SlideShare a Scribd company logo
Henric Johnson 1
Chapter 7
WEB Security
Henric Johnson
Blekinge Institute of Technology, Sweden
http://www.its.bth.se/staff/hjo/
henric.johnson@bth.se
Henric Johnson 2
Outline
• Web Security Considerations
• Secure Socket Layer (SSL) and
Transport Layer Security (TLS)
• Secure Electronic Transaction (SET)
• Recommended Reading and WEB Sites
Henric Johnson 3
Web Security Considerations
• The WEB is very visible.
• Complex software hide many security
flaws.
• Web servers are easy to configure
and manage.
• Users are not aware of the risks.
Henric Johnson 4
Security facilities in the
TCP/IP protocol stack
Henric Johnson 5
SSL and TLS
• SSL was originated by Netscape
• TLS working group was formed within
IETF
• First version of TLS can be viewed as
an SSLv3.1
Henric Johnson 6
SSL Architecture
Henric Johnson 7
SSL Record Protocol Operation
Henric Johnson 8
SSL Record Format
Henric Johnson 9
SSL Record Protocol
Payload
Henric Johnson 10
Handshake Protocol
• The most complex part of SSL.
• Allows the server and client to
authenticate each other.
• Negotiate encryption, MAC algorithm
and cryptographic keys.
• Used before any application data are
transmitted.
Henric Johnson 11
Handshake Protocol Action
Henric Johnson 12
Transport Layer Security
• The same record format as the SSL record
format.
• Defined in RFC 2246.
• Similar to SSLv3.
• Differences in the:
– version number
– message authentication code
– pseudorandom function
– alert codes
– cipher suites
– client certificate types
– certificate_verify and finished message
– cryptographic computations
– padding
Henric Johnson 13
Secure Electronic Transactions
• An open encryption and security
specification.
• Protect credit card transaction on the
Internet.
• Companies involved:
– MasterCard, Visa, IBM, Microsoft,
Netscape, RSA, Terisa and Verisign
• Not a payment system.
• Set of security protocols and formats.
Henric Johnson 14
SET Services
• Provides a secure communication
channel in a transaction.
• Provides tust by the use of X.509v3
digital certificates.
• Ensures privacy.
Henric Johnson 15
SET Overview
• Key Features of SET:
– Confidentiality of information
– Integrity of data
– Cardholder account authentication
– Merchant authentication
Henric Johnson 16
SET Participants
Henric Johnson 17
Sequence of events for
transactions
1. The customer opens an account.
2. The customer receives a certificate.
3. Merchants have their own certificates.
4. The customer places an order.
5. The merchant is verified.
6. The order and payment are sent.
7. The merchant request payment authorization.
8. The merchant confirm the order.
9. The merchant provides the goods or service.
10. The merchant requests payments.
Henric Johnson 18
Dual Signature
H(OI))]||)(([ PIHHEDS cKR
Henric Johnson 19
Payment processing
Cardholder sends Purchase Request
Henric Johnson 20
Payment processing
Merchant Verifies Customer Purchase Request
Henric Johnson 21
Payment processing
• Payment Authorization:
– Authorization Request
– Authorization Response
• Payment Capture:
– Capture Request
– Capture Response
Henric Johnson 22
Recommended Reading and
WEB sites
• Drew, G. Using SET for Secure Electronic
Commerce. Prentice Hall, 1999
• Garfinkel, S., and Spafford, G. Web
Security & Commerce. O’Reilly and
Associates, 1997
• MasterCard SET site
• Visa Electronic Commerce Site
• SETCo (documents and glossary of terms)

More Related Content

Similar to Chapter 7

Hyperledger Fabric Technical Deep Dive 20190618
Hyperledger Fabric Technical Deep Dive 20190618Hyperledger Fabric Technical Deep Dive 20190618
Hyperledger Fabric Technical Deep Dive 20190618
Arnaud Le Hors
 
Network Security_Module_2_Dr Shivashankar
Network Security_Module_2_Dr ShivashankarNetwork Security_Module_2_Dr Shivashankar
Network Security_Module_2_Dr Shivashankar
Dr. Shivashankar
 
CWIN17 Frankfurt / ibm_watson_io_t_platform_and_blockchain_v4
CWIN17 Frankfurt / ibm_watson_io_t_platform_and_blockchain_v4CWIN17 Frankfurt / ibm_watson_io_t_platform_and_blockchain_v4
CWIN17 Frankfurt / ibm_watson_io_t_platform_and_blockchain_v4
Capgemini
 
