A Secure on-line credit card transaction method based on Kerberos Authentication protocol

Nowadays, electronic payment system is an essential part of modern business. Credit cards or debit cards have been widely used for on-site or remote transactions, greatly reducing the need for inconvenient cash transactions. However, there have been a huge number of incidents of credit card frauds over the Internet due to the security weakness of electronic payment system. A number of solutions have been proposed in the past to prevent this problem, but most of them were inconvenient and did not satisfy the needs of cardholders and merchants at the same time. In this thesis, we present a new secure card payment system called NNCC (No Number Credit Card) that significantly reduces the possibility of credit card frauds. This scheme is primarily designed for on-line shopping. NNCC is based on the Kerberos cryptographic framework that has been proven to be secure after being used in real world for decades. In this proposed system, instead of card numbers, only the payment tokens are exchanged between the buyers and merchants. The token is generated based on the payment amount, the client information, and merchant information. However it does not contain the credit card number, so the merchant cannot acquire and illegally use the credit card number. A token is cryptographically secure and valid only for the designated merchant, so it is robust against eavesdropping. This thesis describes the underlying cryptographic schemes, the operating principles, and the system design. It explains the concept of Kerberos and the background in Cryptography. Then it discusses the new proposed system and the associated payment processes. We have implemented a proof-of-concept prototype comprised of ecommerce web sites, client modules, payment server, and database. We show the architecture and protocol of the system, and discuss the performance

Teaching Secure Applications using Sequence Diagrams

Authentication is the validation provided by the communicating entity’s identity as the one that it claims to be. Integration of confidentiality, integrity and authentication into web applications is necessary to prevent unscrupulous attacks. For many years, we have been experimenting with methods for introducing important concepts related to secure transactions and improving undergraduate curricula and research experiences for Computer Science and Information Systems students. To achieve this goal, sequence diagrams which represent the progression of events over time are introduced to our students. This paper describes a learning module developed to help students understand authentication and integration of confidentiality, integrity and authentication into modeling web applications using sequence diagrams

Anonymity and trust in the electronic world

Privacy has never been an explicit goal of authorization mechanisms. The traditional approach to authorisation relies on strong authentication of a stable identity using long term credentials. Audit is then linked to authorization via the same identity. Such an approach compels users to enter into a trust relationship with large parts of the system infrastructure, including entities in remote domains. In this dissertation we advance the view that this type of compulsive trust relationship is unnecessary and can have undesirable consequences. We examine in some detail the consequences which such undesirable trust relationships can have on individual privacy, and investigate the extent to which taking a unified approach to trust and anonymity can actually provide useful leverage to address threats to privacy without compromising the principal goals of authentication and audit. We conclude that many applications would benefit from mechanisms which enabled them to make authorization decisions without using long-term credentials. We next propose specific mechanisms to achieve this, introducing a novel notion of a short-lived electronic identity, which we call a surrogate. This approach allows a localisation of trust and entities are not compelled to transitively trust other entities in remote domains. In particular, resolution of stable identities needs only ever to be done locally to the entity named. Our surrogates allow delegation, enable role-based access control policies to be enforced across multiple domains, and permit the use of non-anonymous payment mechanisms, all without compromising the privacy of a user. The localisation of trust resulting from the approach proposed in this dissertation also has the potential to allow clients to control the risks to which they are exposed by bearing the cost of relevant countermeasures themselves, rather than forcing clients to trust the system infrastructure to protect them and to bear an equal share of the cost of all countermeasures whether or not effective for them. This consideration means that our surrogate-based approach and mechanisms are of interest even in Kerberos-like scenarios where anonymity is not a requirement, but the remote authentication mechanism is untrustworthy

Tutorial: Identity Management Systems and Secured Access Control

Identity Management has been a serious problem since the establishment of the Internet. Yet little progress has been made toward an acceptable solution. Early Identity Management Systems (IdMS) were designed to control access to resources and match capabilities with people in well-defined situations, Today’s computing environment involves a variety of user and machine centric forms of digital identities and fuzzy organizational boundaries. With the advent of inter-organizational systems, social networks, e-commerce, m-commerce, service oriented computing, and automated agents, the characteristics of IdMS face a large number of technical and social challenges. The first part of the tutorial describes the history and conceptualization of IdMS, current trends and proposed paradigms, identity lifecycle, implementation challenges and social issues. The second part addresses standards, industry initia-tives, and vendor solutions. We conclude that there is disconnect between the need for a universal, seamless, trans-parent IdMS and current proposed standards and vendor solutions

An Overview of Cryptography (Updated Version, 3 March 2016)

