Electronic Payment Systems for E-Commerce (Artech House Computer Security Series)

360 Pages·2002·4.13 MB·English

by  Donald O'Mahony

Y

L
F

M

A

E

T

Team-Fly®
Electronic Payment Systems
for E-Commerce
Second Edition
Forquitealongtime,computersecuritywasarathernarrowfieldofstudythatwas
populatedmainlybytheoreticalcomputerscientists,electricalengineers,andapplied
mathematicians.Withtheproliferationofopensystemsingeneral,andoftheInter-
netandtheWorldWideWeb(WWW)inparticular,thissituationhaschangedfun-
damentally. Today, computer and network practitioners are equally interested in
computersecurity,sincetheyrequiretechnologiesandsolutionsthatcanbeusedto
secureapplicationsrelatedtoelectroniccommerce.Againstthisbackground,thefield
of computer security has become very broad and includes many topics of interest.
Theaimofthisseriesistopublishstate-of-the-art,high-standardtechnicalbookson
topics related to computer security. Further information about the series can be
foundontheWWWatthefollowingURL:
http://www.esecurity.ch/serieseditor.html
Also, if you(cid:146)d like to contribute to the series and write a book about a topic
relatedtocomputersecurity,feelfreetocontacteithertheCommissioningEditoror
theSeriesEditoratArtechHouse.
Recent Titles in the Artech House
Computer Security Series
Rolf Oppliger, Series Editor
Demystifying the IPsec Puzzle, Sheila Frankel
Electronic Payment Systems for E-Commerce, Second Edition,
Donal O(cid:146)Mahony, Michael Peirce, and Hitesh Tewari
Information Hiding Techniques for Steganography and Digital Watermarking,
Stefan Katzenbeisser and Fabien A. P. Petitcolas, editors
Non-repudiation in Electronic Commerce, Jianying Zhou
Secure Messaging with PGP and S/MIME, Rolf Oppliger
Security Fundamentals for E-Commerce, Vesna Hassler
Security Technologies for the World Wide Web, Rolf Oppliger
ForalistingofrecenttitlesintheArtechHouse
ComputingLibrary,turntothebackofthisbook.
Electronic Payment Systems
for E-Commerce
Second Edition
Donal O(cid:146)Mahony
Michael Peirce
Hitesh Tewari
Artech House
Boston (cid:149) London
www.artechhouse.com
LibraryofCongressCataloging-in-PublicationData
O(cid:146)Mahony,Donal,1961(cid:150).
Electronicpaymentsystemsfore-commerce/DonalO(cid:146)Mahony,MichaelPeirce,
HiteshTewari.(cid:151)2nded.
p. cm.(cid:151)(ArtechHousecomputersecurityseries)
Rev.ed.of:Electronicpaymentsystems,c1997.
Includesbibliographicalreferencesandindex.
ISBN1-58053-268-3(alk.paper)
1.Electronicfundstransfers. 2.Dataencryption(Computerscience)
3.Internet. I.Peirce,M.E.(MichaelE.) II.Tewari,Hitesh. III.O(cid:146)Mahony,
Donal,1961(cid:150)Electronicpaymentsystems. IV.Title. V.Series.
HG1710.O45 2001
332(cid:146).0285(cid:151)dc21 2001022856
BritishLibraryCataloguinginPublicationData
O(cid:146)Mahony,Donal,1961(cid:150)
Electronicpaymentsystemsfore-commerce.(cid:151)2nd.ed.(cid:151)