CWIN17 Frankfurt / ibm_watson_iot_platform_and_blockchain
CWIN17 Frankfurt / ibm_watson_iot_platform_and_blockchainCWIN17 Frankfurt / ibm_watson_iot_platform_and_blockchain
CWIN17 Frankfurt / ibm_watson_iot_platform_and_blockchain
Capgemini
 
Secure Electronic Transaction
Secure Electronic TransactionSecure Electronic Transaction
Secure Electronic Transaction
United International University
 
Blockchain Explored: A technical deep-dive
Blockchain Explored: A technical deep-diveBlockchain Explored: A technical deep-dive
Blockchain Explored: A technical deep-dive
Binh Nguyen
 
Understanding Blockchain
Understanding BlockchainUnderstanding Blockchain
Understanding Blockchain
Amey Ratnakar Prabhu
 
DataArt Innovation Showcase Blockchain Billing
DataArt Innovation Showcase Blockchain BillingDataArt Innovation Showcase Blockchain Billing
DataArt Innovation Showcase Blockchain Billing
Alan Quayle
 
Web security
Web securityWeb security
Web security
Muhammad Usman
 
Blockchain and BPM - Reflections on Four Years of Research and Applications
Blockchain and BPM - Reflections on Four Years of Research and ApplicationsBlockchain and BPM - Reflections on Four Years of Research and Applications
Blockchain and BPM - Reflections on Four Years of Research and Applications
Ingo Weber
 
An introduction to blockchain and hyperledger v ru
An introduction to blockchain and hyperledger v ruAn introduction to blockchain and hyperledger v ru
An introduction to blockchain and hyperledger v ru
LennartF
 
InitVerse Blockchain - Blockchain web3.0 technology application.pdf
InitVerse Blockchain - Blockchain web3.0 technology application.pdfInitVerse Blockchain - Blockchain web3.0 technology application.pdf
InitVerse Blockchain - Blockchain web3.0 technology application.pdf
InitVerse Blockchain
 
ch1 eriht eriotery erogyteip ergy7.ppt
ch1 eriht  eriotery  erogyteip  ergy7.pptch1 eriht  eriotery  erogyteip  ergy7.ppt
ch1 eriht eriotery erogyteip ergy7.ppt
SonukumarRawat
 
Network Security_Module_2.pdf
Network Security_Module_2.pdfNetwork Security_Module_2.pdf
Network Security_Module_2.pdf
Dr. Shivashankar
 
10. Kanchan verma (Unit 3) E-security systems.pptx
10. Kanchan verma (Unit 3)  E-security systems.pptx10. Kanchan verma (Unit 3)  E-security systems.pptx
10. Kanchan verma (Unit 3) E-security systems.pptx
AdityaSwami23
 
Lecture 13 -_e-commmerce_e-banking_and_advanced_tech
Lecture 13 -_e-commmerce_e-banking_and_advanced_techLecture 13 -_e-commmerce_e-banking_and_advanced_tech
Lecture 13 -_e-commmerce_e-banking_and_advanced_techSerious_SamSoul
 
PKI & SSL
PKI & SSLPKI & SSL
PKI & SSL
RitaThakkar1
 
Making blockchain works for business
Making blockchain works for businessMaking blockchain works for business
Making blockchain works for business
Patrick Yong
 
Cisco ICON Speaker Series: Blockchain - Technology that is revolutionizing th...
Cisco ICON Speaker Series: Blockchain - Technology that is revolutionizing th...Cisco ICON Speaker Series: Blockchain - Technology that is revolutionizing th...
Cisco ICON Speaker Series: Blockchain - Technology that is revolutionizing th...
Vishnu Pendyala
 
Internet banking applications' security
Internet banking applications' securityInternet banking applications' security
Internet banking applications' security
SecuRing
 

Similar to Chapter 7 (20)

Hyperledger Fabric Technical Deep Dive 20190618
Hyperledger Fabric Technical Deep Dive 20190618Hyperledger Fabric Technical Deep Dive 20190618
Hyperledger Fabric Technical Deep Dive 20190618
 
Network Security_Module_2_Dr Shivashankar
Network Security_Module_2_Dr ShivashankarNetwork Security_Module_2_Dr Shivashankar
Network Security_Module_2_Dr Shivashankar
 
