 Data Integrity

(8)

3.9.1 Verification of the Integrity with a One-Way Hash Function

(1)

3.9.2 Verification of the Integrity with Public Key Cryptography

(3)

3.9.3 Blind Signature

(1)

3.9.4 Verification of the Integrity with Symmetric Cryptography

(3)

3.10 Identification of the Participants

(8)

3.10.1 Biometric Identification

(6)

3.10.1.1 Voice Recognition

(1)

3.10.1.2 Handwritten Recognition

(1)

3.10.1.3 Keystroke Recognition

(1)

3.10.1.4 Retinal Recognition

(1)

3.10.1.5 Iris Recognition

(1)

3.10.1.6 Face Recognition

(1)

3.10.1.7 Fingerprint Recognition

(1)

3.10.1.8 Recognition of Hand Geometry

100

(1)

3.10.2 Summary and Evaluation

100

(2)

3.11 Authentication of the Participants

102

(2)

3.12 Access Control

104

(2)

3.13 Denial of Service

106

(2)

3.14 Nonrepudiation

108

(2)

3.14.1 Time-Stamping and Sequence Numbers

109

(1)

3.15 Secure Management of Cryptographic Keys

110

(3)

3.15.1 Production and Storage

110

(1)

3.15.2 Distribution

111

(1)

3.15.3 Utilization, Withdrawal, and Replacement

111

(1)

3.15.4 Key Revocation

112

(1)

3.15.5 Deletion, Backup, and Archiving

112

(1)

3.15.6 Comparison between Symmetric and Public Key Cryptography

112

(1)

3.16 Exchange of Secret Keys: Kerberos

113

(4)

3.16.1 Message (1) - Request of a Session Ticket

114

(1)

3.16.2 Message (2) - Acquisition of a Session Ticket

114

(1)

3.16.3 Message (3) - Request of a Service Ticket

115

(1)

3.16.4 Message (4) - Acquisition of the Service Ticket

115

(1)

3.16.5 Message (5) - Service Request

116

(1)

3.16.6 Message (6) - Optional Response of the Server

117

(1)

3.17 Public Key Kerberos

117

(1)

3.17.1 Where To Find Kerberos?

118

(1)

3.18 Exchange of Public Keys

118

(1)

3.18.1 Diffie-Hellman Exchange

118

(1)

3.19 ISAKMP (Internet Security Association and Key Management Protocol)

119

(2)

3.20 SKIP (Simple Key Management for Internet Protocols)

121

(1)

3.21 Key Exchange Algorithm

121

(1)

3.22 Certificate Management

122

(21)

3.22.1 Basic Operation

125

(1)

3.22.2 Description of an X.509 Certificate

126

(2)

3.22.3 Certification Path

128

(1)

3.22.4 Hierarchical Certification Path

128

(3)

3.22.5 Nonhierarchical Certification Path

131

(1)

3.22.6 Cross-Certification

131

(2)

3.22.7 Online Management of Certificates

133

(1)

3.22.8 Banking Applications

133

(1)

3.22.9 Example: VeriSign

134

(4)

3.22.9.1 Certificate Classes

135

(1)

3.22.9.2 Operational Life

136

(1)

3.22.9.3 Revocation

136

(1)

3.22.9.4 Archival

137

(1)

3.22.9.5 Recovery

137

(1)

3.22.9.6 Liability

137

(1)

3.22.10 Procedures for Strong Authentication

138

(2)

3.22.10.1 One-Way Authentication

138

(1)

3.22.10.2 Two-Way Authentication

139

(1)

3.22.10.3 Three-Way Authentication

139

(1)

3.22.11 Certificate Revocation

140

(1)

3.22.12 Attribute Certificates

141

(2)

3.22.13 Audits

143

(1)

3.23 Encryption Cracks

143

(3)

3.24 Summary

146

(1)

3.25 Appendix I: Principles of Symmetric Encryption

147

(8)

3.25.1 Modes of Algorithm Utilization for Block Encryption

147

(6)

3.25.2 Examples of Symmetric Block Encryption Algorithms

153

(2)

3.25.2.1 Advanced Encryption Standard (AES)

153

(1)