(ArtechHousecomputersecurityseries)
1.Electronicfundstranfers
I.Title II.Peirce,Michael,1972(cid:150) III.Tewari,H.
332.1(cid:146)0285
ISBN
1-58053-463-5
CoverdesignbyIgorValdman
'2001ARTECHHOUSE,INC.
685CantonStreet
Norwood,MA02062
Allrightsreserved.PrintedandboundintheUnitedStatesofAmerica.Nopartofthis
bookmaybereproducedorutilizedinanyformorbyanymeans,electronicormechani-
cal,includingphotocopying,recording,orbyanyinformationstorageandretrievalsystem,
withoutpermissioninwritingfromthepublisher.
Alltermsmentionedinthisbookthatareknowntobetrademarksorservicemarks
havebeenappropriatelycapitalized.ArtechHousecannotattesttotheaccuracyofthis
information.Useofaterminthisbookshouldnotberegardedasaffectingthevalidityof
anytrademarkorservicemark.
InternationalStandardBookNumber:1-58053-268-3
LibraryofCongressCatalogCardNumber:2001022856
10987654321
Contents
Preface xiii
1 Motivationforelectronicpayment 1
References 4
2 Characteristicsofcurrentpaymentsystems 5
2.1 Cashpayments 6
2.2 Paymentthroughbanks 7
2.2.1 Paymentbycheck 7
2.2.2 Paymentbygiroorcredittransfer 9
2.2.3 Automatedclearinghouse(ACH)payments 9
2.2.4 Wiretransferservices 11
2.3 Usingpaymentcards 12
2.4 Consumerpreferencesinpaymentsystems 14
2.5 Regulatoryframework 15
References 17
3 Cryptographictechniques 19
3.1 Encryptionanddecryption 20
3.2 Symmetricencryption 21
3.2.1 DataEncryptionStandard(DES) 22
3.2.2 TripleDES 26
3.2.3 IDEA 26
3.2.4 AdvancedEncryptionStandard(AES) 28
3.2.5 RC2,RC4,andRC5 30
3.3 Messagedigestingorhashing 33
v
vi ElectronicPaymentSystemsforE-Commerce
3.3.1 MD5 34
3.3.2 TheSecureHashAlgorithm(SHA) 34
3.4 Kerberos 35
3.4.1 OverviewoftheKerberosmodel 35
3.4.2 Obtainingaticket 37
3.4.3 Servicerequest 38
3.5 Asymmetricorpublic-keyencryption 38
3.5.1 Propertiesofapublic-keycryptosystem 39
3.5.2 Trapdoorone-wayfunctions 40
3.5.3 Usingpublic-keycryptosystemsforauthentication 40
3.6 Digitalsignaturesandenveloping 40
3.7 RSA 42
3.8 Ellipticcurvecryptography 44
3.9 Public-keyinfrastructure(PKI) 45
3.9.1 Certificates 45
3.9.2 Certificationauthorities 46
3.9.3 Attributecertificates 47
3.10 Transportofsecurityinformation 48
3.10.1 Abstractsyntaxnotation(ASN.1) 49
3.10.2 TheX.509directoryauthenticationframework 51
3.10.3 PKCScryptographicmessagesyntax 53
3.11 Dualsignatures 54
3.12 Nonces 56
3.13 Blindsignatures 57
3.14 Chipcards/smartcards 59
3.14.1 Cardtypes 60
3.14.2 Memorytypesandcapacity 61
3.14.3 Physicalspecifications 63
3.14.4 Security 63
3.14.5 Public-keyprocessingcapabilities 64
3.14.6 Multiapplicationcards 65
3.14.7 JavaCard 65
3.14.8 MULTOS 67
3.14.9 Observers 68
References 69
4 Creditcard(cid:150)basedsystems 73
4.1 Mailorder/telephoneorder(MOTO)transactions 76
Contents vii
4.2 Unsecurednetworkpayments 76
4.3 FirstVirtual 77
4.4 Once-offcreditcardnumbers 80
4.5 Thesecuresocketlayer(SSL) 82
4.6 i-Keyprotocol(iKP) 89
4.6.1 FrameworkofiKPprotocols 90