CWIN17 Frankfurt / ibm_watson_io_t_platform_and_blockchain_v4
CWIN17 Frankfurt / ibm_watson_io_t_platform_and_blockchain_v4CWIN17 Frankfurt / ibm_watson_io_t_platform_and_blockchain_v4
CWIN17 Frankfurt / ibm_watson_io_t_platform_and_blockchain_v4
 
CWIN17 Frankfurt / ibm_watson_iot_platform_and_blockchain
CWIN17 Frankfurt / ibm_watson_iot_platform_and_blockchainCWIN17 Frankfurt / ibm_watson_iot_platform_and_blockchain
CWIN17 Frankfurt / ibm_watson_iot_platform_and_blockchain
 
Secure Electronic Transaction
Secure Electronic TransactionSecure Electronic Transaction
Secure Electronic Transaction
 
Blockchain Explored: A technical deep-dive
Blockchain Explored: A technical deep-diveBlockchain Explored: A technical deep-dive
Blockchain Explored: A technical deep-dive
 
Understanding Blockchain
Understanding BlockchainUnderstanding Blockchain
Understanding Blockchain
 
DataArt Innovation Showcase Blockchain Billing
DataArt Innovation Showcase Blockchain BillingDataArt Innovation Showcase Blockchain Billing
DataArt Innovation Showcase Blockchain Billing
 
Web security
Web securityWeb security
Web security
 
Blockchain and BPM - Reflections on Four Years of Research and Applications
Blockchain and BPM - Reflections on Four Years of Research and ApplicationsBlockchain and BPM - Reflections on Four Years of Research and Applications
Blockchain and BPM - Reflections on Four Years of Research and Applications
 
An introduction to blockchain and hyperledger v ru
An introduction to blockchain and hyperledger v ruAn introduction to blockchain and hyperledger v ru
An introduction to blockchain and hyperledger v ru
 
InitVerse Blockchain - Blockchain web3.0 technology application.pdf
InitVerse Blockchain - Blockchain web3.0 technology application.pdfInitVerse Blockchain - Blockchain web3.0 technology application.pdf
InitVerse Blockchain - Blockchain web3.0 technology application.pdf
 
ch1 eriht eriotery erogyteip ergy7.ppt
ch1 eriht  eriotery  erogyteip  ergy7.pptch1 eriht  eriotery  erogyteip  ergy7.ppt
ch1 eriht eriotery erogyteip ergy7.ppt
 
Network Security_Module_2.pdf
Network Security_Module_2.pdfNetwork Security_Module_2.pdf
Network Security_Module_2.pdf
 
10. Kanchan verma (Unit 3) E-security systems.pptx
10. Kanchan verma (Unit 3)  E-security systems.pptx10. Kanchan verma (Unit 3)  E-security systems.pptx
10. Kanchan verma (Unit 3) E-security systems.pptx
 
Lecture 13 -_e-commmerce_e-banking_and_advanced_tech
Lecture 13 -_e-commmerce_e-banking_and_advanced_techLecture 13 -_e-commmerce_e-banking_and_advanced_tech
Lecture 13 -_e-commmerce_e-banking_and_advanced_tech
 
PKI & SSL
PKI & SSLPKI & SSL
PKI & SSL
 
Making blockchain works for business
Making blockchain works for businessMaking blockchain works for business
Making blockchain works for business
 
Cisco ICON Speaker Series: Blockchain - Technology that is revolutionizing th...
Cisco ICON Speaker Series: Blockchain - Technology that is revolutionizing th...Cisco ICON Speaker Series: Blockchain - Technology that is revolutionizing th...
Cisco ICON Speaker Series: Blockchain - Technology that is revolutionizing th...
 
Internet banking applications' security
Internet banking applications' securityInternet banking applications' security
Internet banking applications' security
 

More from shivz3

Influence of-structured--semi-structured--unstructured-data-on-various-data-m...
Influence of-structured--semi-structured--unstructured-data-on-various-data-m...Influence of-structured--semi-structured--unstructured-data-on-various-data-m...
Influence of-structured--semi-structured--unstructured-data-on-various-data-m...
shivz3
 
