E-commerce (Electronic Commerce) is a way of using the International Internet to conduct business operations in the early 1990s, which uses the international Internet to carry out business operations. It is a new method for various business activities through the application, fast and efficient development of network technology. . In e-commerce activities, the most core and critical is the security issue of the transaction. Due to the openness of the Internet itself, the online trading facing many dangers, such as the transaction is worried that the credit card and personal information will be intercepted or encountered by "black store" on the Internet, and the other party is also worried about being stolen The credit card number or transaction does not pay the account. In addition, the safety controlled means used by all walks of life and the electronic payment system of all business entities are not the same, and the trader has caused an attentive feeling. To this end, the safety of e-commerce should first ensure the identity of the trader, the confidentiality of the transaction information, the non-denial of the transaction process, and the non-modification of the transaction packets; at the same time, it should have legal protection. To this end, through the creation and continuous improvement of related technologies and order, existing e-commerce technology and legal norms have basically met the safety requirements of online transactions.
I. CA confirm the legality of the transaction subject identity in real life to confirm its identity, most commonly used to show the identity card. There is also a "ID card" in e-commerce to prove the legality of the identity of the transaction, but this identity card is a digital form, known as "Digital Certificate." The digital certificate is a must-have condition for e-commerce. It is a passport for participating in the online e-commerce, so the reliability and trustedness of the certificate itself are more important. In order to meet this requirement of online transactions, it is necessary to establish an authority to participate in e-commerce, which is responsible for the issuance and management of digital certificates to ensure true and reliable digital certificate. This institution is a Digital Certificate Certification Center. (Certificate Authority, referred to as CA). The main responsibilities of CA include: the issuance, update, abolition, certificate of digital certificate, online query, certificate authentication, etc. The digital certificate issued by CA typically contains the name of the unique identification certificate owner, the unique identification of the name of the certificate publisher, the public key of the certificate owner, the digital signature of the certificate publisher, the validity period of the certificate, and the serial number of the certificate. At present, my country has established a lot of CA certification bodies. Merchants will investigate the legitimacy of the applicant as long as the merchant is submitted to the relevant agency. For merchants who were reviewed and legitimate, a digital certificate capable of identifying their identity was issued by CA. In addition, other subjects that want to go online can also apply to the CA to issue a digital certificate.
Second, the confidentiality of SSL guard trading information
The online transaction is the most worrying that the credit card number is stolen. When the user enters the credit card number, maybe there is a regular person in a certain place in the network, which is asking for all parties to the online transaction to establish a encrypted channel. Dedicated to confidential information in the transaction, SSL provides a security channel such as a guard online transaction. SSL (Secure Socket Layer, Security Sockets) is a netscape company's recommendation of confidentiality communication protocols on the Transport Layer TCP Protocol and Internet Communication, which has become an open key. Technology industry standards and is widely used in intranet and Internet networks. Its standard running process (as an example of merchants and consumers): 1, the merchant server presents a digital certificate to a consumer browser, this digital certificate contains a public key of the merchant, it can open the merchant Any information encrypted by the server with a private key. 2. A consumer browser automatically transmits a piece of information encrypted with the utility of the merchant, requiring merchants to prove that this information can indeed decryption with its private key. 3, the merchant's server decrypts the export information with its private key. 4. A consumer browser approves merchant is the holder of the certificate, and the SSL security channel is established. 5. At this time, consumer users can enter confidential information such as credit card numbers, which are passed to the merchant after encrypting the merchant's public key encryption. 6, the merchant's server is decrypted, and the confidential information of the credit card number of the consumer user can continue to complete the transaction. As soon as the above process, as long as the SSL security channel is established, even if someone intercepts the confidential information of the consumer party, because he does not have the private key of the merchant, it is also solved the information after encryption, so confidential information is effective. protection. Third, "Packet Summary" Maintaining the correctness of information transmission
"Message Digest" is also known as "digital fingerprint", which is unsearable to combine the digital signature of the e-commerce packets and the transaction main body, and from the newspaper A information on which a symbolic summary, symbolic summary is determined and "signature" is extracted. "Packet Summary" is generated by a special hash function (Hash function), which can be an arbitrary size information, and the output is a summary of a fixed length. These summary has such a nature, and if any of the input information is changed, even only change a bit, the output of the output will also occur, that is, each bit of the input information affects the output summary. This type of HASH function is characterized by a summary from the packet, but it can only be brought to the specified summary, but it is difficult to generate two different reports to the designated summary. The text has the same summary. Through this verification method, it is possible to effectively maintain the real and intact of transaction information during transmission, avoiding the possibility of tampering, pretending or deceiving.