There are many aspects to security and many applications, ranging from secure commerce and payments to private communications and protecting passwords. One essential aspect for secure communications is that of cryptography...While cryptography is necessary for secure communications, it is not by itself sufficient. This paper describes the first of many steps necessary for better security in any number of situations. A much shorter, edited version of this paper appears in the 1999 edition of Handbook on Local Area Networks published by Auerbach in September 1998

Ensuring telecommunication network security through cryptology: a case of 4G and 5G LTE cellular network providers

This paper aims to present the details regarding telecommunication network security through cryptology protocols. The data was based on scientific data collection and the quantitative method was adopted. The questionnaire was developed and the primary respondents were approached who were working in 4 telecommunication networking companies namely Huawei, Ericsson, SK Telecom and Telefonica. The sample size of the research was 60 participants and the statistical analysis was used to analyze research. The finding shows that cryptology protocol such as SSH, SSL, Kerberos PGP and SET are implemented within the companies in order to secure network

Analysis of Windows Cardspace Identity Management System

The Internet, which was originally developed for academic purposes, has expanded and been applied to commercial and business enterprises. It is possible to purchase airline tickets, check bank balances and communicate through e-mail with each other through the Internet. These services can all be performed relatively easily with the proliferation of Internet Service Providers and the lower cost of Personal Computers. The development of the Internet has also had a huge impact on businesses with the growth of e-commerce, e-banking and the tremendous growth in email traffic. There is however a negative impact to this development of the Internet with the rise in on-line criminal activity. The increasing use of the Internet has resulted in the development of on-line identities for users. There can be a great deal of sensitive and personal information associated with an on-line identity and gaining access to these privileges can provide cyber criminals with access to personal resources such as bank account details, credit card information etc. This type of activity has given rise to the term identity theft . This project will present an introduction to Microsoft Cardspace and how it relates to dealing with identity theft, the theory behind the application and present practical demonstrations of how the technology can be implemented using Microsoft© .NET framework technology

Synchronization of multi-carrier CDMA signals and security on internet.