Bi 7
Bi 7Bi 7
Bi 7
shivz3
 
Bi 7 (1)
Bi 7 (1)Bi 7 (1)
Bi 7 (1)
shivz3
 
Bi 5
Bi 5Bi 5
Bi 5
shivz3
 
Bi 4
Bi 4Bi 4
Bi 4
shivz3
 
Bi 3
Bi 3Bi 3
Bi 3
shivz3
 
Bi (1)
Bi (1)Bi (1)
Bi (1)
shivz3
 
Bi (1) (1)
Bi (1) (1)Bi (1) (1)
Bi (1) (1)
shivz3
 
Bi 6
Bi 6Bi 6
Bi 6
shivz3
 
Nw sec
Nw secNw sec
Nw sec
shivz3
 
Chapter 10
Chapter 10Chapter 10
Chapter 10
shivz3
 
Chapter 9
Chapter 9Chapter 9
Chapter 9
shivz3
 
Chapter 5
Chapter 5Chapter 5
Chapter 5
shivz3
 
Chapter 6
Chapter 6Chapter 6
Chapter 6
shivz3
 
Chapter 2
Chapter 2Chapter 2
Chapter 2
shivz3
 
Chapter 1
Chapter 1Chapter 1
Chapter 1
shivz3
 
Chapter 2
Chapter 2Chapter 2
Chapter 2
shivz3
 
Cryptography and network Security Chapter 1
Cryptography and network Security Chapter 1Cryptography and network Security Chapter 1
Cryptography and network Security Chapter 1
shivz3
 

More from shivz3 (18)

Influence of-structured--semi-structured--unstructured-data-on-various-data-m...
Influence of-structured--semi-structured--unstructured-data-on-various-data-m...Influence of-structured--semi-structured--unstructured-data-on-various-data-m...
Influence of-structured--semi-structured--unstructured-data-on-various-data-m...
 
Bi 7
Bi 7Bi 7
Bi 7
 
Bi 7 (1)
Bi 7 (1)Bi 7 (1)
Bi 7 (1)
 
Bi 5
Bi 5Bi 5
Bi 5
 
Bi 4
Bi 4Bi 4
Bi 4
 
Bi 3
Bi 3Bi 3
Bi 3
 
Bi (1)
Bi (1)Bi (1)
Bi (1)
 
Bi (1) (1)
Bi (1) (1)Bi (1) (1)
Bi (1) (1)
 
Bi 6
Bi 6Bi 6
Bi 6
 
Nw sec
Nw secNw sec
Nw sec
 
Chapter 10
Chapter 10Chapter 10
Chapter 10
 
Chapter 9
Chapter 9Chapter 9
Chapter 9
 
Chapter 5
Chapter 5Chapter 5
Chapter 5
 
Chapter 6
Chapter 6Chapter 6
Chapter 6
 
Chapter 2
Chapter 2Chapter 2
Chapter 2
 
Chapter 1
Chapter 1Chapter 1
Chapter 1
 
Chapter 2
Chapter 2Chapter 2
Chapter 2
 
Cryptography and network Security Chapter 1
Cryptography and network Security Chapter 1Cryptography and network Security Chapter 1
Cryptography and network Security Chapter 1
 

Recently uploaded

一比一原版(IIT毕业证)伊利诺伊理工大学毕业证成绩单专业办理
一比一原版(IIT毕业证)伊利诺伊理工大学毕业证成绩单专业办理一比一原版(IIT毕业证)伊利诺伊理工大学毕业证成绩单专业办理
一比一原版(IIT毕业证)伊利诺伊理工大学毕业证成绩单专业办理
zwunae
 
一比一原版(SFU毕业证)西蒙菲莎大学毕业证成绩单如何办理
一比一原版(SFU毕业证)西蒙菲莎大学毕业证成绩单如何办理一比一原版(SFU毕业证)西蒙菲莎大学毕业证成绩单如何办理
一比一原版(SFU毕业证)西蒙菲莎大学毕业证成绩单如何办理
bakpo1
 
Gen AI Study Jams _ For the GDSC Leads in India.pdf
Gen AI Study Jams _ For the GDSC Leads in India.pdfGen AI Study Jams _ For the GDSC Leads in India.pdf
Gen AI Study Jams _ For the GDSC Leads in India.pdf
gdsczhcet
 
Student information management system project report ii.pdf
Student information management system project report ii.pdfStudent information management system project report ii.pdf
Student information management system project report ii.pdf
Kamal Acharya
 
Sachpazis:Terzaghi Bearing Capacity Estimation in simple terms with Calculati...
Sachpazis:Terzaghi Bearing Capacity Estimation in simple terms with Calculati...Sachpazis:Terzaghi Bearing Capacity Estimation in simple terms with Calculati...
Sachpazis:Terzaghi Bearing Capacity Estimation in simple terms with Calculati...
Dr.Costas Sachpazis
 
