This document discusses building identification and security for payments over mixed communication media. It covers creating an identification backbone through browser and device fingerprinting. It also discusses creating middle-tier transmission security using asynchronous cryptography to securely transmit data. This includes encrypting messages with public keys, signing with private keys, decrypting with private keys, and verifying signatures with public keys. It also touches on tokenization and triggering from secure sources.

1. Secure Payments over
Mixed Communication Media!
Jonathan LeBlanc !
Twitter: @jcleblanc !
Book: http://bit.ly/iddatasecurity!

2. • Building an identification backbone!
!
• Creating middle-tier transmission security!
!
• Privileged information security!

3. Identification Backbone!

4. Browser Fingerprinting!
https://panopticlick.eff.org/!

6. Device Fingerprinting!

7. //-------------!
//Build Info: http://developer.android.com/reference/android/os/Build.html!
//-------------!
!
System.getProperty("os.version"); //os version!
android.os.Build.DEVICE //device!
android.os.Build.MODEL //model!
android.os.Build.VERSION.SDK_INT //sdk version of the framework!
android.os.Build.SERIAL //hardware serial number, if available!
Retrieving Build Information for Android Device !

8. Getting Paired Devices!

9. //fetch all bonded bluetooth devices!
Set<BluetoothDevice> pairedDevices = mBluetoothAdapter.getBondedDevices();!
!
//if devices found, fetch name and MAC address for each!
if (pairedDevices.size() > 0){!
for (BluetoothDevice device : pairedDevices){!
//Device Name - device.getName()!
//Device MAC address - device.getAddress()!
}!
}!
Get all Bluetooth Paired Devices: Android!

10. Middle-Tier Data Security!

12. Asynchronous Cryptography: Securing
Data Through Transmission!

14. Multi-User Environment!

15. var fs = require('fs');!
var path = require('path');!
var ursa = require('ursa');!
var mkdirp = require('mkdirp');!
!
//make direction and generate private / public keys for sender / receiver!
var rootpath = './keys';!
makekeys(rootpath, 'sender');!
makekeys(rootpath, 'receiver');!
Package Instantiation and Directory Creation!

16. function makekeys(rootpath, subpath){!
try {!
mkdirp.sync(path.join(rootpath, subpath));!
} catch (err) {!
console.error(err);!
}!
!
var key = ursa.generatePrivateKey(); !
var privatepem = key.toPrivatePem();!
var publicpem = key.toPublicPem()!
!
try {!
fs.writeFileSync(path.join(rootpath, subpath, 'private.pem'), privatepem, 'ascii');!
fs.writeFileSync(path.join(rootpath, subpath, 'public.pem'), publicpem, 'ascii');!
} catch (err) {!
console.error(err);!
}!
}!
Key and Directory Creation!

17. //generate required keys!
var senderprivkey = ursa.createPrivateKey(!
fs.readFileSync(path.join(rootpath, 'sender', 'private.pem')));!
var recipientpubkey = ursa.createPublicKey(!
fs.readFileSync(path.join(rootpath, 'receiver', 'public.pem')));!
!
//prepare JSON message to send!
var msg = { 'user':'Nikola Tesla',!
'address':'W 40th St, New York, NY 10018',!
'state':'active' };!
!
msg = JSON.stringify(msg);!
!
//encrypt with recipient public key, and sign with sender private key!
var encrypted = recipientpubkey.encrypt(msg, 'utf8', 'base64');!
var signed = senderprivkey.hashAndSign('sha256', encrypted, 'utf8', 'base64');!
Preparing Message, Encrypting, and Signing!

18. //generate required keys!
var senderpubkey = ursa.createPublicKey(!
fs.readFileSync(path.join(rootpath, 'sender', 'public.pem')));!
var recipientprivkey = ursa.createPrivateKey(!
fs.readFileSync(path.join(rootpath, 'receiver', 'private.pem')));!
!
//verify message with sender private key!
bufferedmsg = new Buffer(encrypted);!
if (!senderpubkey.hashAndVerify('sha256', bufferedmsg, signed, 'base64')){!
throw new Error("invalid signature");!
} else {!
//decrypt message with recipient private key!
var decryptedmsg = recipientprivkey.decrypt(encrypted, 'base64', 'utf8');!
!
//--------!
//message verified and decrypted !
//--------!
}!
!
Decrypting, and Verifying Message!

19. Secure Data Triggers!

20. Tokenization!

21. Credit Card Tokenization!
Credit Card Information!
Address Information!
Card Holder Name!
...!
7e29c5c48f44755598dec3549155
ad66f1af4671091353be4c4d7694
d71dc866

22. Triggering from Secure Source!

23. Thank You!!
!
Slides: http://slideshare.net/jcleblanc!
Jonathan LeBlanc !
Twitter: @jcleblanc !
Book: http://bit.ly/iddatasecurity!