Electronic Payment Systems:Secure Electronic Transaction

(SET)

Secure Electronic Transaction Secure Electronic Transaction : Protocol Parties in SET Certificate of Participants SET Transaction Process Advantages of SET Disadvantages of SET

An application-layer security mechanism, consisting of a set of protocols.

Protect credit card transaction on the Internet. Companies involved:– MasterCard, Visa, IBM, Microsoft,

Netscape, RSA, Cyber Cash. Not an ordinary payment system. It has a complex technical specification

BACK

Confidentiality: All messages are encrypted Trust: All parties must have digital certificates Privacy: information made available only when and where

necessary Developed by Visa and MasterCard Designed to protect credit card transactions

BACK

1

3 2

4

BACK

Cardholder certificates: Cardholder certificates function as an electronic representation of the payment card. Because they are digitally signed by a financial institution, they cannot be altered by a third party and and can only be generated by a financial institution.

Merchant certificates : This includes the technology required to communicate securely with cardholders and their financial institutions. These certificate are approved by the acquiring financial institution and provide assurance that the merchant holds a valid agreement with an Acquirer.

Payment Gateway Certificates: Payment gateway certificates are obtained by Acquirers or their processors for the systems that process authorization and capture messages. The gateway’s encryption key, which the cardholder gets from this certificate, is used to protect the cardholder’s account information.

Acquirer Certificates: An Acquirer must have certificates in order to operate a Certificate Authority that can accept and process certificate requests directly from merchants over public and private networks.

Issuer Certificates: An Issuer must have certificates in order to operate a Certificate Authority that can accept and process certificate requests directly from cardholder over public and private networks.

BACK

SET Transaction Process

The customer opens an account with a card issuer.◦ MasterCard, Visa, etc.

The customer receives a X.509 V3 certificate signed by

a bank.◦ X.509 V3

A merchant who accepts a certain brand of card must

possess two X.509 V3 certificates.◦ One for signing & one for key exchange

The customer places an order for a product or service with

a merchant. The merchant sends a copy of its certificate for verification.BACK

Provide confidentiality of payment information. Ensure the integrity of all transmitted data. Provide authentication that a cardholder is a legitimate

user of a branded payment card account. Provide authentication that a merchant can accept . Branded payment card transactions through its relationship with an acquiring financial institution. The goal of SET is to ensure that the payment process is

private, convenient and most important of all secure.

BACK

Implementing SET is more costly than SSL/TLS for merchants as well.

Business banks must hire companies to manage their payment gateways, or install payment gateways by themselves.

SET employs complex cryptographic mechanisms that may have an impact on the transaction

speed. The overheads associated with SET are heavy.

BACK

BACK TO INDEX