Secure Electronic Transaction

Secure Electronic Transaction
(SET)
Prepared By:
Naman s. Khandelwal
SCET, Surat
Previous Years Questions

What are secure electronic Commerce components.
Explain each in brief. Give the overview of SET?
(2010)
Explain the secure electronic Transaction. List the SET
participants and explain its role in detail. (June 2011)
Give your ideas: How will you sort out the issue of
vulnerability in case of E-Transaction. (July 2012)
Discuss the SET with example? (Winter 2012)
What is SET. How does it work? (Winter 2013)
prepared by: Naman s. Khandelwal
SET
SET is an open encryption and security specification
designed to protect credit card transactions on the Internet.
SET was developed in 1996 by Master card, and Visa.
SET is not a payment system, rather it is a set of security
protocols and formats
It enables users to employ the existing credit card
payment infrastructure on Internet, in a secure fashion.
It provides 3 services:
a secure communications channel among all parties involved in
a transaction
trust through the use of X.509v3 digital certificates
privacy because the information is only available to parties in a
transaction when and where necessary.
SET Requirements
Provide confidentiality of payment & ordering information :
Assuring cardholders that information is safe & accessible only to the
intended recipient.
Uses DES/ RSA encryption
Ensure the integrity of all transmitted data :

Ensure no changes in content occur during transmission of SET
messages.
Uses Digital signatures
Provide authentication that a cardholder is a legitimate user

of a credit card account :
Digital signatures and certificates are used
Provide authentication that a merchant can accept credit

card transactions through its relationship with a financial
institution :
digital signatures and certificates are used.
SET Requirements
Ensure the use of the best security practices and system
design techniques to protect all legitimate parties in an
electronic commerce transaction :
SET is based on highly secure cryptographic algorithms and protocols.
Create a protocol that neither depends on transport security

mechanisms nor prevents their use :
SET does not interfere with the use of other security mechanisms, such
as IPSec and SSL/TLS.
Facilitate and encourage interoperability among software

and network providers :
The SET protocols and formats are independent of hardware platform,
OS, and Web software.
Key Features of SET

Confidentiality of information:
SET prevents merchant from learning the cardholder's credit card
number.
DES is used to provide confidentiality.
Integrity of data:
SET guarantees that the message contents are not altered in transit.
RSA digital signatures, using SHA-1 hash codes, provide message
integrity.
Cardholder account authentication:

SET enables merchants to verify that a cardholder is a legitimate user.
SET uses X.509v3 digital certificates with RSA signatures.
Merchant authentication:
SET enables cardholders to verify that a merchant has a relationship
with a financial institution
SET uses X.509v3 digital certificates with RSA signatures.
SET Participants
SET Participants
Cardholder:
This is an authorized holder of a payment card (e.g, MasterCard, Visa)
that has been issued by an issuer.
Eg: Customers.
Merchant:
A person or organization that has goods or services to sell to the
cardholder.
A merchant must have a relationship with an acquirer.
Eg: Flipkart.
Issuer:
This is a financial institution that provides the cardholder with the
payment card.
Issuer is responsible for the payment of the debt of the cardholder.
Eg: Bank.
SET Participants
Acquirer:
This is a financial institution that establishes an account with a
merchant and processes payment card authorizations and payments.
Reason for having Acquirer : Merchants accept more than one credit
card brand but do not want to deal with these bankcard associations
issuers.
Acquirer provides authorization to the merchant that a given card
account is active and that the proposed purchase does not exceed the
credit limit.
The acquirer also provides electronic transfer of payments to the
merchant's account. Subsequently, the acquirer is reimbursed by the
issuer over some sort of payment network.
Payment Gateway:
This is a function operated by the acquirer & processes merchant payment
messages.
SET Participants
It act as an interfaces between SET and the existing bankcard payment
networks for authorization and payment functions.
The merchant exchanges SET messages with the payment gateway over the
Internet, while the payment gateway has some direct or network
connection to the acquirer's financial processing system.
Certification authority (CA)

This is an entity that is trusted to issue X.509v3 public-key certificates
for cardholders, merchants, and payment gateways.
The success of SET will depend on the existence of a CA
10
SET Transaction Process

1.
The customer opens an account :
The customer obtains a credit card account, such as MasterCard or

Visa, with a bank
The customer receives a certificate:
2.
3.
After suitable verification of identity, the customer receives an

X.509v3 digital certificate, which is signed by the bank. The
certificate verifies the customer's RSA public key and its expiration
date.
Merchants have their own certificates:
A merchant who accepts a certain brand of card must be in

possession of two certificates for two public keys owned by the
merchant: one for signing messages, and one for key exchange.
The merchant also needs a copy of the payment gateway's public-key
certificate.
11

4.
The customer places an order:
5.
The merchant is verified:
6.
This process involve the customer first browsing through the

merchant's Web site to select items and determine the price. The
customer then sends a list of the items to be purchased to the
merchant, who returns an order form containing the list of items,
their price, a total price, and an order number.
In addition to the order form, the merchant sends a copy of its
certificate, so that the customer can verify that he or she is dealing
with a valid store.
The order and payment are sent:
The customer sends both order and payment information to the

merchant, along with the customer's certificate.
The order confirms the purchase of the items in the order form.
The payment contains credit card details. The payment information is
encrypted in such a way that it cannot be read by the merchant.
The customer's certificate enables the merchant to verify the
customer.
12

