Electronic payment systems for e-commerce

Generally society has been moving towards electronic payment systems since the 1970s, but it is only the arrival of the Internet and its vertiginous growth, that has made possible the recent advances in this area.

Author Notes

Donal OÂMahony holds a Ph.D. in computer science from Trinity College.

Dr. O'Mahony is a lecturer in computer science at Trinity College in Dublin, Ireland, and the head of a research group specializing in networking, telecommunications, and data security. He also has consulted extensively for private industry and government.

050

Preface	p. xiii
1 Motivation for electronic payment	p. 1
References	p. 4
2 Characteristics of current payment systems	p. 5
2.1 Cash payments	p. 6
2.2 Payment through banks	p. 7
2.2.1 Payment by check	p. 7
2.2.2 Payment by giro or credit transfer	p. 9
2.2.3 Automated clearing house (ACH) payments	p. 9
2.2.4 Wire transfer services	p. 11
2.3 Using payment cards	p. 12
2.4 Consumer preferences in payment systems	p. 14
2.5 Regulatory framework	p. 15
References	p. 17
3 Cryptographic techniques	p. 19
3.1 Encryption and decryption	p. 20
3.2 Symmetric encryption	p. 21
3.2.1 Data Encryption Standard (DES)	p. 22
3.2.2 Triple DES	p. 26
3.2.3 IDEA	p. 26
3.2.4 Advanced Encryption Standard (AES)	p. 28
3.2.5 RC2, RC4, and RC5	p. 30
3.3 Message digesting or hashing	p. 33
3.3.1 MD5	p. 34
3.3.2 The Secure Hash Algorithm (SHA)	p. 34
3.4 Kerberos	p. 35
3.4.1 Overview of the Kerberos model	p. 35
3.4.2 Obtaining a ticket	p. 37
3.4.3 Service request	p. 38
3.5 Asymmetric or public-key encryption	p. 38
3.5.1 Properties of a public-key cryptosystem	p. 39
3.5.2 Trapdoor one-way functions	p. 40
3.5.3 Using public-key cryptosystems for authentication	p. 40
3.6 Digital signatures and enveloping	p. 40
3.7 RSA	p. 42
3.8 Elliptic curve cryptography	p. 44
3.9 Public-key infrastructure (PKI)	p. 45
3.9.1 Certificates	p. 45
3.9.2 Certification authorities	p. 46
3.9.3 Attribute certificates	p. 47
3.10 Transport of security information	p. 48
3.10.1 Abstract syntax notation (ASN.1)	p. 49
3.10.2 The X.509 directory authentication framework	p. 51
3.10.3 PKCS cryptographic message syntax	p. 53
3.11 Dual signatures	p. 54
3.12 Nonces	p. 56
3.13 Blind signatures	p. 57
3.14 Chip cards/smart cards	p. 59
3.14.1 Card types	p. 60
3.14.2 Memory types and capacity	p. 61
3.14.3 Physical specifications	p. 63
3.14.4 Security	p. 63
3.14.5 Public-key processing capabilities	p. 64
3.14.6 Multiapplication cards	p. 65
3.14.7 Java Card	p. 65
3.14.8 Multos	p. 67
3.14.9 Observers	p. 68
References	p. 69
4 Credit card-based systems	p. 73
4.1 Mail order/telephone order (MOTO) transactions	p. 76
4.2 Unsecured network payments	p. 76
4.3 First Virtual	p. 77
4.4 Once-off credit card numbers	p. 80
4.5 The secure socket layer (SSL)	p. 82
4.6 i-Key protocol (iKP)	p. 89
4.6.1 Framework of iKP protocols	p. 90
4.6.2 1KP	p. 91
4.6.3 2KP	p. 96
4.6.4 3KP	p. 98
4.7 Secure Electronic Transactions (SET)	p. 100
4.7.1 The SET trust model	p. 102
