Computer Concepts and Applications – Electronic Payment Systems

Computer Concepts and Applications – Electronic Payment Systems

• Electronic Payment System

3.1 Introduction to EPS

Issues of trust and acceptance play a more significant role in the e-commerce worldthan in traditional businesses as far as payment systems are concerned. Traditionally, a customer sees a product, examines it, and then pays for it by cash, check, or credit card (Figure 3.1). In the e-commerce world, in most cases the customer does not actually see the concrete product at the time of transaction, and the method of payment is performed electronically.

Figure 3.1 : Traditional payment scheme EPSs enable a customer to pay for the goods and services online by using integrated hardware and software systems. The main objectives of EPS are to increase efficiency, improve security, and enhance customer convenience and ease of use. Although these systems are in their immaturity, some significant development has been made. There are several methods and tools that can be used to enable EPS implementation (Figure 3.2) Figure3.2 Electronic payment scheme

While customers pay for goods/services by cash, check, or credit cards in conventional businesses, online buyers may use one of the following EPSs to pay for products/services purchased online:

Electronic funds transfer (EFT): EFT involves electronic transfer of money by financial institutions.

Payment cards : They contain stored financial value that can be transferred from the customer's computer to the businessman's computer.

Credit cards : They are the most popular method used in EPSs and are used by charging against the customer credit.

Smart cards: They include stored financial value and other important personal and financial information used for online payments.

Electronic money (e-money/e-cash): This is standard money converted into an electronic format to pay for online purchases.

Online payment: This can be used for monthly payment for Internet, phone bills, etc.

Electronic wallets (e-wallets) : They are similar to smart cards as they include stored financial value for online payments.

Micro-payment systems : They are similar to e-wallets in that they include stored financial value for online payments; on the other hand, they are used for small payments, such as kurus in Turkey .

Electronic gifts : They are one way of sending electronic currency or gift certificates from one individual to another. The receiver can spend these gifts in their favorite online stores provided they accept this type of currency.

Although these groups appear to be separate, there is some overlap among them. When the industry matures, this duplication in naming and function ought to be renamed. For example, e-wallets can be classified as payment cards when they are used to store credit card information or as e-money when they store electronic currency. The standardization of payment mechanisms on the Internet is essential to the success of e-commerce. Businesses offering domestic and international services must have assurance that payment will be received, that it is secure and that it is valid. Addressing security issues is crucial to the acceptance of online payment standards: consumers and merchants must be able to trust that their information is kept intact and remains secure during transmission. SET and SSL are two standards that protect the integrity of online transactions.

3.2 Introduction to Electronic Fund Transfer(EFT) Electronic funds transfer is one of the oldest electronic payment systems. EFT isthe groundwork of the cash-less and check-less culture where and paper bills, checks, envelopes, stamps are eliminated. EFT is used for transferring money from one bank account directly to another without any paper money changing hands. The most popular application of EFT is that instead of getting a paycheck and putting it into a bank account, the money is deposited to an account electronically.EFT is considered to be a safe, reliable, and convenient way to conduct business. The advantages of EFT contain the following:

• Simplified accounting
• Improved efficiency
• Reduced administrative costs
• Improved security

3.3 Introduction to Secure Electronic Transaction(SET) SET (Secure Electronic Transaction) protocol was developed by VISA and MasterCardspecifically for enabling secure credit card transactions on the Internet. This protocol ismainly used for payment. However, since it separates the purchase order informationfrom the payment information to be sent to the Merchant and Payment Authorityrespectively, it can also be used to transmit order information.

SET does not follow anyfixed standard for its message format. Instead, it provides its own message format foreach type of message sent between the merchant and consumer.

SET uses public-keyencryption and X.509 digital certificates for its security implementation.

One of the niceadditional features provided by SET is the error handling capability. SET handles errorssuch as duplicate, corrupted, or malformed messages. Depending on the type of the error found, SET either ignores the message or retransmits it.

When a consumer initiates a transaction at their computer, they can use a piece of software called electronic wallet containing a digital certificate that authenticates that the consumer is who he or she says, while the merchant’s certificate provides the consumer with the same authenticating information about the merchant.

