SECURE ELECTRONIC TRANSACTION Dr

FACULTY CORNER Report on NBA Visit...........................................01 Invited Article....................................................02 Professional Roles and Recognitions...........11 Research News...................................................13 Faculty Upates....................................................23 STUDENTS CORNER Student Co-curricular Activities...................25 Student extracurricular Activities...............28 Student Articles...............................................29 REFELCTIONS.....................................................35 FORTH COMING EVENTS................................36 impulse A Report on NBA Visit Jan 09–11, 2015 The Department of Electronics and Communication Engineering applied for reaccreditation of its B.E. Electronics and Communication Engineering Programme by the National Board of Accreditation (NBA) in March 2014. The NBA Committee visited the College and the Department during Jan 09, 10 and 11, 2015. Dr. S. Radha, Professor and Head of the Department gave a presentation about the Depart- ment overview and about the B.E., ECE Programme. The Programme evaluators visited all the laboratories, department library, class rooms and seminar halls. The programme evaluators interacted with faculty & staff, students and alumni. During the exit meeting, the committee highlighted the lush green large campus with resi- dential accommodation to faculty and staff; wide spread departments with very good labo- ratory space and equipment; dedicated faculty and committed students; excellent faculty retention; and good Wi-Fi facility as the institution’s Strengths. Impressive lab facilities with functional equipment; qualified faculty; good success index and academic performance index; good utilization of alumni resource were highlighted as our department’s strengths by the programme evaluators. The Department of CSE, EEE, IT and BME also had NBA Committee visit along with the De- partment of ECE. Subsequent to the visit, all the five programmes have been accredited for a period of 5 years from July 2015. The Department has also applied for reaccreditation of its M.E., Communication Systems and Applied Electronics Programmes, and the committee visit is expected later this year. 1 impulse SECURE ELECTRONIC TRANSACTION Dr. R. Kishore, Asso. Prof. Recent advancement in wireless com- and Authentication. SET basically provides a munications and electronics has enabled secure communication channel between the a variety of applications and modern com- customer and the merchant involved in the puting systems. With internet, most of the transaction, provides trust by X.509 digital computers in the world today are intercon- certificates. The important point to be noted nected. Even though we enjoy lot of bene- here is that a customer’s credit card informa- fits due to this interconnectivity, it has also tion is exchanged between the customer and created new risks for the users due to threat the credit card authenticator, with a purchase from hackers and attackers. To achieve a se- authorization sent to the merchant that pre- cure system, security must be integrated into vents the merchant from knowing the cus- every component, since any component de- tomer’s credit card information. signed without security can become a point of attack. Consequently, security and privacy SEQUENCE OF STEPS REQUIRED FOR A pervade every aspect of system design. If ad- SET TRANSACTION versaries exist, they can perpetrate a wide variety of attacks in the system. Confidenti- * First the customer obtains a credit card ac ality, Integrity and Authentication are the ba- count with a bank that supports electronic sic security services required to achieve a se- payment and SET cure system. Secure Electronic Transactions, * The customer then receives X.509 digital one of the network security applications, is certificate signed by the bank discussed in this article to understand these * Merchants will be having their own certifi- security services as most of us do credit card cates transactions nowadays. * The customer initiates order * The merchant sends the customer his pub- Secure Electronic Transaction (SET) was a lic key and a copy of his certificate so that the wonderful communication protocol stand- customer can verify that it’s a valid store. ard for securing credit card transactions over insecure networks. Secure Electronic Trans- Now the customer has to place an order with action was developed by SET consortium, es- the merchant. Here the customer wants to tablished in 1996 by VISA and MasterCard. send the Order Information (OI) to the mer- Unlike a payment system, SET is a set of se- chant and the Payment Information (PI) to curity protocols that enables secure transac- the bank. There is no need for the merchant tions over the internet. Like any other security to know about the customer’s PI and the protocol, to meet the requirements SET pro- bank does not need to know about custom- vides services like Confidentiality, Integrity er’s OI. There must be some provision for the 2 impulse customer to keep these two items separate * His certificate. but linked in a way that can be used to re- * His order details, unencrypted. solve conflicts if any. For example the link is * His bank account details encrypted with the needed for the customer to prove that this bank’s public key. payment is for this particular order and not * Upon receiving the Purchase request mes- for some other services. Such a provision is sage from the customer, the merchant possible with Dual Signature. Customer links * Verifies the customer’s certificate by means OI and PI by constructing a Dual Signature. of its CA signatures The steps involved in constructing the Dual * Verifies the Dual Signature using custom- Signature are: er’s public signature key which ensures that the order is not tampered in transit * The customer takes the hash of PI and OI by * The merchant requests payment authoriza- using Secure Hash Algorithm (SHA 1) tion by sending the bank, the authorization * The resulting PI Message Digest (PIMD) and request message OI Message Digest (OIMD) are concatenated * The authorization request message consists and the hash of the result gives Payment Or- of (Note that the merchant doesn’t know the der Message Digest (POMD) client’s payment and bank account details) * POMD is encrypted with customer’s * Purchase related information (The portion private signature PRc key resulting in dual sig- of the Purchase request message passed on nature by the merchant to the payment gateway) * Customer sends Purchase Request message * Authorization related information gener- which includes Purchase related information, ated by the merchant that includes the trans- Order related information and the customer’s action ID signed with merchant’s private sig- certificate nature key and encrypted with a temporary * Purchase related information consists of symmetric key generated by the merchant PI, Dual Signature and OIMD (needed for the and a digital envelope payment gateway to verify Dual Signature) * Certificates like customer’s signature key which is encrypted with a Temporary sym- certificates that is used to verify the Dual metric key Ks which will be passed on by the Signature, the merchant’s signature key cer- merchant to payment gateway along with the tificate that is used to verify the merchant’s Digital envelope (Ks encrypted with bank’s signature and the merchant’s key exchange public key PUb) certificate that is needed in the payment * Order related information needed by the gateway’s response merchant consists of OI, Dual Signature and * Upon receiving an authorization request PIMD (needed for the merchant to verify Dual message from the merchant, the payment Signature) gateway * Customer’s certificate contains his public * Verifies all certificates signature key which is need by merchant as * Decrypts the authorization block and veri- well as payment gateway fies the merchant’s signature * The customer sends the merchant: 3 impulse * Decrypts the payment block and verifies the Dual Signature * Verifies that the transaction ID from the merchant matches with that in the PI received indirectly from the customer * More importantly verifies the customer’s available credit is sufficient for this purchase * The bank sends the merchant a confirmation encrypted with the merchant’s public key, the authorization response * The merchant confirms the order * The merchant ships the goods to the customer. * The merchant sends the bank a transaction request encrypted with the bank’s public key. * The bank transfers the payment to the merchant. Note: The Dual Signature constructed by the customer is sent to both the merchant and the bank. The protocol is designed in such a way that the merchant sees the MD of the PI without seeing the PI itself, and the bank sees the MD of the OI but not the OI itself. The dual signature can be verified using the MD of the OI or PI. It doesn’t require the OI or PI itself. At the same time PIMD and OIMD does not reveal the content of the OI or PI, and thus privacy is preserved. 4 impulse SET was intended to become the de facto standard for secure transactions over the internet between the merchants, the customers, and the credit card companies. Despite heavy pub- licity it failed to gain widespread use due to simplicity of the existing Secure Sockets Layer (SSL) based alternative. Having discussed about SET, we can now look into how we can pro- vide solutions in terms of security services and mechanisms

Load more