The Secure Electronic Transaction

Published Date: 02 Nov 2017

MasterCard and Visa realized that for e-commerce payment processing, software vendors were coming up with new and conflicting standards. Microsoft mainly drove these on one hand, and IBM on the other. To avoid all sorts of future incompatibilities, MasterCard and Visa decided to come up with a standard, ignoring all their competition issues, and in the process, involving all the major software manufacture. (Atul Kahate, 2008)

The basic idea is that both cardholders and merchants must register with Certificate Authorities before they engage in transactions. The cardholder must use an internet browser and the vendor must use a system that is capable of meeting the SET requirements

SET Participants (Fig 1)

Customer: This could be retail, individual or business that are making purchases and using credit card for payment. (Stuart Jacob, 2011)

Merchant: A merchant is a business from whom these purchases are made. A merchant must have a relationship with an Acquirer for accepting payments on the internet. (Stuart Jacob, 2011)

Issuer: The issuer is typically a bank who will authorize the payment for a customer purchase. (Stuart Jacob, 2011)

Acquirer: The acquirer is typically a financial institution that establishes an account with a merchant and processes payment card authorizations and payments. (William Stallings, 2002)

Payment Gateway: is service provider service that authorizes payments for merchant and protect credit card details by encrypting sensitive information to ensure that information is passed securely between the customer and the merchant. (William Stallings, 2002)

Certification Authority (CA): This is an authority that is trusted to provide public key certificates to customer, merchant and payment gateways. (Atul Kahate, 2008)

The purpose of the dual signature is to provide another layer of security for the internet transaction, for both sides (the cardholder and the vendor). When the cardholder initiate the transaction, two signature certificate will be used, the cardholder will send the order information to the vendor with one certificate and at the same time will send the payment information to the bank with another certificate. The vendor do not need to know the cardholder credit card number, similarly the bank do not need to know the details of the cardholder purchase. But the bank will receive a signature certificate from the vendor and make the payment to the vendor.

Fig1. (William Stallings, 2002) Fig 2. (William Stallings, 2002)

The SET dual signature creation steps are shown in Fig 2

The purchaser creates a SHA-1 digest (OIMD) of the document describing what is being purchased, the order information (OI). (Stuart Jacob, 2011)

The purchaser creates a SHA-1 digest (PIMD) of the document describing how the purchase is to be paid for, the payment information (PI). (Stuart Jacob, 2011)

The purchaser creates a SHA-1 digest (POMD) on concatenated copies of the OIMD & PIMD. (Stuart Jacob, 2011)

The purchaser encrypts the POMD, using RSA private key. (Stuart Jacob, 2011)

Dual signature is important because it accomplishes several things:

It provides confidentiality of payment information.

It ensures integrity of all transmitted data.

It provides non-repudiation once the both SET sides are authenticates.

It authenticates the cardholder to the vendor without disclosing the client financial information.

It authenticates the cardholder to the credit card company without disclosing information about the purchase.

It is important for all principles be authenticated, because deception could happen on either end of the transaction. A cardholder could be using a fake credit card account, or the vendor could be a fake company. The credit card company is responsible, during the transaction, for authenticating to the vendor that the cardholder is authentic.

References:

Stuart Jacob.(2011, October 31).Engineering Information Security: The Application of Systems Engineering

Atul Kahate.(2008, February 3).Security and Threat Models - Secure Electronic Transaction (SET) Protocl

Retrieved from

http://www.indicthreads.com/1496/security-and-threat-models-secure-electronic-transaction-set-protocol/

William Stallings.(2002, May 17).Introduction to Secure Electronic Transaction (SET)

Retrieved from

http://www.informit.com/articles/article.aspx?p=26857&seqNum=3

Question 5.2

Checking the outgoing traffic may help to check if confidential or sensitive information or data are leaking out through software, or some employees, by checking for specific protocol header or signature in the traffic, it can prevent attacks from inside on outside machines through users or software like worms or viruses

A lot of companies don’t pay attention on controlling the outgoing traffic, there are chances that an employee without any intention introduce malicious program into their systems by just opening an email attachment or by surfing the internet and accessing a site that might have malicious content that installs a program silently on an internal system using open ports. These programs will at some point start some connections on the open ports to an attacker outside the system that from the firewall standpoint, seem to be coming from inside and are therefore allowed.

Suppose you received an email and you opened it, that email may include an embedded malicious program that is designed to install itself on your machine at the background and then continue to send personal information gathered from the machine out through the internet or maybe the program will act as a distributed denial of service DDoS attack zombie. This is currently the most common method of infection. (Ronald Pacchiano, 2011)

Since the traffic generated by such programs would seem genuine, meaning that it looks like it came from inside the network, it would generally be allowed to leave the same network on the same port or any other open port. The malicious traffic could be blocked if the firewall was configured to block outgoing traffic on the particular TCP/IP port(s) the program was using, but given that there are over 65,000 possible ports and there's no way to be sure which ports a program of this nature might use, the odds of the right ones being blocked are slim and might block port(s) that are essential for the business functions. (Ronald Pacchiano, 2011)

In Fact, blocking ports also prevents genuine programs running on your computer from using them. For example, if you suspect a machine was infected by a malware or virus that was designed to create and send spam email from the same machine, and you tried to block the hardware firewall to control the traffic flow and limit the damage, it will also block your ability to use the email application in which they generate the same kind of traffic.

The firewall should be also set to monitor for abnormal behavior, such as large outbound traffic from internal machines that typically would not be generating significant outbound traffic.