Security in E-Commerce Systems
In e-Commerce Systems two things must be guaranteed:
- The communication partner must in fact be the person he says he is.
- The communication must be secure.
The first demand can be fulfilled by an authentication with certificates.
And the second demand can be fulfilled by encryption with SSL.
The most used protection technologie in e-Commerce Systems is PKI (Public Key Infrastructure). A PKI consists of a Registration Authority (RA) and a Certification Authority (CA).
Tasks of the RA:
- Reception of certificate requests
- Authentication of persons and authorities
- Verification of data
- communicates confidentially with the CA
- Distribution and verification of certificates
- direct interface to the customer
Tasks of the CA:
- Generation of certificates
- Validation, Cross Certification
At the following Picture you can see how a signed certificate is generated.
For more information about PKI and Certificates see also: Digital Certificates and Digital Signatures.
The most frequent weak points in e-Commerce Systems are: