Electronic Payment Protection

1
Electronic Payment Protection

• Secure Sockets layer (SSL) or Secure Electronic
  Transaction (SET) protocols
• Certification Authority (e.g., http//www.verisign
  .com)
• Problem with SSL is the exposure at the client

2
Client
Request Secure Document
Server
Public Key Certificate
Client
Encrypted Session Key
Server
Document Encrypted With Session Key
Client
3
Secure Electronic Transaction (SET) Protocol

• Cardholder, merchant, CA, payment gateway
• All entities have certificates
• Cardholder keeps a security certificate with them
  
• Either in their computer - not mobile - or
• In the form of an electronic wallet

4
Secure Electronic Transaction (SET) Protocol

• Cardholder requests purchase from merchant
• Merchant requests from payment gateway
• Payment authorization
• Payment capture
• Payment gateway obtains
• Authorization from card issuer
• Payment capture information

5
Entities of SET Protocol in Cyber Shopping
5
6
Secure Electronic Transaction (SET) Protocol

• Merchant sends payment capture request to CA
• CA verifies information with acquiring
  (merchants) bank
• Merchant receives settlement from acquiring bank

7
SET vs. SSL
Secure Electronic Transaction (SET)
Secure Socket Layer (SSL)
8
Electronic Payment

• Debit cards
• Used in B2C
• Electronic funds transfer (EFT) / E-checks
• Electronic version of paper checking
• Combines certificates and signatures with payment
  
• Used in B2B
• ePay by Visa, SafeCheck (see www.echeck.org)

9
eCheck Process Flow
10
Electronic Payment

• Stored-value cards, e-cash (e.g., Mondex,
  CyberCoin, VisaCash)
• permit cost-effective micropayments
• mondex smart cards
• battery operated card readers
• swipe card
• value transferred to retailers terminal
• no authorization required

11
Electronic Payment

• Electronic wallet (Fujitsu, Mondex)
• can be used for Internet transaction settlement
• handheld terminal
• values are transferred from customers account to
  customers card or
• to merchants account via either the card or a
  Web connection
• can store values for different currencies
• http//www.mondex.com/

12
Electronic Payment

• Closed e-cash system
• Values recharged (transferred) only by bank
• VisaCash
• Open e-cash system
• Values can be transferred between cards
• Mondex
• eMail-grams
• Pay money to or receive money from anyone with
  email
• e.g., www.Paypal.com