You are on page 1of 66

Internet dan Jaringan Komputer

Electronic Commerce and


Mobile Commerce
Dr. Tb. Maulana Kusuma
mkusuma@staff.gunadarma.ac.id
http://staffsite.gunadarma.ac.id/mkusuma

Magister Manajemen Sistem Informasi 1


Magister Manajemen Sistem Informasi
Internet dan Jaringan Komputer - Universitas Gunadarma 2006
Universitas Gunadarma Definition
Definition of
of E-Commerce
E-Commerce

E-Commerce

Definition
Framework
Media Convergence
Anatomy
Slides prepared by Tb. Maulana Kusuma, Universitas Gunadarma
Internet Sites
Commercial Uses “A modern business methodology that
E-Commerce & WWW
addresses the needs of organizations,
E-Commerce Security merchants, and consumers to cut costs while
Transact. Security
Firewall
improving the quality of goods and services
Encryption and increasing the speed of service delivery”
Public Key Infra-
structure

Consumer Oriented

Home Banking
Home Shopping

Electronic Payment
Banking & Financial
Retailing
On-line E-Commerce
Magister Manajemen Sistem Informasi
Internet dan Jaringan Komputer - Universitas Gunadarma 2006
Universitas Gunadarma E-Commerce
E-Commerce Framework
Framework

E-Commerce Electronic Commerce Applications


• Supply chain management
Definition
Framework • Video on-demand
Media Convergence • Remote Banking
Anatomy
Slides prepared by Tb. Maulana Kusuma, Universitas Gunadarma • Procurement and purchasing
Internet Sites
Commercial Uses • On-line marketing and advertising
E-Commerce & WWW • Home shopping
Common business services infrastructure
E-Commerce Security (security / authentication, electronic payment,
directories / catalogs)
Transact. Security
Firewall The messaging and information
Encryption distribution infrastructure
Public Key Infra-
structure
Multimedia content and network
Consumer Oriented publishing infrastructure

Home Banking
The Information Superhighway infrastructure
Home Shopping
(telecom, cable TV, wireless, Internet)

Electronic Payment
Banking & Financial
Retailing
On-line E-Commerce Technical standards
Public policy, legal
and privacy issues for electronic documents,
multimedia and network protocols
Magister Manajemen Sistem Informasi
Internet dan Jaringan Komputer - Universitas Gunadarma 2006
Universitas Gunadarma E-Commerce
E-Commerce &
& Media
Media Convergence
Convergence

E-Commerce

Definition
Framework “Convergence, broadly defined, is the melding of consumer
Media Convergence
Anatomy
electronics, television, publishing, telecommunications, and
Internet Sites
Slides prepared by Tb. Maulana Kusuma, Universitas Gunadarma computers for the purpose of facilitating new forms of information-
Commercial Uses based commerce”
E-Commerce & WWW
 Convergence of content
E-Commerce Security
Translates all types of information content -- books, business
Transact. Security
documents, videos, movies, music -- into digital information.
Firewall
Encryption  Convergence of transmission
Public Key Infra-
structure Compresses and stores digitized information so it can travel
Consumer Oriented through existing phone and cable wiring.
Home Banking  Convergence of information access device
Home Shopping
To function as both computers and televisions.
Electronic Payment
Banking & Financial
Retailing
On-line E-Commerce
Magister Manajemen Sistem Informasi
Internet dan Jaringan Komputer - Universitas Gunadarma 2006
Universitas Gunadarma Anatomy
Anatomy of
of E-Commerce
E-Commerce Applications
Applications

E-Commerce

Definition
Framework
Media Convergence
Anatomy
Computer Game
Slides prepared by Tb. Maulana Kusuma, Universitas Gunadarma servers
Internet Sites Video
Commercial Uses servers
E-Commerce & WWW

E-Commerce Security PDA Network


Internet Corporate
Transact. Security servers
Firewall
Encryption
Public Key Infra- Telephone
structure
Libraries
Consumer Oriented • Chatlines
Network
•Software
Home Banking TV Service
Home Shopping Provider