4.7.2 SET message structure	p. 105
4.7.3 Payment initialization (PInitReq/PInitRes)	p. 106
4.7.4 Purchase order (PReq/PRes)	p. 107
4.7.5 Authorization (AuthReq/AuthRes)	p. 112
4.7.6 Capture of payment (CapReq/CapRes)	p. 114
4.7.7 Cardholder inquiry (InqReq/InqRes)	p. 115
4.7.8 SET software components	p. 120
4.7.9 SET market acceptance	p. 120
4.7.10 Server-side wallets	p. 122
4.7.11 Using SET with smart cards	p. 123
4.8 Summary	p. 123
References	p. 125
5 Electronic checks and account transfers	p. 127
5.1 Payment transfer between centralized accounts	p. 128
5.1.1 Funding the account	p. 130
5.1.2 Authenticated account transfer	p. 134
5.1.3 Withdrawing funds from the system	p. 137
5.1.4 Business models	p. 137
5.2 FSTC payment initiatives	p. 138
5.2.1 Electronic check concept	p. 139
5.2.2 Financial Services Markup Language (FSML)	p. 141
5.2.3 Electronic check functional flows	p. 144
5.2.4 Check-handling infrastructure	p. 146
5.2.5 Bank Internet Payment System (BIPS)	p. 148
5.2.6 Financial Agent Secure Transaction (FAST)	p. 151
5.3 NACHA Internet payments	p. 153
5.3.1 Internet Secure ATM Payments (ISAP)	p. 153
5.3.2 DirectPay	p. 155
5.4 NetBill	p. 156
5.4.1 Protocol overview	p. 157
5.4.2 Authentication procedure	p. 159
5.4.3 Transaction protocol	p. 160
5.4.4 Price request phase	p. 161
5.4.5 Goods delivery phase	p. 161
5.4.6 Payment phase	p. 162
5.4.7 NetBill characteristics	p. 163
5.5 NetCheque	p. 164
5.6 Summary	p. 167
References	p. 167
6 Electronic cash payment systems	p. 171
6.1 Ecash	p. 172
6.1.1 The Ecash model	p. 173
6.1.2 Ecash coins	p. 174
6.1.3 Coin keys	p. 174
6.1.4 Double-spending prevention	p. 177
6.1.5 Withdrawing coins	p. 178
6.1.6 An Ecash purchase	p. 180
6.1.7 Making the payment	p. 180
6.1.8 Proving payment	p. 181
6.1.9 Payment deposit	p. 182
6.1.10 Integration with the Web	p. 182
6.1.11 Ecash in the mail	p. 183
6.1.12 Transferring Ecash	p. 183
6.1.13 Lost coins	p. 184
6.1.14 Ecash and crime	p. 184
6.1.15 Magic Money	p. 186
6.1.16 Remarks	p. 186
6.2 Project CAFE	p. 186
6.2.1 Goals of CAFE	p. 187
6.2.2 Architecture	p. 188
6.2.3 CAFE devices	p. 189
6.2.4 Role of observers	p. 190
6.2.5 Protocol overview	p. 190
6.2.6 Off-line coins	p. 191
6.2.7 The [alpha] protocol	p. 192
6.2.8 The [Gamma] protocol	p. 195
6.2.9 Additional features	p. 196
6.2.10 Remarks	p. 196
6.3 NetCash	p. 196
6.3.1 Framework/model	p. 197
6.3.2 NetCash coins	p. 198
6.3.3 Double-spending prevention	p. 199
6.3.4 Coin transfer	p. 200
6.3.5 Certificate of insurance	p. 200
6.3.6 Basic purchase	p. 201
6.3.7 Obtaining coins	p. 201
6.3.8 Paying a merchant	p. 203
6.3.9 Verifying coins	p. 204
6.3.10 Providing limited anonymity	p. 204
6.3.11 Merchant anonymity	p. 205
6.3.12 Preventing anonymity	p. 206
6.3.13 Clearing	p. 206
6.3.14 Extensions	p. 207
6.3.15 Preventing merchant fraud	p. 207
6.3.16 Off-line protocols	p. 209
6.3.17 Remarks	p. 210
6.4 Mondex	p. 210
6.5 EMV cash cards and CEPS	p. 213
6.5.1 EMV2000	p. 214
6.5.2 Common Electronic Purse Specification (CEPS)	p. 214
