CSE 6244 Lecture 3
CSE 6244 Lecture 3
1. Confidentiality:
Information can only be accessed by the person for whom it is intended
and no other person except him can access it.
2. Integrity:
Information cannot be modified in storage or transition between sender
and intended receiver without any addition to information being detected.
3. Non-repudiation:
The creator/sender of information cannot deny his or her intention to send
information at later stage.
4. Authentication:
The identities of sender and receiver are confirmed. As well as
destination/origin of information is confirmed.
TYPES OF CRYPTOGRAPHY:
29
2. Hash Functions:
There is no usage of any key in this algorithm. A hash value with fixed
length is calculated as per the plain text which makes it impossible for
contents of plain text to be recovered. Many operating systems use hash
functions to encrypt passwords.
3. Asymmetric Key Cryptography:
30
Integrity– to ensure that the message was not altered during the transmission.
Message digest -The representation of text in the form of a single string of digits,
created using a formula called a one way hash function. Encrypting a message
digest with a private key creates a digital signature which is an electronic means of
authentication..
DIGITAL SIGNATURE
A digital signature is a mathematical technique used to validate the authenticity and
integrity of a message, software or digital document.
DIGITAL CERTIFICATE
Digital certificate is issued by a trusted third party which proves sender's identity to
the receiver and receiver’s identity to the sender.
A digital certificate is a certificate issued by a Certificate Authority (CA) to verify the
identity of the certificate holder. The CA issues an encrypted digital certificate
containing the applicant’s public key and a variety of other identification information.
Digital certificate is used to attach public key with a particular individual or an entity.
32
Digital signature is like a fingerprint
or an attachment to a digital Digital certificate is a file that
Basics / document that ensures its ensures holder’s identity and
Definition authenticity and integrity. provides security.
DIGITAL ENVELOPE:
A digital envelope is a secure electronic data container that is used to protect
a message through encryption and data authentication.
A digital envelope allows users to encrypt data with the speed of secret key
encryption and the convenience and security of public key encryption.
33
An example of a digital envelope is Pretty Good Privacy (PGP) - a popular data
cryptography software that also provides cryptographic privacy and data
communication authentication.
· Card payments – Card payments are done via cards e.g. credit card, debit
card, smart cards, stored valued cards, etc. In this mode, an electronic
payment accepting device initiates the online payment transfer via card
· Credit/ Debit card – An e payment method where the card is required for
making payments through an electronic device.
· Smart card – Also known as a chip card, a smart card, a card with a
microprocessor chip is needed to transfer payments.
· Stored value card – These types of cards have some amount of money
stored beforehand and are needed to make funds transfer. These are prepaid
cards like gift cards, etc.
· Direct debit – Direct debit transfers funds from a customer’s account with the
help of a third party
· E-cash – It is a form where the money is stored in the customer’s device which
is used for making transfers.
34
Alternate payment methods – As technology is evolving, e-payment methods
kept evolving with it (are still evolving..) These innovative alternate e-payment
methods became widely popular very quickly thanks to their convenience.
· Payments are done via Wearable devices – Wearable devices are rapidly
becoming popular among customers. These devices are connected to the
customer’s bank account and are used to make online payments. An example
of a wearable used for making an online payment is a smartwatch.
35
deep learning tools, etc are making it easier for businesses to maintain
transparency.
People are almost comfortable with online shopping and e-payments. With this
trend, accepting online payment is a must for any business.
E-payments are making shopping and banking more convenient. They are
helping customers to reach more clients locally and globally.
36
It’s easy to integrate online payment solutions with businesses as many
payment processing solution providers offering different types of solutions.
Online payment solutions come with security and risk and anti-fraud tools
making them reliable and secure not only for customers but also for merchants.
In any payment transaction, there will be a time lag between the time payment
instructions are issued and final settlement of these claims (either on gross or net
basis). This time lag exposes the entire system to various risks which are given
below:
1. Credit Risk: the risk that a party within the system will be unable fully to meet
its financial obligations within the system either when due or at any time in the
future
2. Liquidity Risk: the risk that a party within the system will have insufficient
funds to meet financial obligations within the system as and when expected
although it may be able to do so at some time in the future
3. Legal Risk: the risk that a poor legal framework or legal uncertainties will
cause or exacerbate credit or liquidity risks
4. Operational Risk: the risk that operational factors such as technical
malfunctions or operational mistakes will cause or exacerbate credit or liquidity
risks
5. Systemic Risk: the risk that the inability of one of the participants to meet its
obligations, or a disruption in the system itself, could result in the inability of
other system participants or of financial institutions in other parts of the
financial system to meet their obligations as they become due. Such a failure
could cause widespread liquidity or credit problems and, as a result, could
threaten the stability of the system or of financial markets.
When data is transferred in non-encrypted form between a server and a client, cyber
criminals can eavesdrop, intercept, modify and steal the data. Private, confidential
data including personal information, login credentials, card details, banking data and
37
corporate communication must be transmitted securely, and this is achieved through
SSL protocol.
There are 3 essential elements at work in the process described above: a protocol
for communications (SSL), credentials for establishing identity (the SSL certificate),
and a third party that vouches for the credentials (the certificate authority).
· Computers use protocols to allow different systems to work together. Web
servers and web browsers rely on the Secure Sockets Layer (SSL)
protocol to enable encrypted communications. The browser’s request that the
server identify itself is a function of the SSL protocol.