Electronic Payment Government


servers Electronic
Banking & Financial publishing
Printer
Retailing
On-line E-Commerce Information Servers with
Consumer Devices Variety of Content
Magister Manajemen Sistem Informasi
Internet dan Jaringan Komputer - Universitas Gunadarma 2006
Universitas Gunadarma Types
Types of
of Internet
Internet Sites
Sites

E-Commerce

Definition There are broadly speaking two main types of


Framework commercial Internet sites available to companies at
Media Convergence
Anatomy
present:
Slides prepared by Tb. Maulana Kusuma, Universitas Gunadarma
Internet Sites
Commercial Uses
 Static Sites
E-Commerce & WWW
It can be used for displaying large amounts of
E-Commerce Security information provided the information does not
Transact. Security
require regular updating and a high degree of
Firewall functionality is not required.
Encryption
Public Key Infra-  Databased Sites
structure
Sometimes referred to as Database Front-end
Consumer Oriented
Systems or dynamically generated Internet sites.
Home Banking
Home Shopping
It can be designed to interact with existing
systems such as order processing, stock control
Electronic Payment systems and sources of information such as
Banking & Financial product databases.
Retailing
On-line E-Commerce
Magister Manajemen Sistem Informasi
Internet dan Jaringan Komputer - Universitas Gunadarma 2006
Universitas Gunadarma Commercial
Commercial Uses
Uses of
of the
the Internet
Internet

E-Commerce
On-line databases On-line databases
Definition (product & services) (selling information)
Framework
Media Convergence
Anatomy
Slides prepared by Tb. Maulana Kusuma, Universitas Gunadarma
Internet Sites
Commercial Uses Employees in the organization Business customers
E-Commerce & WWW
whose tasks range from
procurement to payment
E-Commerce Security

Transact. Security The


Firewall
Encryption
Internet
Public Key Infra-
structure

Consumer Oriented

Home Banking
Home Shopping

Electronic Payment Financial institutions,


banks, credit card Customers at home
Banking & Financial
Retailing companies
On-line E-Commerce Global suppliers
Magister Manajemen Sistem Informasi
Internet dan Jaringan Komputer - Universitas Gunadarma 2006
Universitas Gunadarma Firewall
Firewall

E-Commerce
Corporate Network
Definition
Framework
Media Convergence
Anatomy
Slides prepared by Tb. Maulana Kusuma, Universitas Gunadarma
Internet Sites
Commercial Uses
E-Commerce & WWW
Internet Firewall
E-Commerce Security

Transact. Security Enterprise


Firewall LAN
Encryption or
Public Key Infra- WAN
structure

Consumer Oriented

Home Banking
Home Shopping

Electronic Payment
Banking & Financial
Retailing Firewall bypass
On-line E-Commerce should not be allowed
Magister Manajemen Sistem Informasi
Internet dan Jaringan Komputer - Universitas Gunadarma 2006
Universitas Gunadarma Encryption
Encryption

E-Commerce Encryption is the mutation of information in any form


Definition (text, video, graphics) into a representation unreadable
Framework by anyone without a decryption key.
Media Convergence
Anatomy  Secret Key Cryptography
Slides prepared by Tb. Maulana Kusuma, Universitas Gunadarma
Internet Sites
Commercial Uses Involved the use of a shared key for both
E-Commerce & WWW encryption by the transmitter and decryption by the
E-Commerce Security
receiver. This technique suffer from the problem of
key distribution, since shared keys must be
Transact. Security
Firewall
securely distributed to each pair of communicating
Encryption parties.
Public Key Infra-
structure  Public Key Cryptography
Consumer Oriented Public-key techniques involve a pair of keys; a
Home Banking private key and a public key associated with each
Home Shopping
user. Information encrypted by the private key can
Electronic Payment
be decrypted only using the corresponding public
key. The private key, used to encrypt transmitted
Banking & Financial
Retailing information by the user, is kept secret. The public
On-line E-Commerce key is used to decrypt information at the receiver
and is not kept secret.
Magister Manajemen Sistem Informasi
Internet dan Jaringan Komputer - Universitas Gunadarma 2006
Universitas Gunadarma Personal
Personal Finance
Finance and
and Home
Home
Banking
Banking Management
Management
E-Commerce

Definition
Framework
Media Convergence Home computer
Anatomy ATM
Slides prepared by Tb. Maulana Kusuma, Universitas Gunadarma
Internet Sites
Commercial Uses
E-Commerce & WWW