4.6.2 1KP 91
4.6.3 2KP 96
4.6.4 3KP 98
4.7 SecureElectronicTransactions(SET) 100
4.7.1 TheSETtrustmodel 102
4.7.2 SETmessagestructure 105
4.7.3 Paymentinitialization(PInitReq/PInitRes) 106
4.7.4 Purchaseorder(PReq/PRes) 107
4.7.5 Authorization(AuthReq/AuthRes) 112
4.7.6 Captureofpayment(CapReq/CapRes) 114
4.7.7 Cardholderinquiry(InqReq/InqRes) 115
4.7.8 SETsoftwarecomponents 120
4.7.9 SETmarketacceptance 120
4.7.10 Server-sidewallets 122
4.7.11 UsingSETwithsmartcards 123
4.8 Summary 123
References 125
5 Electronicchecksandaccounttransfers 127
5.1 Paymenttransferbetweencentralizedaccounts 128
5.1.1 Fundingtheaccount 130
5.1.2 Authenticatedaccounttransfer 134
5.1.3 Withdrawingfundsfromthesystem 137
5.1.4 Businessmodels 137
5.2 FSTCpaymentinitiatives 138
5.2.1 Electroniccheckconcept 139
5.2.2 FinancialServicesMarkupLanguage(FSML) 141
5.2.3 Electroniccheckfunctionalflows 144
5.2.4 Check-handlinginfrastructure 146
5.2.5 BankInternetPaymentSystem(BIPS) 148
5.2.6 FinancialAgentSecureTransaction(FAST) 151
viii ElectronicPaymentSystemsforE-Commerce
5.3 NACHAInternetpayments 153
5.3.1 InternetSecureATMPayments(ISAP) 153
5.3.2 DirectPay 155
5.4 NetBill 156
5.4.1 Protocoloverview 157
5.4.2 Authenticationprocedure 159
5.4.3 Transactionprotocol 160
5.4.4 Pricerequestphase 161
5.4.5 Goodsdeliveryphase 161
5.4.6 Paymentphase 162
5.4.7 NetBillcharacteristics 163
5.5 NetCheque 164
5.6 Summary 167
References 167
6 Electroniccashpaymentsystems 171
6.1 Ecash 172
6.1.1 TheEcashmodel 173
6.1.2 Ecashcoins 174
6.1.3 Coinkeys 174
6.1.4 Double-spendingprevention 177
6.1.5 Withdrawingcoins 178
6.1.6 AnEcashpurchase 180
6.1.7 Makingthepayment 180
6.1.8 Provingpayment 181
6.1.9 Paymentdeposit 182
6.1.10 IntegrationwiththeWeb 182
6.1.11 Ecashinthemail 183
6.1.12 TransferringEcash 183
6.1.13 Lostcoins 184
6.1.14 Ecashandcrime 184
6.1.15 MagicMoney 186
6.1.16 Remarks 186
6.2 ProjectCAFE 186
6.2.1 GoalsofCAFE 187
6.2.2 Architecture 188
6.2.3 CAFEdevices 189
Contents ix
6.2.4 Roleofobservers 190
6.2.5 Protocoloverview 190
6.2.6 Off-linecoins 191
6.2.7 Thea protocol 192
6.2.8 TheG protocol 195
6.2.9 Additionalfeatures 196
6.2.10 Remarks 196
6.3 NetCash 196
6.3.1 Framework/model 197
6.3.2 NetCashcoins 198
6.3.3 Double-spendingprevention 199
6.3.4 Cointransfer 200
6.3.5 Certificateofinsurance 200
6.3.6 Basicpurchase 201
6.3.7 Obtainingcoins 201
6.3.8 Payingamerchant 203
6.3.9 Verifyingcoins 204
6.3.10 Providinglimitedanonymity 204
6.3.11 Merchantanonymity 205
6.3.12 Preventinganonymity 206
6.3.13 Clearing 206
6.3.14 Extensions 207
6.3.15 Preventingmerchantfraud 207
6.3.16 Off-lineprotocols 209
6.3.17 Remarks 210
6.4 Mondex 210
6.5 EMVcashcardsandCEPS 213
6.5.1 EMV2000 214
6.5.2 CommonElectronicPurseSpecification(CEPS) 214
6.5.3 Remarks 220
6.6 SmartAxis 220
6.7 Remarks 222
References 223
7 Micropaymentsystems 227
7.1 Millicent 228
7.1.1 TheMillicentmodel 229