This chapter is from the book
This chapter is from the book
This chapter is from the book
3.5 Secure Communications
One of the major advancements supporting the proliferation of e-commerce pertains to the creation of secure communication protocols, such as the Secure Sockets Layer (SSL). These protocols have given Web users greater confidence that their transactions across the Internet will not be intercepted by a third party eavesdropping on the connection between the user and the Web system.
SSL enables two parties to communicate in an encrypted form over a network. Establishing a secure communications session between a browser client and a Web server entails several steps.
A well-known certificate authority must grant the Web server a valid certificate. The certificate stores information about the host, including its public key (Powell, Braginski, 1998, p. 332). A public key consists of a large number that can be used to encrypt a message that can then be decrypted only with the corresponding private key. The reverse is also possible; a message encrypted with the private key can be decrypted only by using the public key. On the Internet, private keys are closely guarded by their owners, whereas public keys are available to anyone. A private key owner is any individual user or a Web server having an assigned certificate. This type of encryption is usually referred to as asymmetric encryption, as two keys are used in the encryption/decryption process.
The client computer must be configured with the public key of the certificate authority (CA) that issued the server's certificate. This is necessary to verify that the certificate from the host is valid and belongs to the host in question. Several independent commercial companies, such as Verisign, are certificate authorities. The client uses the public key of the CA to verify the authenticity of the server's certificate.
The client computer challenges the host to encrypt a random piece of data with the private key—known only by the host—and the client must be able to successfully decrypt it with the public key. If the client is not able to do so, the session is aborted, as the client is not able to successfully authenticate the server.
If it has successfully authenticated the server, the client computer must generate a session key that will be used for all communications for the remainder of the session. The session key is encrypted with the server's public key so it cannot be read by anyone else and is sent to the server. (Prowell, Braginski, 1998, p. 329.) The session key is used because it is faster than public/private key cryptography. Session key encryption is also called symmetric encryption, as only one key is used for the encryption/decryption process.
Once these steps have been followed, the client computer and the Web server communicate by using the session key for the remainder of their conversation. This complicated exchange of certificates and keys is necessary in order to verify the identity of the Web server and to transfer the session key from the client to the server. Then the two parties can communicate using symmetric encryption, without a third party being able to decrypt the conversation; the third party does not know and cannot acquire the session key.
Most e-commerce Web systems allow users to browse products on the Web site without the use of an encrypted channel, as the information being exchanged is intended to be available to the general public. When it comes time for the user to make a purchase, however, the client computer connects to a special port on the Web server, known as the secure HTTP, or SSL, port. As soon as this connection is made, the client and the server engage in the initial handshake, outlined in the preceding steps, in order to verify the server's identity and to exchange the session key. At this point, the user can enter sensitive information, such as a credit card number, and be confident that the information cannot be read by a third party.