3.25.2.2 Data Encryption Standard (DES)

154

(1)

3.25.2.3 Triple DES

154

(1)

3.25.2.4 IDEA

154

(1)

3.25.2.5 SKIPJACK

154

(1)

3.26 Appendix II: Principles of Public Key Encryption

155

(6)

3.26.1 RSA

156

(1)

3.26.1.1 Practical Considerations

157

(1)

3.26.2 Public Key Cryptography Standards (PKCS)

157

(2)

3.26.3 Pretty Good Privacy (PGP)

159

(1)

3.26.4 Elliptic Curve Cryptography (ECC)

159

(2)

3.27 Appendix III: Principles of the Digital Signature Algorithm (DSA)

161

(1)

3.28 Appendix IV: Comparative Data

162

(4)

3.28.1 Performance Data for JSAFE 1.1

163

(1)

3.28.2 Performance for S /WAN

164

(1)

3.28.3 Performance for BSAFETM 3.0

165

(1)

3.28.4 Performance for BSAFETM 4.1

166

(1)

Questions

166

(7)

4 Business-to-Business Commerce

Abstract

173

(1)

4.1 Overview of Business-to-Business Commerce

174

(3)

4.2 Examples of Business-to-Business Electronic Commerce

177

(4)

4.2.1 A Short History of Business-to-Business Electronic Commerce

177

(1)

4.2.2 Banking Applications

178

(1)

4.2.3 Aeronautical Applications

178

(1)

4.2.4 Applications in the Automotive Industry

179

(1)

4.2.5 Other Examples

180

(1)

4.2.6 Effect of the Internet

180

(1)

4.3 Business-to-Business Electronic Commerce Platforms

181

(1)

4.4 Obstacles Facing Business-to-Business Electronic Commerce

182

(2)

4.5 Business-to-Business Electronic Commerce Systems

184

(3)

4.5.1 Generation and Reception of Structured Data

185

(2)

4.5.2 Management of the Distribution

187

(1)

4.5.3 Management of Security

187

(1)

4.6 Structured Alphanumeric Data

187

(8)

4.6.1 Definitions

188

(1)

4.6.2 ANSI X12

189

(1)

4.6.3 EDIFACT

190

(5)

4.6.3.1 UNB / UNZ and UIB / UIZ Segments

191

(1)

4.6.3.2 UNH / UNT Segments

192

(1)

4.6.3.3 UNS Segment

193

(1)

4.6.3.4 UNG/UNE Segments

193

(1)

4.6.3.5 UNO/UNP Segments

193

(1)

4.6.3.6 Structure of an Interchange

194

(1)

4.6.3.7 Partial List of EDIFACT Messages

194

(1)

4.6.3.8 Interactive EDIFACT

195

(1)

4.6.4 Structural Comparison between X12 and EDIFACT

195

(1)

4.7 Structured Documents or Forms

195

(8)

4.7.1 SGML

197

(1)

4.7.2 XML

198

(1)

4.7.3 Integration of XML with Alphanumeric EDI

198

(5)

4.7.3.1 BizTalk®

200

(1)

4.7.3.2 Commerce XML (cXML)

200

(1)

4.7.3.3 Electronic Business XML (ebXML)

201

(1)

4.7.3.4 SAML (Security Assertion Markup Language)

201

(1)

4.7.3.5 SOAP (Simple Object Access Protocol)

202

(1)

4.7.3.6 UDDI (Universal Description, Discovery, and Integration)

202

(1)

4.7.3.7 WSDL (Web Services Description Language)

203

(1)

4.8 EDI Messaging

203

(3)

4.8.1 X.400

203

(1)

4.8.2 Internet (SMTP/MIME)

204

(2)

4.9 Security of EDI

206

(17)

4.9.1 X12 Security

207

(2)

4.9.2 EDIFACT Security 208

4.9.2.1 Security of EDIFACT Documents Using In-Band Segments

209

(4)

4.9.2.2 Security of EDIFACT Documents with Out-of-Band Segments: The AUTACK Message

213

(3)

4.9.3 IETF Proposals

216

(4)

