Electronic Commerce

Chapter 3

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

31

Learning Objective 1

Explain the history of the Internet and how it works.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

32

Electronic Networks
Electronic networks are groups of computers that are connected together electronically. Local area networks (LANs) are networks that span a single site. Metropolitan area networks (MANs) span a single city or metropolitan area.
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 33

Electronic Networks
Wide area networks (WANs) are networks of computers that span at least two metropolitan areas.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

34

The Internet
The Internet is an electronic highway that allows computers to communicate with each other. The earliest practical version of the Internet was created in the early 1970s by the Pentagons Advanced Research Projects Agency (ARPA). It was called ARPANET.
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 35

The Internet

Bitnet

MILnet

NSFnet

They adopted a common set of communications protocols called TCP/IP (Transmission Control Protocol/Internet Protocol).
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 36

The Internet
Transmission Control Protocol (TCP) divides electronic messages into packets of information and then reassembles these packets at the end.

Internet Protocol (IP) assigns a unique address to each computer on the Internet.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

37

The Internet
Fixed IP address

Dynamic IP address
Domain name Domain name servers
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 38

Learning Objective 2

Describe intranets and explain how they are made secure.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

39

Intranets

It is a self-contained, in-house internet. Extranets exist when the intranets of two or more companies are linked together.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 10

Intranet Security Issues

The Internet
Network computers

Corporate Intranet

Firewall
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 11

Intranet Security Issues

Firewalls can be defeated.

An attacker can assume a false identify such as a false IP address.

What are additional layers of defense?

Access limits through password control

Encryption Proxy servers
3 12

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

Learning Objective 3

Explain client-server technology and how it applies to electronic financial transactions.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 13

Commerce on the Internet

It is a robot-type program that constantly runs on some computers and exchanges information with clients.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 14

Commerce on the Internet

What is a client?

It is a program that accesses and exchanges information with a server. A great many of the business transactions that occur on the Internet take place in client-server environments.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 15

Commerce on the Internet

Being robots, servers dont get paid by the hour and dont require fringe benefits. Servers can deal with hundreds of users (clients) at one time. Servers can be accessed at any time of day, anywhere in the world, with no per-minute communication charges.
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 16

Types of Servers
There are many kinds of servers on the Internet: Mail servers Web servers File servers Commerce servers

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 17

Types of Servers
Mail Server
Senders mail client Message sender Senders mail server Receivers mail server The Internet
3 18

Receivers mail client Message receiver

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

Types of Servers
What are file servers?
They allow authorized clients to retrieve files from libraries of files that exist on remote computers. The most common protocol for file serves is called FTP. A file server that uses this protocol is called an FTP server.
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 19

Types of Servers
What is a Web server? It is a server that allows a user (client) to access documents and run computer programs that reside on remote computers. All Web clients automatically read and interpret HTML (hypertext markup language).
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 20

Types of Servers
Hyperlinked Documents
Hyperlink World Wide Web document on server in Chicago World Wide Web document on server in San Diego World Wide Web document on server in Tokyo
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 21

Types of Servers

They are specialized types of Web servers with various commerce-related features. Support for the secure electronic transaction (SET) protocol

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 22

Types of Servers
Support for specialized types of client and server authentication Support for interfacing with external programs Enhanced security features Online credit card or bank verification
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 23

Types of Servers
Bank Encrypted communication link Verify payment

Order/payment information

Internet
Consumers client Commerce server

Product information and order verification

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 24

Types of Servers

Commerce server

Corporate accounting system

Goods shipped to customer

Shipping

Order file

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 25

Electronic Payment Systems

Traditional electronic bill payment systems

Traditional credit card systems

Secure electronic transaction (SET) systems Virtual cash systems

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 26

Learning Objective 4

Describe various approaches to securing electronic financial transactions.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 27

Security for Electronic Transaction

Secret-key encryption Public-key encryption

Digital envelopes

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 28

Secret-Key Encryption
Secret key

Message

Encryption

Decryption

Message

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 29

Public-Key Encryption
Recipients public key Recipients private key

Message

Encryption

Ciphertext

Decryption

Message

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 30

Digital Envelope
What is a digital envelope? It is an encryption method in which the message is encrypted with a secret key, and the secret key is encrypted with the recipients public key. This method is sometimes referred to as double-key encryption.
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 31

Double-Key Encryption
Recipients public key

Random message key

Public-key encryption

Encrypted message key

Message

Private-key encryption

Ciphertext
3 32

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

Double-Key Encryption
Recipients private key
Message key Encrypted message key Public-key decryption

Ciphertext

Private-key decryption

Message
3 33

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

Digital Signatures
A digital signature occurs when someone encrypts a message with his or her own private key.

What is a hashing function?

A hashing function takes a long variable-length string of characters and converts it into a short fixed-length string.
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 34

Digital Signature Creation

Hashing algorithm

Senders private key

Hash of message

Public-key decryption

Digital signature

Message
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 35

Verification of Digital Signature

Message

Hashing algorithm

Hash of message

Verify signature

Digital signature

Public-key decryption

Senders public key

3 36

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

Digital Time-Stamping
What is a digital time-stamping service (DTS)? It is an organization that adds digital time-stamps to documents.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 37

Digital Time-Stamp Procedure

Attach date and time, then digital signature

Message

Digital time stamp service

Message

Date and time Digital signature

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 38

Verification of Digital Time-Stamp

Message Date and time Digital signature

Hash message and date and time

Hashed message and date and time

Verify match

Decrypt DTSs signature with DTSs public key

Decrypted digital signature

3 39

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

Security Issues for Public-Key Encryption Systems

What is cryptanalysis attack? It involves various techniques for analyzing encrypted messages for purposes of decoding them without legitimate access to the keys.

The simplest possible attack on a message is the guessed plaintext attack.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 40

Security Issues for Public-Key Encryption Systems

The whole security of public-key encryption depends on the assumption that an attacker cannot factor the product of two large prime numbers (factoring attack).
The best way to prevent cryptanalysis and factoring attacks is to use very long keys.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 41

Security Issues for Public-Key Encryption Systems

What are some ways of protecting private keys? Creating and distributing keys Digital certificates Certificate revocation list (CRLS) Certificate chains Certificate-signing units Key expirations
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 42

Electronic Commerce and Encryption Technology

What is digital cash? It is money created when a bank attaches its digital signature to a note promising to pay the bearer some amount of money.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 43

Electronic Commerce and Encryption Technology

What is blinding? It is a technique in which a bank issues digital cash in such a way the it is unable to link the payer to the payee.

What is a blinded digital signature?

It is a digital signature and related digital cash that have been issued with blinding.
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 44

Computer Software and Computer Card Systems

What is an electronic wallet? It is a computer program that keeps track of the various keys and items of information associated with digital money.

What are smart cards?

They are hand-held electronic cards that are used for payments.
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 45

Computer Software and Computer Card Systems

Memory cards Shared-key cards

Signature-transporting cards
Signature-creating cards
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 3 46

End of Chapter 3

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood

3 47