E - C o m m e r c e T e c h n o l o g y E - C o m m e r c e T e c h n o l o g y TEC2441 1 E-commerce Defined E-commerce Defined E-commerce E-commerce involves involves digitally enabled commercialdigitally enabled commercialtransactions transactions between and among organizations and between and among organizations and individuals individuals Digitally enabled transactions Digitally enabled transactions include all transactions include all transactions mediated by digital technology mediated by digital technology Commercial transactions Commercial transactions involve the exchange of value involve the exchange of value across organizational or individual boundaries in return across organizational or individual boundaries in return for products or services for products or services
itally enabled commercial transactionstransactions between and among organizations andbetween and among organizations and
individualsindividuals
Digitally enabled transactionsDigitally enabled transactions include all transactionsinclude all transactionsmediated by digital technologymediated by digital technology
Commercial transactionsCommercial transactions involve the exchange of valueinvolve the exchange of value
across organizational or individual boundaries in returnacross organizational or individual boundaries in returnfor products or servicesfor products or services
E-commerce vs. E-businessE-commerce vs. E-business
Debate among consultants and academics aboutDebate among consultants and academics aboutmeanings and limitations of terms e-commerce and e-meanings and limitations of terms e-commerce and e-
businessbusiness
We use the termWe use the term e-businesse-business to refer primarily to theto refer primarily to thedigital enablement of transactions and processes withindig
ital enablement of transactions and processes within
a firma firm, involving information systems under the control of , involving information systems under the control of
the firmthe firm
E-business does not include commercial transactionsE-business does not include commercial transactions
involving an exchange of value across organizationalinvolving an exchange of value across organizational
Encryption is the process of transforming plain text or data intoEncryption is the process of transforming plain text or data intocipher text(random text) that cannot be read by anyone outsidecipher text(random text) that cannot be read by anyone outside
of the sender and the receiver. The purpose of encryption is :-of the sender and the receiver. The purpose of encryption is :-
1)to secure stored information and1)to secure stored information and
2)to secure information during transmission2)to secure information during transmission
Encryption can provide four of the six key dimensions of e-Encryption can provide four of the six key dimensions of e-commerce security. i.e integrity, non-repudiation ,commerce security. i.e integrity, non-repudiation ,
authentication and confidentiality.authentication and confidentiality.
TEC2441 18
I hi l i i f d i d ( i lli iblI thi l i t t i t f d i t d t t ( i t lli ibl
In this plain text is transformed into random text (unintelligibleIn this plain text is transformed into random text (unintelligible
to hackers) called the “to hackers) called the “cipher text”cipher text”. A key(cipher) is any. A key(cipher) is any
method for transforming plain text to cipher text. Encryptionmethod for transforming plain text to cipher text. Encryption
can be either usingcan be either using substitutionsubstitution or or transpositiontransposition .In.In
substitution cipher, every occurrence of a given letter issubstitution cipher, every occurrence of a given letter isreplaced systematically by another letter.replaced systematically by another letter.
Eg: If we use the key(cipher)- “letter + 3”Eg: If we use the key(cipher)- “letter + 3”
Then the wordThen the word
A T T A C KA T T A C Kwill be transformed to D W W D F Nwill be transformed to D W W D F N
In transposition cipher, the ordering of the letters in each wordIn transposition cipher, the ordering of the letters in each word
is changed in some systematic way.is changed in some systematic way.
ymme r c ey encryp onymme r c ey encryp on Also called as Secret key encryption .In this types of encryption both theAlso called as Secret key encryption .In this types of encryption both the
sender and the receiver use the same key to encrypt and decrypt thesender and the receiver use the same key to encrypt and decrypt the
message. The secret key is send over some communication media or message. The secret key is send over some communication media or
exchange the key in person..Symmetric key encryption requires that bothexchange the key in person..Symmetric key encryption requires that both
parties share the same key. If the key is lost or stolen the entire encryptionparties share the same key. If the key is lost or stolen the entire encryption
system fails.system fails.
The cipher or keys used to transform plain text in to cipher text are digitalThe cipher or keys used to transform plain text in to cipher text are digital
strings. Computers store text or other data as binary strings composed of 0’sstrings. Computers store text or other data as binary strings composed of 0’s
and 1’s. The strength of modern security protection is measured in terms of and 1’s. The strength of modern security protection is measured in terms of
the length of binary key used to encrypt the data. It may use keys withthe length of binary key used to encrypt the data. It may use keys with56,128 or 512 binary digits is 256,128 or 512 binary digits is 2512512 ..