4.9.3.1 PGP/MIME Encrypted and Signed

217

(2)

4.9.3.2 S/MIME Message Encrypted and Signed

219

(1)

4.9.4 Protocol Stacks for EDI Messaging

220

(1)

4.9.5 Interoperability of Secured EDI and 5/MIME

221

(2)

4.9.6 Security of XML Exchanges

223

(1)

4.10 Relation of EDI with Electronic Funds Transfer

223

(5)

4.10.1 Funds Transfer with EDIFACT

226

(2)

4.10.2 Funds Transfer with X12

228

(1)

4.11 Electronic Billing

228

(1)

4.12 EDI Integration with Business Processes

229

(1)

4.13 Standardization of the Exchanges of Business-to-Business Electronic Commerce

230

(6)

4.13.1 EDI /EDIFACT

230

(4)

4.13.2 XML/EDI Integration

234

(1)

4.13.2.1 CEFACT

234

(1)

4.13.2.2 CommerceNet

234

(1)

4.13.2.3 IETF (Internet Engineering Task Force)

234

(1)

4.13.2.4 Open Buying on the Internet (OBI)

234

(1)

4.13.2.5 Open Trading Protocol (OTP) Consortium

234

(1)

4.13.2.6 Organization for the Advancement of Structured Information Standards (OASIS)

235

(1)

4.13.2.7 RosettaNet

235

(1)

4.13.3 XML

235

(1)

4.14 Summary

236

(1)

Questions

236

(3)

5 SSL (Secure Sockets Layer)

Abstract

239

(1)

5.1 General Presentation of the SSI Protocol

239

(4)

5.1.1 Functional Architecture

240

(1)

5.1.2 SSL Security Services

241

(2)

5.1.2.1 Authentication

242

(1)

5.1.2.2 Confidentiality

242

(1)

5.1.2.3 Integrity

243

(1)

5.2 SSL Subprotocols

243

(18)

5.2.1 SSL Exchanges

244

(3)

5.2.1.1 State Variables of an SSL Session

245

(1)

5.2.1.2 State Variables of an SSL Connection

246

(1)

5.2.2 Synopsis of Parameters Computation

247

(2)

5.2.3 The Handshake Protocol

249

(9)

5.2.3.1 General Operation

249

(1)

5.2.3.2 Opening of a New Session

249

(1)

5.2.3.3 Identification of the Cipher Suites

249

(3)

5.2.3.4 Authentication of the Server

252

(1)

5.2.3.5 Exchange of Secrets

253

(2)

5.2.3.6 Verification and Confirmation by the Server

255

(1)

5.2.3.7 Summary: Session Establishment

255

(1)

5.2.3.8 Connection Establishment

255

(3)

5.2.4 The ChangeCipherSpec Protocol

258

(1)

5.2.5 The Record Protocol

258

(1)

5.2.6 The Alert Protocol

259

(2)

5.2.7 Summary

261

(1)

5.3 Example of SSL Processing

261

(13)

5.3.1 Assumptions

262

(1)

5.3.2 Establishment of a New Session

263

(7)

5.3.2.1 Message Size

263

(1)

5.3.2.2 ClientHello Message

263

(1)

5.3.2.3 ServerHello Message

264

(1)

5.3.2.4 Certificate Message

264

(1)

5.3.2.5 ClientKeyExchange Message

265

(1)

5.3.2.6 Calculation of the Cipher Suite

265

(2)

5.3.2.7 ServerHelloDone Message

267

(1)

5.3.2.8 Finished Message

267

(1)

5.3.2.9 Processing at the Record Layer

268

(2)

5.3.3 Processing of Application Data

270

(1)

5.3.3.1 MAC Computation and Encryption

270

(1)

5.3.3.2 Decryption and Verification of the Data

270

(1)

5.3.4 Connection Establishment

271

(8)

5.3.4.1 Connection Establishment in an Existing Session

271

(1)

5.3.4.2 Session Refresh

272

(1)

5.3.4.3 Summary

273

(1)

5.4 Performance Acceleration

274

(2)

5.5 Implementations

276

(1)

5.6 Summary

277

(1)