Fundamentals of Electric Drives and its applications.pptx
Fundamentals of Electric Drives and its applications.pptxFundamentals of Electric Drives and its applications.pptx
Fundamentals of Electric Drives and its applications.pptx
manasideore6
 
ASME IX(9) 2007 Full Version .pdf
ASME IX(9)  2007 Full Version       .pdfASME IX(9)  2007 Full Version       .pdf
ASME IX(9) 2007 Full Version .pdf
AhmedHussein950959
 
block diagram and signal flow graph representation
block diagram and signal flow graph representationblock diagram and signal flow graph representation
block diagram and signal flow graph representation
Divya Somashekar
 
road safety engineering r s e unit 3.pdf
road safety engineering  r s e unit 3.pdfroad safety engineering  r s e unit 3.pdf
road safety engineering r s e unit 3.pdf
VENKATESHvenky89705
 
Design and Analysis of Algorithms-DP,Backtracking,Graphs,B&B
Design and Analysis of Algorithms-DP,Backtracking,Graphs,B&BDesign and Analysis of Algorithms-DP,Backtracking,Graphs,B&B
Design and Analysis of Algorithms-DP,Backtracking,Graphs,B&B
Sreedhar Chowdam
 
Hybrid optimization of pumped hydro system and solar- Engr. Abdul-Azeez.pdf
Hybrid optimization of pumped hydro system and solar- Engr. Abdul-Azeez.pdfHybrid optimization of pumped hydro system and solar- Engr. Abdul-Azeez.pdf
Hybrid optimization of pumped hydro system and solar- Engr. Abdul-Azeez.pdf
fxintegritypublishin
 
space technology lecture notes on satellite
space technology lecture notes on satellitespace technology lecture notes on satellite
space technology lecture notes on satellite
ongomchris
 
Pile Foundation by Venkatesh Taduvai (Sub Geotechnical Engineering II)-conver...
Pile Foundation by Venkatesh Taduvai (Sub Geotechnical Engineering II)-conver...Pile Foundation by Venkatesh Taduvai (Sub Geotechnical Engineering II)-conver...
Pile Foundation by Venkatesh Taduvai (Sub Geotechnical Engineering II)-conver...
AJAYKUMARPUND1
 
一比一原版(UofT毕业证)多伦多大学毕业证成绩单如何办理
一比一原版(UofT毕业证)多伦多大学毕业证成绩单如何办理一比一原版(UofT毕业证)多伦多大学毕业证成绩单如何办理
一比一原版(UofT毕业证)多伦多大学毕业证成绩单如何办理
ydteq
 
Cosmetic shop management system project report.pdf
Cosmetic shop management system project report.pdfCosmetic shop management system project report.pdf
Cosmetic shop management system project report.pdf
Kamal Acharya
 
WATER CRISIS and its solutions-pptx 1234
WATER CRISIS and its solutions-pptx 1234WATER CRISIS and its solutions-pptx 1234
WATER CRISIS and its solutions-pptx 1234
AafreenAbuthahir2
 
Investor-Presentation-Q1FY2024 investor presentation document.pptx
Investor-Presentation-Q1FY2024 investor presentation document.pptxInvestor-Presentation-Q1FY2024 investor presentation document.pptx
Investor-Presentation-Q1FY2024 investor presentation document.pptx
AmarGB2
 
Hierarchical Digital Twin of a Naval Power System
Hierarchical Digital Twin of a Naval Power SystemHierarchical Digital Twin of a Naval Power System
Hierarchical Digital Twin of a Naval Power System
Kerry Sado
 
AP LAB PPT.pdf ap lab ppt no title specific
AP LAB PPT.pdf ap lab ppt no title specificAP LAB PPT.pdf ap lab ppt no title specific
AP LAB PPT.pdf ap lab ppt no title specific
BrazilAccount1
 
ML for identifying fraud using open blockchain data.pptx
ML for identifying fraud using open blockchain data.pptxML for identifying fraud using open blockchain data.pptx
ML for identifying fraud using open blockchain data.pptx
Vijay Dialani, PhD
 

Recently uploaded (20)