SET is basically a process that operates under a fixed set of rules. It has characteristics that are different than those associated with digital money such as DigiCash. Digital money by itself can cause a transaction to occur. SET requires a functional meeting (or at least an exchange of messages) of all the interested parties before a transaction can occur. A SET transaction must be authorized by all the parties concerned in order to complete, while merchants in the digital money realm may change the resultant value of adigital cash token. SET merchants cannot directly touch cardholder information, which is available only to the Issuer (and by extension the Payment Gateway), while digital money merchants can derive transaction/recipient information SET allows for the merchant's identity to be authenticated via digital certificates.However, SET also allows for the merchant to request users to authenticate themselvesthrough digital certificates. This makes it much more difficult for someone to use a stolen credit card.

• 3.4 Business requirements addressed by SET/Objectives of SET

SET addresses seven major business requirements:1 Provide confidentiality of payment information and enable confidentiality of order information that is transmitted along with the payment information.

Ensure the integrity of all transmitted data.

Provide authentication that a cardholder is a legitimate user of a branded payment card account.

Provide authentication that a merchant can accept branded payment card transactions through its relationship with an acquiring financial institution.

Ensure the use of the best security practices and system design techniques to protect all legitimate parties in an electronic commerce transaction.

Create a protocol that neither depends on transport security mechanisms nor prevents their use.

Facilitate and encourage interoperability among software and network providers.

Point 1 ensures that card information cannot be viewed by unauthorized parties. Point 2 ensures that the information cannot be changed or tampered. Points 3 and 4 ensure that the cardholder and merchant are really who they claim they are. Hence, in essence, this framework, if implemented effectively, will allow both buyers and sellers to transact in total confidence in an open network.

• 3.5 Introduction to Digital certificates & Digital Signatures

3.5.1Digital Certificates:

• Digital Certificate is a data with digital signature from one trusted Certification Authority (CA).This data contains:
• Who owns this certificate
• Who signed this certificate
• The expired date

User name & email address

A digital certificate is a special kind of machine-readable document issued by a trusted Certificate Authority (CA) to an individual or organization which is unique to them. It is kept secret and access to it is usually protected by a password. There is a public part of the certificate which is included with your digital signature (see below). In order for someone to send you something encrypted so that only you can read it they require their own digital certificate and the public part of your certificate.

A digital certificate can exist in several different formats. One of the most popular certificate standards is X.509 developed by the ITU Telecommunication Standardization Sector (ITU-T). It specifies standard formats for public key certificates and algorithm for certification path validation. There is some variation in the items contained in a digital certificate but, typically, it will contain the following:

• public key of the certificate owner
• public key algorithm used
• name of the person or organization to whom the certificate was issued
• date that the public key expires
• name of the issuing certificate authority
• serial number assigned to the digital certificate
• URL of the relevant certificate revocation list
• certificate signature algorithm

digital signature of the issuing certificate authority

• Digital certificates can be obtained from a variety of sources. Depending on the source, these certificates might be free or cost thousands of dollars. CSertificates are valid for different lengths of time and for different purposes. Commonly, lengths are set in multiples of years, though it is possible to issue perpetual certificates. In general, it is recommended that the life of a certificate be kept fairly short so that, if someone else comes into possession of the private key, it does not become a permanent liability. This is not a trivial concern, as anyone in possession of your private key can effectively pretend to be you. Most references recommend that the first thing you do after generating a digital certificate is to generate a corresponding revocation certificate, to be used to notify others to not trust anything signed with the certificate, in the event that the private key it contained fell into someone else's hands.

Depending on who is doing the definition, you may find certificates broken down into a differing number of classes. The class roughly corresponds to the level of trust assigned to the certificate. The most commonly recognized classes include the following:

• Class 1 — Certificates assigned to individuals and intended for use with e-mail.
• Class 2 — Certificates assigned to identify organizations.
• Class 3— Certificates issued to identify servers and for software signing.

Web of trust

In the context above, trust refers to how much you trust that the certificate belongs to who it says it does, not to how trustworthy the person it refers to might be. This is true whether you are talking about a web of trust or a hierarchical certificate authority (CA). A web of trust is composed of a web of people certifying that the others are who they say they are. While it is possible to setup a PKI employing only a web of trust, as is done with OpenPGP, combining the concept of a web of trust with a hierarchical certificate authority combines many of the best features of each. A local web of trust can be used to confirm identity to the hierarchical CA, allowing it to provide identification assurance to others who are not members of the initiating web of trust.