Questions

278

(1)

Appendix 5.1 Structures of the Handshake Messages

A5.1 Messages of the Handshake

279

(6)

A5.1.1 Header

279

(1)

A5.1.2 HelloRequest

280

(1)

A5.1.3 ClientHello

280

(1)

A5.1.4 ServerHello

281

(1)

A5.1.5 Certificate

281

(1)

A5.1.6 ServerKeyExchange

281

(1)

A5.1.7 CertificateRequest

282

(1)

A5.1.8 ServerHelloDone

283

(1)

A5.1.9 ClientKeyExchange

283

(1)

A5.1.10 CertificateVerify

284

(1)

A5.1.11 Finished

284

(1)

6 TLS (Transport Layer Security) and WTLS (Wireless Transport Layer Security)

Abstract

285

(1)

6.1 From SSL to TLS

285

(5)

6.1.1 Start of the Encryption of Transmitted Data

286

(1)

6.1.2 The Available Cipher Suite

286

(1)

6.1.3 Computation of MasterSecret and the Derivation of Keys

286

(2)

6.1.4 Alert Messages

288

(1)

6.1.5 Responses to Record Blocks of Unknown Type

289

(1)

6.2 WTLS

290

(15)

6.2.1 Architecture

290

(2)

6.2.2 From TLS to WTLS

292

(7)

6.2.2.1 The Formats of Identifiers and Certificates

293

(1)

6.2.2.2 Cryptographic Algorithms

294

(1)

6.2.2.3 The Content of Some Handshake Messages

295

(1)

6.2.2.4 The Exchange Protocol during the Handshake

296

(1)

6.2.2.5 Calculation of Secrets

297

(2)

6.2.2.6 Parameter Sizes

299

(1)

6.2.2.7 Alert Messages

299

(1)

6.2.2.8 Record

299

(1)

6.2.3 Service Constraints

299

(12)

6.2.3.1 Possible Location of the WAP/Web Gateway

300

(1)

6.2.3.2 ITLS

301

(1)

6.2.3.3 NAETEA

302

(3)

6.3 Summary

305

(1)

Questions

306

(1)

7 The SET Protocol

Abstract

307

(1)

7.1 SET Architecture

308

(3)

7.2 Security Services of SET

311

(5)

7.2.1 Cryptographic Algorithms

312

(2)

7.2.2 The Method of the Dual Signature

314

(2)

7.3 Certification

316

(10)

7.3.1 Certificate Management

316

(4)

7.3.1.1 Cardholder Certificate

318

(1)

7.3.1.2 Merchant Certificates

319

(1)

7.3.1.3 Certificate of Financial Agents

319

(1)

7.3.1.4 Certificates of the Root Authority

319

(1)

7.3.1.5 Certificate Durations

320

(1)

7.3.2 Registration of the Participants

320

(6)

7.3.2.1 Cardholder Registration

320

(5)

7.3.2.2 Merchant Registration

325

(1)

7.4 Purchasing Transaction

326

(11)

7.4.1 SET Payment Messages

327

(2)

7.4.2 Transaction Progress

329

(14)

7.4.2.1 Initialization

329

(1)

7.4.2.2 Order Information and Payment Instruction

330

(4)

7.4.2.3 Authorization Request

334

(1)

7.4.2.4 Granting Authorization

334

(2)

7.4.2.5 Capture

336

(1)

7.5 Optional Procedures in SET

337

(1)

7.6 SET Implementations

338

(1)

7.7 Evaluation

339

(2)

7.8 Summary

341

(1)

Questions

341

(2)

8 Composite Solutions

Abstract

343

(1)

8.1 C-SET and Cyber-COMM

343

(10)

8.1.1 General Architecture of C-SET

344

(2)

8.1.2 Cardholder Registration

346

(2)

8.1.3 Distribution of the Payment Software

348

(1)

8.1.4 Purchase and Payment

348

(3)

8.1.5 Encryption Algorithms

351

(1)

8.1.6 Interoperability of SET and C-SET

352

(1)

8.1.6.1 Case 1: Cardholder Is C-SET Certified and Merchant Is SET Certified

352

(1)