6.5.3 Remarks	p. 220
6.6 SmartAxis	p. 220
6.7 Remarks	p. 222
References	p. 223
7 Micropayment systems	p. 227
7.1 Millicent	p. 228
7.1.1 The Millicent model	p. 229
7.1.2 Purchasing with Millicent	p. 231
7.1.3 Scrip	p. 233
7.1.4 Scrip structure	p. 234
7.1.5 Scrip certificate generation	p. 235
7.1.6 Scrip validation	p. 235
7.1.7 Preventing double spending	p. 237
7.1.8 Computation costs	p. 237
7.1.9 Sending scrip over a network: the Millicent protocols	p. 237
7.1.10 Scrip in the clear	p. 237
7.1.11 Encrypted network connection	p. 237
7.1.12 Request signatures	p. 241
7.1.13 Performance	p. 243
7.1.14 Millicent with the Web	p. 243
7.1.15 Extensions	p. 244
7.1.16 Summary	p. 245
7.2 SubScrip	p. 245
7.2.1 Basic SubScrip	p. 246
7.2.2 Establishing a temporary account	p. 246
7.2.3 Providing anonymity	p. 247
7.2.4 A SubScrip ticket	p. 247
7.2.5 A SubScrip purchase	p. 248
7.2.6 Security and privacy	p. 248
7.2.7 Protected SubScrip	p. 249
7.2.8 Refunding SubScrip	p. 250
7.2.9 Lost tickets	p. 250
7.3 PayWord	p. 250
7.3.1 PayWord user certificates	p. 251
7.3.2 Revoked certificates	p. 253
7.3.3 PayWord chains	p. 253
7.3.4 Commitment to a PayWord chain	p. 254
7.3.5 Spending PayWords	p. 255
7.3.6 Variable-size payments	p. 256
7.3.7 Redeeming spent PayWords	p. 257
7.3.8 Computational costs	p. 257
7.3.9 Extensions	p. 258
7.3.10 Remarks	p. 258
7.4 iKP micropayment protocol	p. 259
7.4.1 [mu]-3KP protocol	p. 260
7.4.2 Repeated micropayments	p. 261
7.4.3 Nonrepeated micropayments	p. 264
7.4.4 Remarks	p. 266
7.5 Hash chain trees	p. 266
7.5.1 PayTree	p. 268
7.5.2 Unbalanced One-way Binary Tree (UOBT)	p. 270
7.6 MicroMint	p. 273
7.6.1 The MicroMint model	p. 274
7.6.2 MicroMint coins	p. 274
7.6.3 Verifying a coin	p. 275
7.6.4 Minting coins	p. 276
7.6.5 Computational costs	p. 277
7.6.6 Multiple coins per bin	p. 278
7.6.7 Coin validity criterion	p. 278
7.6.8 Preventing forgery	p. 279
7.6.9 A MicroMint purchase	p. 280
7.6.10 Double spending	p. 280
7.6.11 Extensions	p. 281
7.7 Probability-based micropayments	p. 283
7.7.1 Bets using coin flips	p. 284
7.7.2 Hash chain lottery tickets	p. 286
7.8 Jalda	p. 288
7.9 NewGenPay/IBM Micropayments	p. 292
7.10 Banner advertising as a form of micropayment	p. 296
7.11 Micropayments summary and analysis	p. 297
References	p. 300
8 Mobile commerce	p. 303
8.1 Mobile Internet architectures	p. 305
8.1.1 Carrying Internet data on cellular networks	p. 305
8.1.2 The wireless application protocol (WAP)	p. 306
8.1.3 Japan's iMode service	p. 307
8.2 Industry consortia	p. 308
8.3 Mobile network operator as banker	p. 308
8.4 Third-party account-based mobile payment systems	p. 309
8.4.1 Sonera MobilePay	p. 310
8.4.2 Paybox	p. 311
8.4.3 GiSMo	p. 313
8.4.4 The Fundamo architecture	p. 315
8.5 Credit card-based systems	p. 316
8.5.1 Mobile SET	p. 317
8.5.2 Remarks	p. 320
8.6 Summary	p. 321
References	p. 322
9 Payment systems: prospects for the future	p. 325
About the authors	p. 329
Index	p. 331

Available:*

On Order

Summary

Summary

Author Notes

Table of Contents