7.
The merchant requests payment authorization:
8.
The merchant confirms the order:
9.
The merchant sends the payment information to the payment

gateway, requesting authorization that the customer's available
credit is sufficient for this purchase.
After payment gateway verifies the details of customers credit card
with the help of issuer, either it authorizes or reject the payment.
After authorization, merchant sends confirmation of order to the
customer.
The merchant provides the goods or service:
The merchant ships the goods or provides the service to the

customer.
10. The merchant requests payment:
Merchant request for payment is sent to the payment gateway, which

handles all of the payment processing.
13
Dual Signature
Purpose : to link two messages that are intended for two
different recipients.
The customer wants to send the order information (OI) to
the merchant and the payment information (PI) to the bank.
The merchant does not need to know the customer's credit
card number, and the bank does not need to know the
details of the customer's order.
The customer is afforded extra protection in terms of
privacy by keeping these two items separate.
The link is needed so that the customer can prove that this
payment is intended for this order and not for some other
goods or service.
14
Dual Signature
The customer takes the hash (using SHA-1) of the PI and the
hash of the OI.
These two hashes are then concatenated and the hash of the
result is taken.
Finally, the customer encrypts the final hash with his or her
private signature key, creating the dual signature.
The POMD is available to both the merchant and the
payment gateway.
15
Dual Signature
DS=E ( PRc, [ H( H(PI) || H(OI) ) ] )
16
Purchase Request Cardholder

How does the cardholder protect the payment information
from the merchant ?
For this cardholder performs following process:
Cardholder creates PI, DS & OIMD and encrypts the whole
thing with a one time session key KS
Cardholder then encrypts session key KS with the payment
gateways public key to form a Digital Envelope.
Cardholder sends the digital envelope to the merchant,
instructing it to forward it to the payment gateway.
Since the merchant does not have the private key of the
payment gateway, it cannot decrypt the envelope and obtain
the payment details.
17
Purchase Request Cardholder
18
Merchant verifies Customer Purchase Request

Cardholder sends the merchant the OI, DS, and PIMD.
Note that the merchant must not get PI.
Then the merchant compute following quantities :
H ( PIMD || H[OI] )
D (PUc, DS)
If these two quantities are equal, then the merchant has
verified the signature and confirms that the order came
from the authentic cardholder, and not from someone
posing as the cardholder.
19
Merchant verifies Customer Purchase Request

H ( PIMD || H[OI] ) = D (PUc, DS)
20
Payment gateway verifies Customer Purchase Request

Cardholder sends purchase request to merchant.
Merchant passes Digital Envelope to the Payment gateway.
The payment gateway decrypts the envelope and get PI, DS
and OIMD. Note that payment gateway need not get OI.
Now payment gateway compute following quantities:
H ( H[PI] || OIMD )
D ( PUc, DS)
If these two quantities are equal, then the payment gateway
has verified the signature.
This verification satisfies the payment gateway that the
payment information came from the authentic cardholder,
and not from someone posing as cardholder.
21
Thank You !!
22

Secure Electronic Transaction

Uploaded by

Copyright:

Available Formats

Secure Electronic Transaction

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Secure Electronic Transaction

Uploaded by

Copyright:

Available Formats

Secure Electronic Transaction

Previous Years Questions

prepared by: Naman s. Khandelwal

prepared by: Naman s. Khandelwal

Ensure the integrity of all transmitted data :

Provide authentication that a cardholder is a legitimate user

Provide authentication that a merchant can accept credit

prepared by: Naman s. Khandelwal

Create a protocol that neither depends on transport security

Facilitate and encourage interoperability among software

prepared by: Naman s. Khandelwal

Key Features of SET

Cardholder account authentication:

prepared by: Naman s. Khandelwal

prepared by: Naman s. Khandelwal

prepared by: Naman s. Khandelwal

Certification authority (CA)

prepared by: Naman s. Khandelwal

SET Transaction Process

The customer opens an account :

The customer obtains a credit card account, such as MasterCard or

The customer receives a certificate:

After suitable verification of identity, the customer receives an

Merchants have their own certificates:

A merchant who accepts a certain brand of card must be in

prepared by: Naman s. Khandelwal

SET Transaction Process

The customer places an order:

The merchant is verified:

This process involve the customer first browsing through the

The order and payment are sent:

The customer sends both order and payment information to the

SET Transaction Process

The merchant requests payment authorization:

The merchant confirms the order:

The merchant sends the payment information to the payment

The merchant provides the goods or service:

The merchant ships the goods or provides the service to the

10. The merchant requests payment:

Merchant request for payment is sent to the payment gateway, which

prepared by: Naman s. Khandelwal

prepared by: Naman s. Khandelwal

prepared by: Naman s. Khandelwal

prepared by: Naman s. Khandelwal

Purchase Request Cardholder

prepared by: Naman s. Khandelwal

Purchase Request Cardholder

prepared by: Naman s. Khandelwal

Merchant verifies Customer Purchase Request

prepared by: Naman s. Khandelwal

Merchant verifies Customer Purchase Request

prepared by: Naman s. Khandelwal

Payment gateway verifies Customer Purchase Request

prepared by: Naman s. Khandelwal

prepared by: Naman s. Khandelwal

You might also like