一比一原版(IIT毕业证)伊利诺伊理工大学毕业证成绩单专业办理
一比一原版(IIT毕业证)伊利诺伊理工大学毕业证成绩单专业办理一比一原版(IIT毕业证)伊利诺伊理工大学毕业证成绩单专业办理
一比一原版(IIT毕业证)伊利诺伊理工大学毕业证成绩单专业办理
 
一比一原版(SFU毕业证)西蒙菲莎大学毕业证成绩单如何办理
一比一原版(SFU毕业证)西蒙菲莎大学毕业证成绩单如何办理一比一原版(SFU毕业证)西蒙菲莎大学毕业证成绩单如何办理
一比一原版(SFU毕业证)西蒙菲莎大学毕业证成绩单如何办理
 
Gen AI Study Jams _ For the GDSC Leads in India.pdf
Gen AI Study Jams _ For the GDSC Leads in India.pdfGen AI Study Jams _ For the GDSC Leads in India.pdf
Gen AI Study Jams _ For the GDSC Leads in India.pdf
 
Student information management system project report ii.pdf
Student information management system project report ii.pdfStudent information management system project report ii.pdf
Student information management system project report ii.pdf
 
Sachpazis:Terzaghi Bearing Capacity Estimation in simple terms with Calculati...
Sachpazis:Terzaghi Bearing Capacity Estimation in simple terms with Calculati...Sachpazis:Terzaghi Bearing Capacity Estimation in simple terms with Calculati...
Sachpazis:Terzaghi Bearing Capacity Estimation in simple terms with Calculati...
 
Fundamentals of Electric Drives and its applications.pptx
Fundamentals of Electric Drives and its applications.pptxFundamentals of Electric Drives and its applications.pptx
Fundamentals of Electric Drives and its applications.pptx
 
ASME IX(9) 2007 Full Version .pdf
ASME IX(9)  2007 Full Version       .pdfASME IX(9)  2007 Full Version       .pdf
ASME IX(9) 2007 Full Version .pdf
 
block diagram and signal flow graph representation
block diagram and signal flow graph representationblock diagram and signal flow graph representation
block diagram and signal flow graph representation
 
road safety engineering r s e unit 3.pdf
road safety engineering  r s e unit 3.pdfroad safety engineering  r s e unit 3.pdf
road safety engineering r s e unit 3.pdf
 
Design and Analysis of Algorithms-DP,Backtracking,Graphs,B&B
Design and Analysis of Algorithms-DP,Backtracking,Graphs,B&BDesign and Analysis of Algorithms-DP,Backtracking,Graphs,B&B
Design and Analysis of Algorithms-DP,Backtracking,Graphs,B&B
 
Hybrid optimization of pumped hydro system and solar- Engr. Abdul-Azeez.pdf
Hybrid optimization of pumped hydro system and solar- Engr. Abdul-Azeez.pdfHybrid optimization of pumped hydro system and solar- Engr. Abdul-Azeez.pdf
Hybrid optimization of pumped hydro system and solar- Engr. Abdul-Azeez.pdf
 
space technology lecture notes on satellite
space technology lecture notes on satellitespace technology lecture notes on satellite
space technology lecture notes on satellite
 
Pile Foundation by Venkatesh Taduvai (Sub Geotechnical Engineering II)-conver...
Pile Foundation by Venkatesh Taduvai (Sub Geotechnical Engineering II)-conver...Pile Foundation by Venkatesh Taduvai (Sub Geotechnical Engineering II)-conver...
Pile Foundation by Venkatesh Taduvai (Sub Geotechnical Engineering II)-conver...
 
一比一原版(UofT毕业证)多伦多大学毕业证成绩单如何办理
一比一原版(UofT毕业证)多伦多大学毕业证成绩单如何办理一比一原版(UofT毕业证)多伦多大学毕业证成绩单如何办理
一比一原版(UofT毕业证)多伦多大学毕业证成绩单如何办理
 
Cosmetic shop management system project report.pdf
Cosmetic shop management system project report.pdfCosmetic shop management system project report.pdf
Cosmetic shop management system project report.pdf
 
WATER CRISIS and its solutions-pptx 1234
WATER CRISIS and its solutions-pptx 1234WATER CRISIS and its solutions-pptx 1234
WATER CRISIS and its solutions-pptx 1234
 
Investor-Presentation-Q1FY2024 investor presentation document.pptx
Investor-Presentation-Q1FY2024 investor presentation document.pptxInvestor-Presentation-Q1FY2024 investor presentation document.pptx
Investor-Presentation-Q1FY2024 investor presentation document.pptx
 