8.1.6.2 Case 2: SET-Certified Cardholder and C-SET-Certified Merchant

352

(1)

8.2 Hybrid SSL/SET Architecture

353

(9)

8.2.1 Hybrid Operation SET/SSL

356

(2)

8.2.2 Transaction Flows

358

(3)

8.2.2.1 SSL Session between the Client and the Intermediary

358

(2)

8.2.2.2 Payment Authorization

360

(1)

8.2.2.3 Notification of the Merchant and the Client

360

(1)

8.2.2.4 Financial Settlement

360

(1)

8.2.3 Evaluation of the Hybrid Mode SET/SSL

361

(1)

8.3 3-D Secure

362

(7)

8.3.1 Enrollment

364

(1)

8.3.2 Purchase and Payment Protocol

365

(2)

8.3.3 Clearance and Settlement

367

(1)

8.3.4 Security

368

(1)

8.4 Payments with CD-ROM

369

(1)

8.5 Summary

370

(1)

Questions

370

(1)

9 Micropayments and Face-to-Face Commerce

Abstract

371

(1)

9.1 Characteristics of Micropayment Systems

372

(1)

9.2 Potential Applications

373

(1)

9.3 Chipper°

374

(2)

9.4 GeldKarte

376

(5)

9.4.1 Registration and Loading of Value

377

(1)

9.4.2 Payment

377

(3)

9.4.3 Security

380

(1)

9.5 Mondex

381

(3)

9.5.1 Loading of Value

382

(1)

9.5.2 Payment

382

(1)

9.5.3 Security

383

(1)

9.5.4 Pilot Experiments

384

(1)

9.6 Proton

384

(2)

9.6.1 Loading of Value

385

(1)

9.6.2 Payment

385

(1)

9.6.3 International Applications

386

(1)

9.7 Harmonization of Electronic Purses

386

(3)

9.7.1 Authentication of the Purse by the Issuer

387

(1)

9.7.2 Loading of Value

388

(1)

9.7.3 Point-of-Sales Payments

388

(1)

9.8 Summary

389

(2)

Questions

10 Remote Micropayments

Abstract

391

(1)

10.1 Security without Encryption: First Virtual

392

(3)

10.1.1 Buyer's Subscription

392

(1)

10.1.2 Purchasing Protocol

392

(2)

10.1.3 Acquisition and Financial Settlement

394

(1)

10.1.4 Security

394

(1)

10.1.5 Evaluation

395

(1)

10.2 NetBi11

395

(7)

10.2.1 Registration and Loading of Value

395

(1)

10.2.2 Purchase

396

(5)

10.2.2.1 Negotiation

398

(1)

10.2.2.2 Order

398

(1)

10.2.2.3 Delivery

398

(1)

10.2.2.4 Payment

399

(2)

10.2.3 Financial Settlement

401

(1)

10.2.4 Evaluation

401

(1)

10.3 KLELine

402

(6)

10.3.1 Registration

403

(1)

10.3.2 Purchase and Payment

403

(3)

10.3.3 Financial Settlement

406

(1)

10.3.4 Evaluation

406

(1)

10.3.5 Evaluation and Evolution

407

(1)

10.4 Millicent

408

(7)

10.4.1 Secrets

409

(1)

10.4.2 Description of the Scrip

409

(2)

10.4.3 Registration and Loading of Value

411

(1)

10.4.4 Purchase

412

(2)

10.4.5 Evaluation

414

(1)

10.5 PayWord

415

(6)

10.5.1 Registration and the Loading of Value

416

(1)

10.5.2 Purchase

417

(2)

10.5.2.1 Commitment

417

(1)

10.5.2.2 Delivery

418

(1)

10.5.3 Financial Settlement

419

(1)

10.5.4 Computational Load

419

(2)

10.5.4.1 Load on the Broker

419

(1)

10.5.4.2 Load on the User

420

(1)

10.5.4.3 Load on the Vendor

420

(1)

10.5.5 Evaluation

421

(1)

10.6 MicroMint

421

(3)

10.6.1 Registration and Loading of Value

422

(1)

10.6.2 Purchase

422

(1)