Many of the commercial certificate authorities will provide free certificates, at least for e-mail encryption use. However, most of these 'free' certificates are short trial certificates, good for 30 to 60 days at most. However, there are a few certificate authorities which do issue more than basic trial certificates. One of these is Thawte, operating globally out of South Africa. A second is the Comodo Group, operating out of New Jersey. Another organization that issues free certificates is CAcert. This is a non-profit community-driven CA incorporated in New South Wales, Australia. Start Commercial (StartCom), based in Eilat, Israel, is in the process of setting up a somewhat similar web-of-trustbased certificate system. A careful search of the Web will turn up others as well.

Thawte

In addition to their various paid certificates, Thawte offers free personal certificates which can be used for encrypting e-mail and digitally signing messages. The base certificate simply incorporates your e-mail address. By participating in their web of trust, you can include additional information, such as your name. To do this, you must accumulate 50 trust points from Thawte notaries. If you don't happen to live near any Thawte notaries, there is a trusted third party (TTP) program, but it is associated with a $25 processing fee.

COMODO

The default COMODO Secure E-mail Certificate, unlike most others, does include your name. Instead of having you create a revocation certificate, they have you create a revocation password, allowing you to revoke a certificate by logging into their Web site. The COMODO Web site indicates that you must apply for and collect the certificate using Microsoft Internet Explorer. However, I didn't seem to have any problems using Firefox to do this. Unlike some certificates, it is restricted to private use only. Note that, unlike the other CAs, there is no validation process to ensure that the name submitted with the application is actually yours. This lack of verification is a good reminder to look at even digital security certificates with a bit of skepticism.

CAcert

CAcert contrasts with most other certificate authorities in that it is not associated with a commercial entity, being staffed entirely by volunteers and incorporating open source tools. Their default certificate also includes only your e-mail address. As with Thawte, you can add your full name to your certificate by accumulating 50 Assurance Points from a CAcert Assurer. You can also have your name added to your certificate by participating in CAcert's free TTP program. To be assured in their TTP system, you simply need to provide two forms of photo identification to an assurer, who completes a simple form, signs their name over copies of the photo identification, and has you mail it all back to CAcert. A TTP assurer can be a bank manager, an accountant, a lawyer, a justice of the peace or a notary public. In essence, it is someone officially responsible for witnessing signatures and ID documents. CAcert is also different in that they also issue free certificates for code signing, servers and assured servers.

AIM

AIM Encrypt takes a somewhat different tact in that they provide free SSL Certificates for both free and commercial use of AOL Instant Messenger (AIM). Note that these will not currently work with the AIM Triton program, as it does not support encrypted conversations. Once installed, you screen name will show up on other clients with a padlock to indicate that encrypted conversations are supported.

3.5.2Digital Signatures:

Digital signature can be used in all electronic communications -Web, e-mail, e-commerce.It is an electronic stamp or seal that append to the document.Ensure the document being unchanged during transmission.

Bob has been given two keys. One of Bob's keys is called a Public Key, the other is called a Private Key.

Bob's Public key is available to anyone who needs it, but he keeps his Private Key to himself. Keys are used to encrypt information. Encrypting information means "scrambling it up", so that only a person with the appropriate key can make it readable again. Either one of Bob's two keys can encrypt data, and the other key can decrypt that data.

Susan (shown below) can encrypt a message using Bob's Public Key. Bob uses his Private Key to decrypt the message. Any of Bob's coworkers might have access to the message Susan encrypted, but without Bob's Private Key, the data is worthless.

With his private key and the right software, Bob can put digital signatures on documents and other data. A digital signature is a "stamp" Bob places on the data which is unique to Bob, and is very difficult to forge. In addition, the signature assures that any changes made to the data that has been signed can not go undetected.

To sign a document, Bob's software will crunch down the data into just a few lines by a process called "hashing". These few lines are called a message digest. (It is not possible to change a message digest back into the original data from which it was created.) Bob's software then encrypts the message digest with his private key. The result is the digital signature.

Finally, Bob's software appends the digital signature to document. All of the data that was hashed has been signed.

Bob now passes the document on to Pat.