Hierarchical Digital Twin of a Naval Power System
Hierarchical Digital Twin of a Naval Power SystemHierarchical Digital Twin of a Naval Power System
Hierarchical Digital Twin of a Naval Power System
 
AP LAB PPT.pdf ap lab ppt no title specific
AP LAB PPT.pdf ap lab ppt no title specificAP LAB PPT.pdf ap lab ppt no title specific
AP LAB PPT.pdf ap lab ppt no title specific
 
ML for identifying fraud using open blockchain data.pptx
ML for identifying fraud using open blockchain data.pptxML for identifying fraud using open blockchain data.pptx
ML for identifying fraud using open blockchain data.pptx
 

Chapter 7

  • 1. Henric Johnson 1 Chapter 7 WEB Security Henric Johnson Blekinge Institute of Technology, Sweden http://www.its.bth.se/staff/hjo/ henric.johnson@bth.se
  • 2. Henric Johnson 2 Outline • Web Security Considerations • Secure Socket Layer (SSL) and Transport Layer Security (TLS) • Secure Electronic Transaction (SET) • Recommended Reading and WEB Sites
  • 3. Henric Johnson 3 Web Security Considerations • The WEB is very visible. • Complex software hide many security flaws. • Web servers are easy to configure and manage. • Users are not aware of the risks.
  • 4. Henric Johnson 4 Security facilities in the TCP/IP protocol stack
  • 5. Henric Johnson 5 SSL and TLS • SSL was originated by Netscape • TLS working group was formed within IETF • First version of TLS can be viewed as an SSLv3.1
  • 6. Henric Johnson 6 SSL Architecture
  • 7. Henric Johnson 7 SSL Record Protocol Operation
  • 8. Henric Johnson 8 SSL Record Format
  • 9. Henric Johnson 9 SSL Record Protocol Payload
  • 10. Henric Johnson 10 Handshake Protocol • The most complex part of SSL. • Allows the server and client to authenticate each other. • Negotiate encryption, MAC algorithm and cryptographic keys. • Used before any application data are transmitted.
  • 11. Henric Johnson 11 Handshake Protocol Action
  • 12. Henric Johnson 12 Transport Layer Security • The same record format as the SSL record format. • Defined in RFC 2246. • Similar to SSLv3. • Differences in the: – version number – message authentication code – pseudorandom function – alert codes – cipher suites – client certificate types – certificate_verify and finished message – cryptographic computations – padding
  • 13. Henric Johnson 13 Secure Electronic Transactions • An open encryption and security specification. • Protect credit card transaction on the Internet. • Companies involved: – MasterCard, Visa, IBM, Microsoft, Netscape, RSA, Terisa and Verisign • Not a payment system. • Set of security protocols and formats.
  • 14. Henric Johnson 14 SET Services • Provides a secure communication channel in a transaction. • Provides tust by the use of X.509v3 digital certificates. • Ensures privacy.
  • 15. Henric Johnson 15 SET Overview • Key Features of SET: – Confidentiality of information – Integrity of data – Cardholder account authentication – Merchant authentication
  • 16. Henric Johnson 16 SET Participants
  • 17. Henric Johnson 17 Sequence of events for transactions 1. The customer opens an account. 2. The customer receives a certificate. 3. Merchants have their own certificates. 4. The customer places an order. 5. The merchant is verified. 6. The order and payment are sent. 7. The merchant request payment authorization. 8. The merchant confirm the order. 9. The merchant provides the goods or service. 10. The merchant requests payments.
  • 18. Henric Johnson 18 Dual Signature H(OI))]||)(([ PIHHEDS cKR
  • 19. Henric Johnson 19 Payment processing Cardholder sends Purchase Request
  • 20. Henric Johnson 20 Payment processing Merchant Verifies Customer Purchase Request
  • 21. Henric Johnson 21 Payment processing • Payment Authorization: – Authorization Request – Authorization Response • Payment Capture: – Capture Request – Capture Response
  • 22. Henric Johnson 22 Recommended Reading and WEB sites • Drew, G. Using SET for Secure Electronic Commerce. Prentice Hall, 1999 • Garfinkel, S., and Spafford, G. Web Security & Commerce. O’Reilly and Associates, 1997 • MasterCard SET site • Visa Electronic Commerce Site • SETCo (documents and glossary of terms)