E-Commerce Security
The Internet
Transact. Security
Firewall
Encryption
Public Key Infra-
structure

Consumer Oriented

Home Banking
Home Shopping Bank Server

Electronic Payment
Banking & Financial
Retailing
On-line E-Commerce ATM
Home computer
Magister Manajemen Sistem Informasi
Internet dan Jaringan Komputer - Universitas Gunadarma 2006
Universitas Gunadarma Home
Home Shopping
Shopping

E-Commerce

Definition
Framework
Media Convergence
Anatomy
Slides prepared by Tb. Maulana Kusuma, Universitas Gunadarma
Internet Sites
Commercial Uses
E-Commerce & WWW

E-Commerce Security

Transact. Security
Firewall
Encryption
Public Key Infra-
structure

Consumer Oriented

Home Banking
Home Shopping

Electronic Payment
Banking & Financial
Retailing
On-line E-Commerce
Magister Manajemen Sistem Informasi
Internet dan Jaringan Komputer - Universitas Gunadarma 2006
Universitas Gunadarma Banking
Banking &
& Financial
Financial Payments
Payments

E-Commerce

Definition
Framework
Media Convergence
Anatomy
Internet Sites
Commercial Uses
Slides prepared by Tb. Maulana Kusuma, Universitas Gunadarma
 Large-scale or wholesale payments
E-Commerce & WWW
e.g., bank-to-bank transfer
E-Commerce Security

Transact. Security
 Small-scale or retail payments
Firewall
Encryption e.g., automated teler machines and
Public Key Infra-
structure cash dispenser
Consumer Oriented
 Home Banking
Home Banking
Home Shopping
e.g., bill payment
Electronic Payment
Banking & Financial
Retailing
On-line E-Commerce
Magister Manajemen Sistem Informasi
Internet dan Jaringan Komputer - Universitas Gunadarma 2006
Universitas Gunadarma Retailing Payments
Payments

E-Commerce

Definition
Framework
Media Convergence
Anatomy
Internet Sites
Commercial Uses
Slides prepared by Tb. Maulana Kusuma, Universitas Gunadarma
 Credit cards
E-Commerce & WWW
e.g., VISA or MasterCard
E-Commerce Security

Transact. Security
 Private label credit / debit cards
Firewall
Encryption e.g., J.C. Penney Card, BCA Debit
Public Key Infra-
structure
 Charge cards
Consumer Oriented

Home Banking e.g., American Express


Home Shopping

Electronic Payment
Banking & Financial
Retailing
On-line E-Commerce
Magister Manajemen Sistem Informasi
Internet dan Jaringan Komputer - Universitas Gunadarma 2006
Universitas Gunadarma On-line
On-line E-Commerce
E-Commerce Payment
Payment Systems
Systems

E-Commerce

Definition
Framework
Media Convergence
Anatomy
Internet Sites
Commercial Uses
Slides prepared by Tb. Maulana Kusuma, Universitas Gunadarma
 Token-based payment systems
E-Commerce & WWW
 Electronic cash (e.g., DigiCash)
E-Commerce Security
 Electronic checks (e.g., NetCheque)
Transact. Security
Firewall  Smart cards or debit cards (e.g., Mondex)
Encryption
Public Key Infra-
structure
 Credit card-based payment systems
Consumer Oriented  Encrypted Credit cards (e.g., WWW form-
Home Banking based encryption)
Home Shopping
 Third-party authorization numbers (e.g., First
Electronic Payment
Virtual)
Banking & Financial
Retailing
On-line E-Commerce
Outline

m-Commerce Overview
Infrastructure
m-Commerce Applications
Mobile Payment
Limitations
Security in m-Commerce

Magister Manajemen Sistem Informasi 15


Mobile Commerce: Overview

Mobile commerce (m-Commerce,


m-Business)—any e-Commerce done in a
wireless environment, especially via the
Internet
 Can be done via the Internet, private
communication lines, smart cards, etc.
 Creates opportunity to deliver new services to
existing customers and to attract new ones

Magister Manajemen Sistem Informasi 16


Mobile commerce from the Customer‘s
point of view
The customer wants to access information, goods
and services any time and in any place on his
mobile device.