First, Pat's software decrypts the signature (using Bob's public key) changing it back into a message digest. If this worked, then it proves that Bob signed the document, because only Bob has his private key. Pat's software then hashes the document data into a message digest. If the message digest is the same as the message digest created when the signature was decrypted, then Pat knows that the signed data has not been changed.

It just so happens that Susan works at the company's certificate authority center. Susan can create a digital certificate for Bob simply by signing Bob's public key as well as some information about Bob.

Now Bob's co-workers can check Bob's trusted certificate to make sure that his public key truly belongs to him. In fact, no one at Bob's company accepts a signature for which there does not exist a certificate generated by Susan. This gives Susan the power to revoke signatures if private keys are compromised, or no longer needed. There are even more widely accepted certificate authorities that certify Susan.

Let's say that Bob sends a signed document to Pat. To verify the signature on the document, Pat's software first uses Susan's (the certificate authority's) public key to check the signature on Bob's certificate. Successful de-encryption of the certificate proves that Susan created it. After the certificate is de-encrypted, Pat's software can check if Bob is in good standing with the certificate authority and that all of the certificate information concerning Bob's identity has not been altered.

Pat's software then takes Bob's public key from the certificate and uses it to check Bob's signature. If Bob's public key de-encrypts the signature successfully, then Pat is assured that the signature was created using Bob's private key, for Susan has certified the matching public key. And of course, if the signature is valid, then we know that Doug didn't try to change the signed content.

3.5.3Stages of SET

Process Steps

1). Merchant sends invoice and unique transaction ID (XID) 2). Merchant sends merchant certificate and bank certificate (encrypted with CA’s private key) 3). Customer decrypts certificates, obtains public keys 4). Customer generates order information (OI) and payment info (PI) encrypted with different session keys and dual-signed 5). Merchant sends payment request to bank encrypted with bank- merchant session key, PI, digest of OI and merchant’s certificate 6). Bank verifies that the XID matches the one in the PI 7). Bank sends authorization request to issuing bank via card network 8). Bank sends approval to merchant 9). Merchant sends acknowledgement to customer 3.5.4Types of payment System 1) Digital cash:

Similar to regular cash, e-cash enables transactions between customers without theneed for banks or other third parties. When used, e-cash is transferred directly andimmediately to the participating merchants and vending machines. Electronic cashis a secure and convenient alternative to bills and coins. This payment systemcomplements credit, debit, and charge cards and adds additional convenience andcontrol to everyday customer cash transactions. E-cash usually operates on a smartcard, which includes an embedded microprocessor chip. The microprocessor chipstores cash value and the security features that make electronic transactionssecure. Mondex, a subsidiary of MasterCard (Mondex Canada Association) is a goodexample of e-cash E-cash is transferred directly from the customer's desktop to the merchant's site.Therefore, e-cash transactions usually require no remote authorization or personalidentification number (PIN) codes at the point of sale. E-cash can be transferredover a telephone line or over the Web. The microprocessor chip embedded onto thecard keeps track of the e-cash transactions. Using e-cash the customer has twooptions:

a stand-alone card containing e-cash or a combination card thatincorporates both ecash and debit .

How a typical e-cash system works: A customer or merchant signs up with one of the participating banks or financial institutions. The customer receives specificsoftware to install on his or her computer. The software allows the customer todownload “electronic coins” to his or her desktop. The software manages theelectronic coins. The initial purchase of coins is charged against the customer's bank account or against a credit card. When buying goods or services from a web site that accepts e-cash, the customer simply clicks the “Pay with e-cash” button. Themerchant's software generates a payment request, describing the item(s)purchased, price, and the time and date. The customer can then accept or rejectthis request. When the customer accepts the payment request, the softwareresiding on the customer's desktop subtracts the payment amount from the balanceand creates a payment that is sent to the bank or the financial institution of themerchant, and then is deposited to the merchant's account. The attractive featureof the entire process is its turnaround time which is a few seconds. The merchant isnotified and in turn ships the goods.

Electronic cheque:

E-check is the result of cooperation among several banks,government entities, technology companies, and e-commerce organizations. An e-check uses the same legal and business protocols associated with traditional paper checks. It is a new payment instrument that combines high-security, speed, convenience, and processing efficiencies for online transactions. It shares the speed and processing efficiencies of all-electronic payments. An e-check can be used by large and small organizations, even where other electronic payment solutions are too risky or not appropriate. The key advantages of e-checks are as follows:

• Secure and quick settlement of financial obligations
• Fast check processing
• Very low transaction cost
• E-check is being considered for many online transactions.

