Enhancing the security of electronic commerce transactions

by

Vorapranee Khu-smith

Abstract: 

This thesis looks at the security of electronic commerce
transaction processing. It begins with an introduction to security
terminology used in the thesis. Security requirements for card
payments via the Internet are then described, as are possible
protocols for electronic transaction processing. It appears that
currently the Secure Socket Layer (SSL) protocol together with its
standardised version Transport Layer Security (TLS) are the most
widely used means to secure electronic transactions made over the
Internet. Therefore, the analysis and discussions presented in the
remainder of the thesis are based on the assumption that this
protocol provides a `baseline' level of security, against which
any novel means of security should be measured.

The SSL and TLS protocols are analysed with respect to how well
they satisfy the outlined security requirements. As SSL and TLS
provide transport layer security, and some of the security
requirements are at the application level, it is not surprising
that they do not address all the identified security requirements.

As a result, in this thesis, we propose four protocols that can be
used to build upon the security features provided by SSL/TLS.
The main goal is to design schemes that enhance the security of
electronic transaction processing whilst imposing minimal
overheads on the involved parties. In each case, a description of
the new scheme is given, together with its advantages and
limitations. In the first protocol, we propose a way to use an EMV
card to improve the security of online transactions. The second
protocol involves the use of the GSM subscriber authentication
service to provide user authentication over the Internet. Thirdly,
we propose the use of GSM data confidentiality service to protect
sensitive information as well as to ensure user authentication.

Regardless of the protection scheme employed for the transactions,
there exist threats to all PCs used to conduct electronic commerce
transactions. These residual threats are examined, and motivate
the design of the fourth protocol, proposed specifically to
address cookie threats.