The most widely used symmetric key encryption on the internet today is theThe most widely used symmetric key encryption on the internet today is the
Data Encryption Standard(DES) developed by the National Security AgencyData Encryption Standard(DES) developed by the National Security Agency
(NSA) and IBM it uses a 56 bit encryption key.(NSA) and IBM it uses a 56 bit encryption key.
Public key encryptionPublic key encryption In this method, two mathematically related digital keys are used :In this method, two mathematically related digital keys are used :
a public key and a private key. The private key is key secret bya public key and a private key. The private key is key secret by
the owners and the public key is widely disseminated(circulated).the owners and the public key is widely disseminated(circulated).
Both keys can be used to encrypt and decrypt a message.Both keys can be used to encrypt and decrypt a message.
However, once the keys are used to encrypt a message, thatHowever, once the keys are used to encrypt a message, that
same key cannot be used to decrypt the message. Thesame key cannot be used to decrypt the message. The
mathematical algorithms used to produce the keys are one waymathematical algorithms used to produce the keys are one way
functions. A one-way irreversible mathematical function is one infunctions. A one-way irreversible mathematical function is one in
which, once the algorithm is applied, the input cannot bewhich, once the algorithm is applied, the input cannot be
subsequently derived from the output. The key is sufficiently longsubsequently derived from the output. The key is sufficiently long
(128,256 and 512 bit keys) that it would take enormous(128,256 and 512 bit keys) that it would take enormous
computing power to derive one key from he other using thecomputing power to derive one key from he other using the
largest and faster computer available. Message confidentiality islargest and faster computer available. Message confidentiality is
achieved but message repudiation i.e sender deny of sending theachieved but message repudiation i.e sender deny of sending the
g a gna ureg a gna ure In general use, a certificate is a document issued by some authority toIn general use, a certificate is a document issued by some authority to
attest to a truth or to offer certain evidence. A digital certificate isattest to a truth or to offer certain evidence. A digital certificate is
commonly used to offer evidence in electronic form about the holder commonly used to offer evidence in electronic form about the holder
of the certificate. In PKI(Public key infrastruture) it comes from aof the certificate. In PKI(Public key infrastruture) it comes from atrusted third party, called a certification authority (CA) and it bears thetrusted third party, called a certification authority (CA) and it bears the
digital signature of that authority.digital signature of that authority.
A common use for a digital certificate is to associate or “bind” aA common use for a digital certificate is to associate or “bind” a
person to a public key, which is contained in the certificate. The CA isperson to a public key, which is contained in the certificate. The CA is
asserting that this unique public key belongs to one individual; thatasserting that this unique public key belongs to one individual; that
individual is the person who holds the linked private key. Only theindividual is the person who holds the linked private key. Only the
person who holds the private key can decrypt something that’sperson who holds the private key can decrypt something that’s
encrypted with the public key.encrypted with the public key.
Digital certificates are also commonly used in electronic commerce,Digital certificates are also commonly used in electronic commerce,
where the owner of a secure site will obtain a digital certificate that’swhere the owner of a secure site will obtain a digital certificate that’s
checked by a browser for a secure session. In this case, the CA ischecked by a browser for a secure session. In this case, the CA isasserting that the public key belongs to the business; it’s bound to theasserting that the public key belongs to the business; it’s bound to the
SSL: Secure Sockets layer SSL: Secure Sockets layer The most common form of Securing channels of communication is SSL of TCP/IP.The most common form of Securing channels of communication is SSL of TCP/IP.
When you receive a message form a server on the web that you will beWhen you receive a message form a server on the web that you will be
communicating through a secure channel, this means you will be using SSL tocommunicating through a secure channel, this means you will be using SSL to
establish a secure negotiated session(here URL changes from HTTP to HTTPS).establish a secure negotiated session(here URL changes from HTTP to HTTPS).
