Security in E-Commerce Systems

From
Revision as of 22:34, 18 January 2005 by Fhilde (talk | contribs) (→‎Weak Points)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

Introduction

In e-Commerce Systems two things must be guaranteed:

  • The communication partner must in fact be the person he says he is.
  • The communication must be secure.

The first demand can be fulfilled by an authentication with certificates.
And the second demand can be fulfilled by encryption with SSL.


Technologie

The most used protection technologie in e-Commerce Systems is PKI (Public Key Infrastructure). A PKI consists of a Registration Authority (RA) and a Certification Authority (CA).


Tasks of the RA:

  • Reception of certificate requests
  • Authentication of persons and authorities
  • Verification of data
  • communicates confidentially with the CA
  • Distribution and verification of certificates
  • direct interface to the customer


Tasks of the CA:

  • Generation of certificates
  • Prolongation/Renewal/Withdrawal
  • Validation, Cross Certification


At the following Picture you can see how a signed certificate is generated.

Way of origin of a signed Certificate


For more information about PKI and Certificates see also: Digital Certificates and Digital Signatures.


Weak Points

The most frequent weak points in e-Commerce Systems are:

  • too short and too simple passwords
  • weak encryption (with too short keys)
  • careless use with passwords and access data