第七章 WEBsecurity 电子商务信息安全与管理教学课件.pptVIP

* * * * * * * * * * * * * * Stallings Fig 17-8. * * 在购买请求阶段，商家的初始应答中包含一个交易标识，该标识将在后面的各阶段中使用。 * Stallings Fig 17-10. * * * 在PI和OI中包含交易标识 Homework 7.5.2 7.2 7.6 7.7 Secure Electronic Transactions An open encryption and security specification. Protect credit card transaction on the Internet. Companies involved: MasterCard, Visa, IBM, Microsoft, Netscape, RSA, Terisa and Verisign Not a payment system. Set of security protocols and formats. SET Services Provides a secure communication channel among all parties involved in a transaction. Provides trust by the use of X.509v3 digital certificates. Ensures privacy because the information is only available to parties in a transaction when and where necessary. SET Participants 持卡人 商家 发卡机构 清算银行 支付网关 认证中心 Sequence of events for transactions The customer opens an account. The customer receives a certificate. Merchants have their own certificates. The customer places an order. The merchant is verified. The order and payment are sent. The merchant request payment authorization. The merchant confirm the order. The merchant provides the goods or service. The merchant requests payments. Dual Signature 双重签名 customer creates dual messages order information (OI) for merchant payment information (PI) for bank neither party needs details of other but must know they are linked use a dual signature for this signed concatenated hashes of OI PI Dual Signature 双重签名 PI = Payment Information PIMD = PI message digest OI = Order Information OIMD = OI message digest H = Hash function (SHA-1) POMD = Payment Order message digest || = Concatenation E = Encryption (RSA) KRc = Customers private signature key SET Transaction Types 1 Cardholder registration 8 Authorization reversal (撤销) 2 Merchant registration 9 Capture reversal 3 Purchase request 10 Credit (信用评估) 4 Payment authorization 11 Credit reversal 5 Payment capture