A secure negotiated session is a client-server session in which the URL of theA secure negotiated session is a client-server session in which the URL of therequested document, along with the contents , contents of forms and the cookiesrequested document, along with the contents , contents of forms and the cookies
exchanged, are encrypted. For ex , your credit card number that you entered into aexchanged, are encrypted. For ex , your credit card number that you entered into a
form would be encrypted. Through a series of handshakes and communications,form would be encrypted. Through a series of handshakes and communications,
the browser and the server establish one another ‘s identity by exchanging digitalthe browser and the server establish one another ‘s identity by exchanging digital
certificates, decide on the strongest shared form of encryption, and then proceed tocertificates, decide on the strongest shared form of encryption, and then proceed to
communicate using an agreed-upon session key. A SESSION KEY is a uniquecommunicate using an agreed-upon session key. A SESSION KEY is a uniquesymmetric encryption key chosen just for this single secure session. The SSLsymmetric encryption key chosen just for this single secure session. The SSL
protocol provides Data encryption, Server authentication and message integrity for protocol provides Data encryption, Server authentication and message integrity for
Current Online Payment SystemsCurrent Online Payment Systems
Credit cards are dominant form of online payment,Credit cards are dominant form of online payment,accounting for around 80% of online payments in 2002accounting for around 80% of online payments in 2002
New forms of electronic payment include:New forms of electronic payment include:
Digital cashDigital cash Online stored value systemsOnline stored value systems
Digital accumulating balance payment systemsDigital accumulating balance payment systems
One of the first forms of alternative payment systemsOne of the first forms of alternative payment systems Not really “cash” – rather, are forms of value storageNot really “cash” – rather, are forms of value storage
and value exchange that have limited convertibility intoand value exchange that have limited convertibility into
other forms of value, and require intermediaries toother forms of value, and require intermediaries to
convertconvert
Many of early examples have disappear; conceptsMany of early examples have disappear; concepts
survive as part of P2P payment systemssurvive as part of P2P payment systems
Online Stored Value SystemsOnline Stored Value Systems
Permit consumers to make instant, online payments toPermit consumers to make instant, online payments tomerchants and other individuals based on value storedmerchants and other individuals based on value stored
in an online accountin an online account
Rely on value stored in a consumer’s bank, checking or Rely on value stored in a consumer’s bank, checking or
Smart Cards as Stored ValueSmart Cards as Stored Value
SystemsSystems
Another kind of stored value system based on credit-Another kind of stored value system based on credit-card sized plastic cards that have embedded chips thatcard sized plastic cards that have embedded chips that
store personal informationstore personal information
Two types:Two types:
ContactContact
ContactlessContactless
Examples: Mondex, American Express BlueExamples: Mondex, American Express Blue
Digital Credit Card Payment SystemsDigital Credit Card Payment Systems
Extend the functionality of existing credit cards for useExtend the functionality of existing credit cards for useas online shopping payment toolsas online shopping payment tools
Focus specifically on making use of credit cards safer Focus specifically on making use of credit cards safer
and more convenient for online merchants andand more convenient for online merchants and
consumersconsumers
Example: eChargeExample: eCharge
How an Online Credit CardHow an Online Credit Card
The SET (Secure ElectronicThe SET (Secure Electronic
Transaction) ProtocolTransaction) Protocol
Authenticates cardholder and merchant identity throughAuthenticates cardholder and merchant identity throughuse of digital certificatesuse of digital certificates
An open standard developed byAn open standard developed by MasterCard and VisaMasterCard and Visa
Transaction process similar to standard online creditTransaction process similar to standard online creditcard transaction, with more identity verificationcard transaction, with more identity verification
Thus far, has not caught on much, due to costs involvedThus far, has not caught on much, due to costs involved
in integrating SET into existing systems, and lack of in integrating SET into existing systems, and lack of
Digital Accumulating BalanceDigital Accumulating Balance
Payment SystemsPayment Systems
Allows users to make micropayments and purchases onAllows users to make micropayments and purchases onthe Web, accumulating a debit balance for which theythe Web, accumulating a debit balance for which they
are billed at the end of the monthare billed at the end of the month
Digital Checking Payment SystemsDigital Checking Payment Systems
Extend the functionality of existing checking accountsExtend the functionality of existing checking accountsfor use as online shopping payment toolsfor use as online shopping payment tools
The skills required making effective use of internet and e-The skills required making effective use of internet and e-commerce capabilities are far more sophisticated then usingcommerce capabilities are far more sophisticated then using
television and newspaper.television and newspaper.
4) Persistent cultural attraction of physical markets and traditional4) Persistent cultural attraction of physical markets and traditional
shopping experiences.shopping experiences.
5) Persistent global inequality limiting access to telephones and5) Persistent global inequality limiting access to telephones and3epersonal computers.3epersonal computers.
