Web Security
By: Dr. Juita T. Raut
SDSM College, palghar
Web & Internet Security Consideration
• Security on the Internet
• Decentralization
• Redundancy
• Asynchronous
• Concurrency
Web traffic security approaches:
• Network level
• Transport level
• Application level
Secure Socket layer
• It provides security to the data that is transferred between web browser and server.
• SSL encrypts the link between a web server and a browser which ensures that all
data passed between them remain private and free from attack.
• Secure Socket Layer Protocols:
• SSL record protocol
• Handshake protocol
• Change-cipher spec protocol
• Alert protocol
SSL Record Protocol:
SSL Record provides two services to SSL connection.
•Confidentiality
•Message Integrity
• In the SSL Record Protocol application
data is divided into fragments.
• The fragment is compressed and then
encrypted MAC (Message Authentication
Code) generated by algorithms like SHA
(Secure Hash Protocol) and MD5
(Message Digest) is appended.
• After that encryption of the data is done
and in last SSL header is appended to the
data.
• Handshake Protocol:
• Handshake Protocol is used to establish sessions. This protocol allows the client and
server to authenticate each other by sending a series of messages to each other.
Handshake protocol uses four phases to complete its cycle.
• Phase-1: In Phase-1 both Client and Server send hello-packets to each other. In this IP
session, cipher suite and protocol version are exchanged for security purposes.
• Phase-2: Server sends his certificate and Server-key-exchange. The server end phase-2
by sending the Server-hello-end packet.
• Phase-3: In this phase, Client replies to the server by sending his certificate and Client-
exchange-key.
• Phase-4: In Phase-4 Change-cipher suite occurs and after this the Handshake Protocol
ends.
• Change-cipher Protocol:
• This protocol uses the SSL record protocol. Unless Handshake Protocol is
completed, the SSL record Output will be in a pending state. After the
handshake protocol, the Pending state is converted into the current state.
Change-cipher protocol consists of a single message which is 1 byte in length
and can have only one value. This protocol’s purpose is to cause the pending
state to be copied into the current state.
• Alert Protocol:
• This protocol is used to convey SSL-related alerts to the peer entity. Each
message in this protocol contains 2 bytes.
Transport Layer Security (TLS)
• Transport Layer Securities (TLS) are designed to provide security at the transport layer. TLS was derived from a security
protocol called Secure Socket Layer (SSL). TLS ensures that no third party may eavesdrop or tampers with any message.
• There are several benefits of TLS:
• Encryption:
TLS/SSL can help to secure transmitted data using encryption.
• Interoperability:
TLS/SSL works with most web browsers, including Microsoft Internet Explorer and on most operating systems and web
servers.
• Algorithm flexibility:
TLS/SSL provides operations for authentication mechanism, encryption algorithms and hashing algorithm that are used
during the secure session.
• Ease of Deployment:
Many applications TLS/SSL temporarily on a windows server 2003 operating systems.
• Ease of Use:
Because we implement TLS/SSL beneath the application layer, most of its operations are completely invisible to client.
SSL V/S TLS
Secure Electronic Transaction (SET)
• SET is a system that ensures the security and integrity of electronic transactions
done using credit cards in a scenario.
• SET is not some system that enables payment but it is a security protocol applied to
those payments.
• It uses different encryption and hashing techniques to secure payments over the
internet done through credit cards.
• The SET protocol was supported in development by major organizations like Visa,
Mastercard, and Microsoft which provided its Secure Transaction Technology
(STT), and Netscape which provided the technology of Secure Socket Layer (SSL).
SET Scenario
Requirements in SET: The SET protocol has some requirements to meet, some of the important requirements
are:
•It has to provide mutual authentication i.e., customer (or cardholder) authentication by confirming if the
customer is an intended user or not, and merchant authentication.
•It has to keep the PI (Payment Information) and OI (Order Information) confidential by appropriate
encryptions.
•It has to be resistive against message modifications i.e., no changes should be allowed in the content being
transmitted.
•SET also needs to provide interoperability and make use of the best security mechanisms.
Participants in SET: In the general scenario of online transactions, SET includes similar participants:
1.Cardholder – customer
2.Issuer – customer financial institution
3.Merchant
4.Acquirer – Merchant financial
5.Certificate authority – Authority that follows certain standards and issues certificates(like X.509V3) to all
other participants.
SET functionalities:
•Provide Authentication
• Merchant Authentication – To prevent theft, SET allows customers to check previous
relationships between merchants and financial institutions. Standard X.509V3 certificates are
used for this verification.
• Customer / Cardholder Authentication – SET checks if the use of a credit card is done by an
authorized user or not using X.509V3 certificates.
•Provide Message Confidentiality: Confidentiality refers to preventing unintended people from
reading the message being transferred. SET implements confidentiality by using encryption techniques.
Traditionally DES is used for encryption purposes.
•Provide Message Integrity: SET doesn’t allow message modification with the help of signatures.
Messages are protected against unauthorized modification using RSA digital signatures with SHA-1 and
some using HMAC with SHA-1,.
Dual Signature: The dual signature is a concept introduced with SET, which aims at connecting two
information pieces meant for two different receivers :
Order Information (OI) for merchant
Payment Information (PI) for bank
• Advantages:
• Extremely secure
• Disadvantages:
• Not easy to implement
• Expensive
• Scalability is still an issue
• Not tried and tested
• Expensive to integrate with legacy application
SSL V/S SET
Issue Secure Socket Layer (SSL) Secure Electronic Transaction
(SET)
Objective Data exchange in encrypted form Payment mechanism is related to
E-Commerce
Certification Communication between two Parties involved in payment
parties for certification process
Authentication Weak authentication Very strong
Risk of Merchant Fraud More chances No chance