He can use his mobile device to purchase tickets for


events or public transport, pay for parking, download
content and even order books and CDs.

He should be offered appropriate payment methods.


They can range from secure mobile micropayment
to service subscriptions.

Magister Manajemen Sistem Informasi 17


Mobile commerce from the Provider‘s
point of view
The future development of the mobile telecommunication
sector is heading more and more towards value-added
services. Analysts forecast that soon half of mobile
operators‘ revenue will be earned through mobile
commerce.

Consequently operators as well as third party providers


will focus on value-added-services. To enable mobile
services, providers with expertise on different sectors will
have to cooperate.

Innovative service scenarios will be needed that meet


the customer‘s expectations and business models that
satisfy all partners involved.
Magister Manajemen Sistem Informasi 18
m-Commerce Terminology

Generations
 1G: 1979-1992 wireless technology

 2G: current wireless technology; mainly

accommodates text
 2.5G: interim technology accommodates graphics

 3G: 3rd generation technology (2001-2005)

supports rich media (video clips)


 4G: will provide faster multimedia display (2006-

2010)

Magister Manajemen Sistem Informasi 19


Terminology and Standards

GPS: Satellite-based Global Positioning System


PDA: Personal Digital Assistant—handheld
wireless computer
SMS: Short Message Service
EMS: Enhanced Messaging Service
MMS: Multimedia Messaging Service
WAP: Wireless Application Protocol
Smart-phones—Internet-enabled cell phones
with attached applications
Magister Manajemen Sistem Informasi 20
Attributes of m-Commerce and Its
Economic Advantages
 Mobility—users carry cell phones or other mobile
devices
 Broad reach—people can be reached at any time
 Ubiquity—easier information access in real-time
 Convenience—devices that store data and have
Internet, intranet, extranet connections
 Instant connectivity—easy and quick connection to
Internet, intranets, other mobile devices, databases
 Personalization—preparation of information for individual
consumers
 Localization of products and services —knowing where
the user is located at any given time and match service
to them
Magister Manajemen Sistem Informasi 21
Outline

m-Commerce
Infrastructure
m-Commerce Applications
Mobile Payment
Limitations
Security in m-Commerce

Magister Manajemen Sistem Informasi 22


Mobile Computing Infrastructure

Hardware
Cellular (mobile) phones
Screenphones—a
Attachable keyboard telephone equipped with
PDAs color screen, keyboard, e-
Interactive pagers mail, and Internet
Other devices capabilities
 Notebooks E-mail handhelds
 Handhelds Wirelined—connected by
 Smartpads
wires to a network

Magister Manajemen Sistem Informasi 23


Mobile Computing Infrastructure
(cont.)

Unseen infrastructure requirements


 Suitably configured wireline or wireless WAN
modem
 Web server with wireless support
 Application or database server
 Large enterprise application server
 GPS locator used to determine the location of
mobile computing device carrier

Magister Manajemen Sistem Informasi 24


Mobile Computing Infrastructure
(cont.)
Software
 Micro browser
 Mobile client operating system (OS)
 Bluetooth—a chip technology and WPAN standard
that enables voice and data communications between
wireless devices over short-range radio frequency
(RF)
 Mobile application user interface
 Back-end legacy application software
 Application middleware
 Wireless middleware
Magister Manajemen Sistem Informasi 25
Mobile Computing Infrastructure
(cont.)

Networks and access


 Wireless transmission media
Microwave
Satellites
Radio
Infrared
Cellular radio technology
 Wireless systems

Magister Manajemen Sistem Informasi 26


Outline
m-Commerce Overview
Infrastructure
m-Commerce Applications
Mobile Payment
Limitations
Security in m-Commerce

Magister Manajemen Sistem Informasi 27


Mobile Service Scenarios

Financial Services.
Entertainment.
Shopping.
Information Services.
Payment.
Advertising.
And more ...

Magister Manajemen Sistem Informasi 28


Early content and applications have all been geared around information
delivery but as time moves on the accent will be on revenue
generation.