Smartcard:

A smart card is about the size of a credit card, madeof a plastic with an embedded microprocessor chip that holds important financial and personal information. The microprocessor chip is loaded with the relevant information and periodically recharged. In addition to these pieces of information, systems have been developed to store cash onto the chip. The money on the card is saved in an encrypted form and is protected by a password to ensure the security of the smart card solution. In order to pay via smart card it is necessary to introduce the card into a hardware terminal. The device requires a special key from the issuing bank to start a money transfer in either direction. Smart cards can be disposable or rechargeable. A popular example of a disposable smart card is the one issued by telephone companies. After using the pre-specified amount, the card can be discarded. Smart cards have been extensively used in the telecommunications industry for years. Smart-card technology can be used to hold information on health care, transportation, identification, retail, loyalty programs and banking, to name a few. Smart cards enable information for different purposes to be stored in one location. The microprocessor chip can process different types of information, and therefore, various industries use them in different ways. Due to their multipurpose functions, their popularity in Turkey is also on the rise.

Smart cards are broadly classified into two groups:

Contact: This type of smart card must be inserted into a special card reader to be read and updated. A contact smart card contains a microprocessor chip that makes contact with electrical connectors to transfer the data.

Contact-less: This type of smart card can be read from a short distance using radio frequency. A contact-less smart card also contains a microprocessor chip and an antenna that allows data to be transmitted to a special card reader without any physical contact. This type of smart card is useful for people who are moving in vehicles or on foot. They are used extensively in European countries for collecting payment for highway tolls, train fares, parking, bus fares, and admission fees to movies, theaters, plays, and so forth.

Smart cards can accommodate a variety of applications that allow the customer to make purchases from a credit account, debit account, or stored value on the card. These cards can even have multiple applications operating at the same time. The customer, for example, could have a frequent flyer program working on the same card as the customer debit or credit account. This enables the customer to earn points in his or her favorite program.

Several computer manufacturers (e.g. Compaq) are developing keyboards thatinclude smart card slots that can be read like bank credit cards. A smart card can be programmed for different applications. Some cards contain programming and data to support multiple applications, and some can be updated with new applications after they are issued. IBM, Microsoft, Schlumberger, and Bull are among the major players in smart card development and utilization Some of the advantages of smart cards include the following:

• Stored many types of information
• Not easily duplicated
• Not occupy much space
• Portable
• Low cost to issuers and users

Included high security

The disadvantages of smart cards :the lack of universal standards for their design and utilization. On the other hand, smart card applications are expected to increase as a result of the resolution of these disadvantages in the near future.

• Credit/debit card: Credit cards, debit cards, charge cards, smart cards are payment cards. They arethe most popular tool for electronic payment transactions.

Credit Cards:

• Credit cards issued by credit card companies (e.g., MasterCard, Visa) andmajor banks (e.g. Is Bankasi, ZiraatBankasi, YapiKredi, etc.)

Credit cards are issued based on the customer's income level, credit history, andtotal wealth. The customer uses these cards to buy goods and services or get cash from the participating financial institutions. The customer is supposed to pay his or her debts during the payment period; otherwise interest will accumulate. Two limitations of credit cards are their unsuitability for very small or very large payments. It is not cost-justified to use a credit card for small payments. Also, due to security issues, these cards have a limit and cannot be used for excessively large transactions.

• Credit cards issued by department stores (e.gBoyner), oil companies

(e.g.Shell)

Businesses extremely benefit from these company cards and they are cheaper to operate. They are widely issued to and used by a broad range of customers. Businesses offer incentives to attract customers to open an account and get one of these cards.

Dedit Cards:

The difference between credit cards and debit cards is that in order to pay with adebit card you need to know your personal identification number (PIN) and need a hardware device that is able to read the information that is stored in the magnetic strip on the back .Debit cards task similar to checks in that the charges will be taken from the customer's checking account. The benefit for the customer is the easiness of use and convenience. These cards also keep the customer under his or her budget because they do not allow the customer to go beyond his or her resources. The advantage to the merchant is the speed at which the merchant collects these charges.