10.6.3 Financial Settlement

422

(1)

10.6.4 Security

422

(2)

10.6.4.1 Protection against Forgery

423

(1)

10.6.4.2 Protection against Coin Theft

423

(1)

10.6.4.3 Protection against Double Spending

424

(1)

10.6.5 Evaluation

424

(1)

10.7 eCoin

424

(1)

10.8 Comparison of the Different First-Generation Remote Micropayment Systems

425

(2)

10.9 Second-Generation Systems

427

(4)

10.9.1 Prepaid Cards Systems

427

(1)

10.9.2 Systems Based on Electronic Mail

427

(3)

10.9.2.1 PayPa1

428

(2)

10.9.3 Minitel-like Systems

430

(1)

Questions

431

(2)

11 Digital Money

Abstract

433

(1)

11.1 Building Blocks

434

(11)

11.1.1 Case of Debtor Untraceability

434

(4)

11.1.1.1 Loading of Value

435

(1)

11.1.1.2 Purchase

436

(1)

11.1.1.3 Deposit and Settlement

436

(1)

11.1.1.4 Improvement of Protection

436

(2)

11.1.2 Case of Creditor Untraceability

438

(1)

11.1.3 Mutual Untraceablity

438

(1)

11.1.4 Description of Digital Denominations

439

(3)

11.1.5 Detection of Counterfeit (Multiple Spending)

442

(3)

11.1.5.1 Loading of Value

443

(1)

11.1.5.2 Purchasing

444

(1)

11.1.5.3 Financial Settlement and Verification

444

(1)

11.1.5.4 Proof of Double Spending

444

(1)

11.2 DigiCash (Ecash)

445

(4)

11.2.1 Registration

446

(1)

11.2.2 Loading of Value

446

(1)

11.2.3 Purchase

447

(1)

11.2.4 Financial Settlement

448

(1)

11.2.5 Delivery

448

(1)

11.2.6 Evaluation

449

(1)

11.3 NetCash

449

(6)

11.3.1 Registration and Value Purchase

450

(1)

11.3.2 Purchase

450

(1)

11.3.3 Extensions of NetCash

451

(3)

11.3.4 Evaluation

454

(1)

11.4 Summary

455

(1)

Questions

456

(1)

12 Dematerialized Checks

Abstract

457

(1)

12.1 Classical Processing of Paper Checks

458

(1)

12.1.1 Checkbook Delivery

458

(1)

12.1.2 Check Processing

458

(1)

12.2 Dematerialized Processing of Paper-Based Checks

459

(3)

12.2.1 Electronic Check Presentment

460

(1)

12.2.2 Point-of-Sale Check Approval

461

(1)

12.2.3 Check Imaging

461

(1)

12.3 NetCheque

462

(4)

12.3.1 Registration

463

(1)

12.3.2 Payment and Financial Settlement

464

(2)

12.4 Bank Internet Payment System (BIPS)

466

(4)

12.4.1 Types of Transactions

466

(1)

12.4.2 BIPS Service Architecture

467

(3)

12.5 eCheck

470

(4)

12.5.1 Payment and Settlement

470

(3)

12.5.2 Representation of eChecks

473

(1)

12.6 Comparison of Virtual Checks with Bankcards

474

(2)

12.7 Summary

476

(1)

Questions

477

(2)

13 Security of Integrated Circuit Cards

Abstract

479

(1)

13.1 Overview

479

(5)

13.1.1 Classification of Smart Cards and Their Applications

480

(2)

13.1.2 Integrated-Circuit Cards with Contacts

482

(1)

13.1.3 Contactless Integrated-Circuit Cards

482

(2)

13.2 Description of Integrated-Circuit Cards

484

(2)

13.2.1 Memory Types

484

(1)

13.2.2 Operating Systems

485

(1)

13.3 Standards for Integrated-Circuit Cards

486

(3)

13.3.1 ISO Standards

486

(1)

13.3.2 EMV (EuroPay, MasterCard, Visa)

487

(2)

13.3.2.1 Properties of Encryption Keys

488

(1)

13.3.2.2 Migration to EMV

488

(1)