Entertainment Communications
• Music • Short Messaging
• Games • Multimedia Messaging
• Graphics • Unified Messaging
• Video • e-mail
• Chat rooms
• Video - conferencing
m-Commerce
Information
Transactions
• News
• Banking
• City guides
• Broking
• Directory Services
• Shopping
• Maps
• Auctions
• Traffic and weather
• Betting
• Corporate information
• Booking &
reservations
• Market data
• Mobile wallet
• Mobile purse
Magister Manajemen Sistem Informasi 29
Classes of M-Commerce Applications

Magister Manajemen Sistem Informasi 30


Mobile Application: Financial Tool

As mobile devices become more secure


Mobile banking
Bill payment services
m-Brokerage services
Mobile money transfers
Mobile micro payments
Replace ATM’s and credit cards??

Magister Manajemen Sistem Informasi 31


Financial Tool:
Wireless Electronic Payment Systems

“transform mobile phones into secure,


self-contained purchasing tools capable
of instantly authorizing payments…”
Types:
 Micro payments
 Wireless wallets (m-Wallet)
 Bill payments

Magister Manajemen Sistem Informasi 32


Examples

Swedish Postal Bank


 Check Balances/Make Payments & Conduct
some transactions
Dagens Industri
 Receive Financial Data and Trade on
Stockholm Exchange
Citibank
 Access balances, pay bills & transfer funds
using SMS

Magister Manajemen Sistem Informasi 33


Mobile Applications : Marketing,
Advertising, And Customer Service
Shopping from Wireless Devices
 Have access to services similar to those of
wireline shoppers
Shopping carts
Price comparisons
Order status
 Future
Will be able to view and purchase products using
handheld mobile devices

Magister Manajemen Sistem Informasi 34


Mobile Applications : Marketing,
Advertising, And Customer Service
Targeted Advertising
 Using demographic information can
personalize wireless services
(barnesandnoble.com)
 Knowing users’ preferences and surfing
habits marketers can send:
User-specific advertising messages
Location-specific advertising messages

Magister Manajemen Sistem Informasi 35


Mobile Applications : Marketing,
Advertising, And Customer Service
CRM applications
 MobileCRM
 Comparison shopping using Internet capable
phones
 Voice Portals
Enhanced customer service improved access to
data for employees

Magister Manajemen Sistem Informasi 36


Mobile Portals

“A customer interaction channel that


aggregates content and services for
mobile users.”
 Charge per time for service or subscription
based
Example: I-Mode in Japan
 Mobile corporate portal
Serves corporations customers and suppliers

Magister Manajemen Sistem Informasi 37


Mobile Intrabusiness and Enterprise
Applications
Support of Mobile Employees
by 2005 25% of all workers could be mobile
employees
 sales people in the field, traveling executives,

telecommuters, consultants working on-site,


repair or installation employees
need same corporate data as those working
inside company’s offices
 solution: wireless devices

wearable devices: cameras, screen,


keyboard, touch-panel display

Magister Manajemen Sistem Informasi 38


Mobile B2B and Supply Chain
Applications
“mobile computing solutions enable organizations to respond
faster to supply chain disruptions by proactively adjusting
plans or shifting resources related to critical supply chain
events as they occur.”
 accurate and timely information

 opportunity to collaborate along supply chain

 must integrate mobile devices into information exchanges

 example: “telemetry” integration of wireless

communications, vehicle monitoring systems, and vehicle


location devices
leads to reduced overhead and faster service
responsiveness (vending machines)

Magister Manajemen Sistem Informasi 39


Applications of Mobile Devices for
Consumers/Industries
Personal Service Applications
 example airport

Mobile Gaming and Gambling


Mobile Entertainment
 music and video

Hotels
Intelligent Homes and Appliances
Wireless Telemedicine
Other Services for Consumers

Magister Manajemen Sistem Informasi 40


Outline
m-Commerce Overview
Infrastructure
m-Commerce Applications
Mobile Payment
Limitations
Security in m-Commerce

Magister Manajemen Sistem Informasi 41


Mobile Payment for m-Commerce

Mobile Payment can be offered as a stand-alone


service.

Mobile Payment could also be an important enabling


service for other m-commerce services (e.g. mobile
ticketing, shopping, gambling…) :

 It could improve user acceptance by making the services


more secure and user-friendly.
 In many cases offering mobile payment methods is the
only chance the service providers have to gain revenue
from an m-Commerce service.