by Yooh Ji Heng.Thesis (M.Phil.)--Chinese University of Hong Kong, 1996.Includes bibliographical references (leaves 119-128).Appendix in Chinese.Chapter I --- Synchronization of Multi-carrier CDMA Signals --- p.1Chapter 1 --- Introduction --- p.2Chapter 1.1 --- Spread Spectrum CDMA --- p.4Chapter 1.1.1 --- Direct Sequence/SS-CDMA --- p.5Chapter 1.1.2 --- Frequency Hopping/SS-CDMA --- p.5Chapter 1.1.3 --- Pseudo-noise Sequence --- p.6Chapter 1.2 --- Synchronization for CDMA signal --- p.7Chapter 1.2.1 --- Acquisition of PN Sequence --- p.7Chapter 1.2.2 --- Phase Locked Loop --- p.8Chapter 2 --- Multi-carrier CDMA --- p.10Chapter 2.1 --- System Model --- p.11Chapter 2.2 --- Crest Factor --- p.12Chapter 2.3 --- Shapiro-Rudin Sequence --- p.14Chapter 3 --- Synchronization and Detection by Line-Fitting --- p.16Chapter 3.1 --- Unmodulated Signals --- p.16Chapter 3.2 --- Estimating the Time Shift by Line-Fitting --- p.19Chapter 3.3 --- Modulated Signals --- p.22Chapter 4 --- Matched Filter --- p.23Chapter 5 --- Performance and Conclusion --- p.27Chapter 5.1 --- Line Fitting Algorithm --- p.27Chapter 5.2 --- Matched Filter --- p.28Chapter 5.3 --- Conclusion --- p.30Chapter II --- Security on Internet --- p.31Chapter 6 --- Introduction --- p.32Chapter 6.1 --- Introduction to Cryptography --- p.32Chapter 6.1.1 --- Classical Cryptography --- p.33Chapter 6.1.2 --- Cryptanalysis --- p.35Chapter 6.2 --- Introduction to Internet Security --- p.35Chapter 6.2.1 --- The Origin of Internet --- p.35Chapter 6.2.2 --- Internet Security --- p.36Chapter 6.2.3 --- Internet Commerce --- p.37Chapter 7 --- Elementary Number Theory --- p.39Chapter 7.1 --- Finite Field Theory --- p.39Chapter 7.1.1 --- Euclidean Algorithm --- p.40Chapter 7.1.2 --- Chinese Remainder Theorem --- p.40Chapter 7.1.3 --- Modular Exponentiation --- p.41Chapter 7.2 --- One-way Hashing Function --- p.42Chapter 7.2.1 --- MD2 --- p.43Chapter 7.2.2 --- MD5 --- p.43Chapter 7.3 --- Prime Number --- p.44Chapter 7.3.1 --- Listing of Prime Number --- p.45Chapter 7.3.2 --- Primality Testing --- p.45Chapter 7.4 --- Random/Pseudo-Random Number --- p.47Chapter 7.4.1 --- Examples of Random Number Generator --- p.49Chapter 8 --- Private Key and Public Key Cryptography --- p.51Chapter 8.1 --- Block Ciphers --- p.51Chapter 8.1.1 --- Data Encryption Standard (DES) --- p.52Chapter 8.1.2 --- International Data Encryption Algorithm (IDEA) --- p.54Chapter 8.1.3 --- RC5 --- p.55Chapter 8.2 --- Stream Ciphers --- p.56Chapter 8.2.1 --- RC2 and RC4 --- p.57Chapter 8.3 --- Public Key Cryptosystem --- p.58Chapter 8.3.1 --- Diffie-Hellman --- p.60Chapter 8.3.2 --- Knapsack Algorithm --- p.60Chapter 8.3.3 --- RSA --- p.62Chapter 8.3.4 --- Elliptic Curve Cryptosystem --- p.63Chapter 8.3.5 --- Public Key vs. Private Key Cryptosystem --- p.64Chapter 8.4 --- Digital Signature --- p.65Chapter 8.4.1 --- ElGamal Signature Scheme --- p.66Chapter 8.4.2 --- Digital Signature Standard (DSS) --- p.67Chapter 8.5 --- Cryptanalysis to Current Cryptosystems --- p.68Chapter 8.5.1 --- Differential Cryptanalysis --- p.68Chapter 8.5.2 --- An Attack to RC4 in Netscapel.l --- p.69Chapter 8.5.3 --- "An Timing Attack to Diffie-Hellman, RSA" --- p.71Chapter 9 --- Network Security and Electronic Commerce --- p.73Chapter 9.1 --- Network Security --- p.73Chapter 9.1.1 --- Password --- p.73Chapter 9.1.2 --- Network Firewalls --- p.76Chapter 9.2 --- Implementation for Network Security --- p.79Chapter 9.2.1 --- Kerberos --- p.79Chapter 9.2.2 --- Privacy-Enhanced Mail (PEM) --- p.80Chapter 9.2.3 --- Pretty Good Privacy (PGP) --- p.82Chapter 9.3 --- Internet Commerce --- p.83Chapter 9.3.1 --- Electronic Cash --- p.85Chapter 9.4 --- Internet Browsers --- p.87Chapter 9.4.1 --- Secure NCSA Mosaic --- p.87Chapter 9.4.2 --- Netscape Navigator --- p.89Chapter 9.4.3 --- SunSoft HotJava --- p.91Chapter 10 --- Examples of Electronic Commerce System --- p.94Chapter 10.1 --- CyberCash --- p.95Chapter 10.2 --- DigiCash --- p.97Chapter 10.3 --- The Financial Services Technology Consortium --- p.98Chapter 10.3.1 --- Electronic Check Project --- p.99Chapter 10.3.2 --- Electronic Commerce Project --- p.101Chapter 10.4 --- FirstVirtual --- p.103Chapter 10.5 --- Mondex --- p.104Chapter 10.6 --- NetBill --- p.106Chapter 10.7 --- NetCash --- p.108Chapter 10.8 --- NetCheque --- p.111Chapter 11 --- Conclusion --- p.113Chapter A --- An Essay on Chinese Remainder Theorem and RSA --- p.115Bibliography --- p.11

The Role of Digital Certificates in EGoverning. The Case of the Romanian Regulation and Surveillance Authority

The implementation of electronic governance related projects implies user authentication,accounts activation and personal data verification. Certain public services, particularly thoseinvolving financial transactions or statements, require a high security level. The use of the PKI technology and, consequently, of digital signatures, constitutes the most viable solution, meeting the required security standards, protecting, on the one hand, the signatory’s identity, and, on the other hand, the integrity of the transmitted message. Due to the use of the digital certificate, the development of online public services is now possible, especially since it meets the requirements of security standards, but also because it is highly trusted by users. This article intends to analyze the impact of the digital certificate on the improvement of communication between state authorities, including specific transactional relations, and also to consider its influence on security improvement of dataflow. The study demonstrates that the digital certificate is closely connected to the information society, directly determining the dynamics of the development of new applications that provide a better interface between the state and its citizens