13.4 Security of Microprocessor Cards

489

(15)

13.4.1 Security during Production

489

(3)

13.4.2 Physical Security of the Card during Usage

492

(1)

13.4.3 Logical Security of the Card during Usage

493

(3)

13.4.3.1 Authentication with Symmetric Encryption

493

(1)

13.4.3.2 Authentication with Public-Key Encryption

494

(2)

13.4.4 Examples of Authentication

496

(7)

13.4.4.1 Memory Card Reader for the Minitel

496

(1)

13.4.4.2 Smart Card of French Banks

497

(1)

13.4.4.3 EMV Card

498

(5)

13.4.5 Evaluation

503

(1)

13.5 Multiapplication Smart Cards

504

(5)

13.5.1 File System of ISO/IEC 7816-4

504

(2)

13.5.2 The Swedish Electronic Identity Card

506

(1)

13.5.3 Management of Applications in Multiapplication Cards

506

(3)

13.5.3.1 Secondary Applications Controlled by the Primary Application

507

(1)

13.5.3.2 Federation of Several Applications under a Central Authority

507

(1)

13.5.3.3 Independent Multiapplications on the Same Card

508

(1)

13.6 Integration of Smart Cards with Computer Systems

509

(3)

13.6.1 OpenCard Framework

510

(1)

13.6.2 PC/SC

511

(1)

13.7 Limits on Security

512

(3)

13.7.1 Logical (Noninvasive) Attacks

512

(1)

13.7.2 Physical (Destructive) Attacks

513

(1)

13.7.3 Attacks due to Negligence in the Implementation

513

(1)

13.7.4 Attacks against the Chip-Reader Communication Channel

514

(1)

13.8 Summary

515

(2)

Questions

517

(2)

14 Systems of Electronic Commerce

Abstract

519

(1)

14.1 SEMPER

519

(4)

14.1.1 SEMPER Architecture

520

(2)

14.1.2 Payment Terminology in SEMPER

522

(1)

14.1.3 The Payment Manager

523

(1)

14.2 CAFE

523

(3)

14.3 JEPI

526

(1)

14.4 PICS and P3P

526

(1)

14.5 Analysis of User Behavior

527

(1)

14.6 Fidelity Cards

528

(1)

14.7 Quality of Service Considerations

529

(1)

14.8 Summary

530

(1)

Questions

531

(2)

15 Electronic Commerce in Society

Abstract

533

(1)

15.1 Communication Infrastructure

534

(2)

15.2 Harmonization and Standardization

536

(1)

15.3 Issuance of Electronic Money

537

(1)

15.4 Protection of Intellectual Property

538

(1)

15.5 Electronic Surveillance and Privacy

539

(4)

15.6 Filtering and Censorship

543

(1)

15.7 Taxation of Electronic Commerce

544

(1)

15.8 Fraud Prevention

545

(1)

15.9 Archives Dematerialization

545

(2)

Questions

547

(2)

Web Sites

General

549

(1)

Standards

549

(1)

Encryption

550

(1)

Kerberos

550

(1)

Certification

551

(1)

Biometrics

551

(2)

General

551

(1)

Standards Organizations

552

(1)

Products

552

(1)

Face Recognition

552

(1)

Fingerprints

552

(1)

Iris Scan

553

(1)

Hand Geometry

553

(1)

Keyboard Recognition

553

(1)

Retinal Scan

553

(1)

Speech Recognition

553

(1)

EDIFACT

553

(1)

XML

554

(1)

Integration XML/EDIFACT

554

(1)

SSL/TLS/WTLS

555

(1)

SET

555

(1)

Purses

555

(1)

Micropayments

556

(1)

Smart (Microprocessor) Cards

556

(1)

Electronic and Virtual Checks

557

(1)

SEMPER

558

(1)

Labeling Organizations

558

(1)

Organizations

559

(2)

Acronyms

561

(14)

References

575

(22)

Index

597

Please wait while the item is added to your bag...

FREE SHIPPING

Amazon no longer offers textbook rentals. We do!

Protocols for Secure Electronic Commerce, Second Edition

Summary

Table of Contents

Supplemental Materials