Magister Manajemen Sistem Informasi 42


Mobile Payment (cont.)

the consumer must be informed of:


 what is being bought, and
 how much to pay
 options to pay;
the payment must be made
payments must be traceable.

Magister Manajemen Sistem Informasi 43


Mobile Payment (cont.)
Customer requirements:
 a larger selection of merchants with whom they can
trade
 a more consistent payment interface when making the
purchase with multiple payment schemes, like:
• Credit Card payment
• Bank Account/Debit Card Payment
Merchant benefits:
• brands to offer a wider variety of payment
• Easy-to-use payment interface development
Bank and financial institution benefits
• to offer a consistent payment interface to consumer and
merchants

Magister Manajemen Sistem Informasi 44


Payment via Internet Payment Provider

WAP
GW/Proxy

Browsing (negotiation)

Merchant
Mobile e-Payment
Server

GSM Security SSL tunnel


User
SMS-C
IPP

Mobile Wallet
CC/Bank
Magister Manajemen Sistem Informasi 45
Payment via Integrated Payment Server
WAP
GW/Proxy

Browsing (negotiation)

Mobile Commerce
Server
Merchant

GSM Security
User SSL tunnel

SMS-C ISO8583 Based


CP

VPP IF
CC/Bank
Mobile Wallet
Voice Pre-Paid

Magister Manajemen Sistem Informasi 46


Outline

m-Commerce Overview
Infrastructure
m-Commerce Applications
Mobile Payment
Limitations
Security in m-Commerce

Magister Manajemen Sistem Informasi 47


Limitations of m-Commerce

Usability Problem
small size of mobile devices (screens,
keyboards, etc)
limited storage capacity of devices
hard to browse sites
Technical Limitations
lack of a standardized security protocol
insufficient bandwidth
3G licenses

Magister Manajemen Sistem Informasi 48


Limitations of m-Commerce

Technical Limitations…
transmission and power consumption limitations
 poor reception in tunnels and certain buildings
 multi-path interference, weather, and terrain problems
and distance-limited connections

WAP Limitations
Speed
Cost
Accessibility

Magister Manajemen Sistem Informasi 49


Limiting Technological Factors

Networks Mobile Middleware Localization


•Bandwidth •Standards •Upgrade of Network
•Interoperability •Distribution •Upgrade of Mobile
•Cell Range Devices
•Roaming •Precision

Security
Mobile Devices
•Mobile Device
•Battery
•Network
•Memory
•Gateway
•CPU
•Display Size

Magister Manajemen Sistem Informasi 50


Potential Health Hazards

Cellular radio signals = cancer?


 No conclusive evidence yet
 could allow for myriad of lawsuits
 mobile devices may interfere with sensitive
medical devices such as pacemakers

Magister Manajemen Sistem Informasi 51


Outline

m-Commerce Overview
Infrastructure
m-Commerce Applications
Mobile Payment
Limitations
Security in m-Commerce

Magister Manajemen Sistem Informasi 52


Security in m-Commerce:
Environment
CA

SAT GW
(SIM)

Mobile Content
Mobile IP Aggregation
Network Service Internet
Provider
Network
WAP1.1 (+SIM where avail.) Merchant
WAP GW

Mobile e-Commerce Bank (FI)


Server
Mobile Bank
WAP1.2 Security and
(WIM) Payment

Operator centric model


Magister Manajemen Sistem Informasi 53
WAP Architecture

Client Web Server


WAP Gateway
WML

with WML-Script
WML Encoder CGI

WML Decks
WML- Scripts
WSP/WTP WMLScript HTTP etc.
Script
Compiler
WTAI
Protocol Adapters Content
Etc.

Magister Manajemen Sistem Informasi 54


Comparison between Internet and
WAP Technologies
Wireless Application Protocol

HTML Wireless Application Other Services and


JavaScript Environment (WAE) Applications

Session Layer (WSP)


HTTP
Transaction Layer (WTP)

TLS - SSL Security Layer (WTLS)

Transport Layer (WDP)


TCP/IP
UDP/IP Bearers:
SMS USSD
MagisterCSD IS-136
Manajemen CDMA
Sistem Informasi CDPD PDC-P Etc.. 55
WAP Risks

WAP Gap
 Claim: WTLS protects WAP as SSL protects
HTTP
 Problem: In the process of translating one
protocol to another, information is decrypted
and re-encrypted
 Solution: Doing decryption/re-encryption in
the same process on the WAP gateway
Wireless gateways as single point of
failure
Magister Manajemen Sistem Informasi 56
Platform Risks

Without a secure OS, achieving security on


mobile devices is almost impossible
Learned lessons:
 Memory protection of processes
 Protected kernel rings
 File access control
 Authentication of principles to resources
 Differentiated user and process privileges
 Sandboxes for untrusted code
 Biometric authentication

Magister Manajemen Sistem Informasi 57


WMLScript

Scripting is heavily used for client-side


processing to offload servers and reduce
demand on bandwidth
Wireless Markup Language (WML) is the
equivalent to HTML, but derived from XML
WMLScript is WAP’s equivalent to JavaScript
 Derived from JavaScript™

Magister Manajemen Sistem Informasi 58


WMLScript (cont.)

Integrated with WML


 Reduces network traffic
Has procedural logic, loops, conditionals, etc
Optimized for small-memory, small-CPU devices
Bytecode-based virtual machine
Compiler in network
Works with Wireless Telephony Application
(WTA) to provide telephony functions

Magister Manajemen Sistem Informasi 59


Risks of WMLScript
• Lack of Security Model
• Does not differentiate trusted local code from untrusted code
downloaded from the Internet. So, there is no access control!!
• WML Script is not type-safe.
• Scripts can be scheduled to be pushed to the client device without
the user’s knowledge
• Does not prevent access to persistent storage
• Possible attacks:
• Theft or damage of personal information
• Abusing user’s authentication information
• Maliciously offloading money saved on smart cards

Magister Manajemen Sistem Informasi 60


Bluetooth
 Bluetooth is the codename for a small, low-cost, short range
wireless technology specification
 Enables users to connect a wide range of computing and
telecommunication devices easily and simply, without the
need to buy, carry, or connect cables.
 Bluetooth enables mobile phones, computers and PDAs to
connect with each other using short-range radio waves,
allowing them to "talk" to each other
 It is also cheap

Magister Manajemen Sistem Informasi 61


Bluetooth Security
Bluetooth provides security between any two Bluetooth devices for user protection
and secrecy
 mutual and unidirectional authentication
 encrypts data between two devices
 Session key generation
• configurable encryption key length
• keys can be changed at any time during a connection
 Authorization (whether device X is allowed to have access service Y)
• Trusted Device: The device has been previously authenticated, a link key
is stored and the device is marked as “trusted” in the Device Database.
• Untrusted Device: The device has been previously authenticated, link key
is stored but the device is not marked as “trusted” in the Device Database
• Unknown Device: No security information is available for this device. This
is also an untrusted device.
 automatic output power adaptation to reduce the range exactly to
requirement, makes the system extremely difficult to eavesdrop
Magister Manajemen Sistem Informasi 62
New Security Risks in m-Commerce

• Abuse of cooperative nature of ad-hoc networks


• An adversary that compromises one node can
disseminate false routing information.
• Malicious domains
• A single malicious domain can compromise devices by
downloading malicious code
• Roaming (are you going to the bad guys ?)
• Users roam among non-trustworthy domains

Magister Manajemen Sistem Informasi 63


New Security Risks (cont.)

• Launching attacks from mobile devices


• With mobility, it is difficult to identify attackers

• Loss or theft of device


• More private information than desktop computers
• Security keys might have been saved on the device
• Access to corporate systems
• Bluetooth provides security at the lower layers only: a
stolen device can still be trusted
Magister Manajemen Sistem Informasi 64
New Security Risks (cont.)

• Problems with Wireless Transport Layer Security


(WTLS) protocol
• Security Classes:
• No certificates
• Server only certificate (Most Common)
• Server and client Certificates
• Re-establishing connection without re-authentication
• Requests can be redirected to malicious sites

Magister Manajemen Sistem Informasi 65


New Privacy Risks

• Monitoring user’s private information


• Offline telemarketing
• Who is going to read the “legal jargon”
• Value added services based on location awareness
(Location-Based Services)

Magister Manajemen Sistem Informasi 66

You might also like