· Credentials for establishing identity are common to our everyday lives: a
driver’s license, a passport, a company badge. An SSL certificate is a type of
digital certificate that serves as a credential in the online world. Each SSL
certificate uniquely identifies a specific domain (such as thawte.com) and a web
server.
· Our trust of a credential depends on our confidence in the organization that
issued it. Certificate authorities have a variety of methods to verify
information provided by individuals or organizations. Established certificate
authorities, such as Thawte, are well known and trusted by browser vendors.
Browsers extend that trust to digital certificates that are verified by the
certificate authority
BIOMETRICS
Biometrics is the measurement and statistical analysis of people's physical
and behavioral characteristics. The technology is mainly used for identification and
access control, or for identifying individuals that are under surveillance.
The basic premise of biometric authentication is that everyone is unique and an
individual can be identified by his or her intrinsic physical or behavioral traits.
The term "biometrics" is derived from the Greek words "bio" meaning life and "metric"
meaning to measure.
There are two main types of biometric identifiers:
38
Ø Physiological characteristics: The shape or composition of the body.
Ø Behavioral characteristics: The behavior of a person.
Accuracy of biometrics
The accuracy and cost of readers has until recently been a limiting factor in
the adoption of biometric authentication solutions but the presence of high quality
cameras, microphones, and fingerprint readers in many of today’s mobile devices
means biometrics is likely to become a considerably more common method of
authenticating users, particularly as the new FIDO specification means that two-
factor authentication using biometrics is finally becoming cost effective and in a
position to be rolled out to the consumer market.
The quality of biometric readers is improving all the time, but they can still
produce false negatives and false positives. One problem with fingerprints is that
people inadvertently leave their fingerprints on many surfaces they touch, and it’s
fairly easy to copy them and create a replica in silicone. People also leave DNA
everywhere they go and someone’s voice is also easily captured. Dynamic biometrics
like gestures and facial expressions can change, but they can be captured by HD
cameras and copied. Also, whatever biometric is being measured, if the
measurement data is exposed at any point during the authentication process, there
is always the possibility it can be intercepted. This is a big problem, as people can’t
change their physical attributes as they can a password. While limitations in biometric
authentication schemes are real, biometrics is a great improvement over passwords
as a means of authenticating an individual.
39
E-COMMERCE - SECURITY SYSTEMS
Security is an essential part of any transaction that takes place over the internet.
Customers will lose his/her faith in e-business if its security is compromised.
Following are the essential requirements for safe e-payments/transactions −
· Confidentiality − Information should not be accessible to an unauthorized
person. It should not be intercepted during the transmission.
· Integrity − Information should not be altered during its transmission over the
network.
· Availability − Information should be available wherever and whenever
required within a time limit specified.
· Authenticity − There should be a mechanism to authenticate a user before
giving him/her an access to the required information.
· Non-Repudiability − It is the protection against the denial of order or denial
of payment. Once a sender sends a message, the sender should not be able
to deny sending the message. Similarly, the recipient of message should not
be able to deny the receipt.
· Encryption − Information should be encrypted and decrypted only by an
authorized user.
· Auditability − Data should be recorded in such a way that it can be audited
for integrity requirements.
MEASURES TO ENSURE SECURITY
MAJOR SECURITY MEASURES ARE FOLLOWING −
· Encryption − It is a very effective and practical way to safeguard the data
being transmitted over the network. Sender of the information encrypts the
data using a secret code and only the specified receiver can decrypt the data
using the same or a different secret code.
· Digital Signature − Digital signature ensures the authenticity of the
information. A digital signature is an e-signature authenticated through
encryption and password.
· Security Certificates − Security certificate is a unique digital id used to verify
the identity of an individual website or user.
40
· Small appliances such as toasters and coffee makers
· Computers
· Televisions
· Stereo equipment
· Lighting equipment and bulbs
· Power tools
· Toys and sports equipment with electronic components
· Medical equipment systems
· Printers, scanners and photocopiers
· Personal care devices, such as electric toothbrushes and blowdryers
41
· Mercury: Some appliances like gas hot water heaters and chest freezers
contain mercury switches. When mercury isn’t properly disposed, it may create
serious health issues such as respiratory and skin disorders.
Solutions to the E-waste Problem
1. Recycling
More consumers need to get into the habit of taking their used
electronics to an experienced recycling firm that can disassemble them,
separating and categorizing the contents by material and cleaning them, then
shredding them mechanically for further sorting with advanced separation
technologies.
An experienced recycling firm like Great Lakes Electronics Corporation will
meet the highest standards for how they recycle our e-waste and ensure that
nothing of value within any device gets wasted. By doing so, they’re also able
to meet the high demand for recycling metals from used electronics, which are
then used to make new products.
2. Education
The second most important solution is to educate people about how
important recycling is for e-waste. It can begin with setting an example, making
a commitment on your own to take any electronic device you have that’s no
longer wanted or being used, and bring it to a recycling firm rather than throw
it out with your regular trash or toss it in a desk drawer.
But then it’s also important to be vocal about that with others: to note that out
of concern for our environment, you adopted the practice of recycling each
device.
Writing about the environmental benefits of recycling e-waste on social media
sites is also a good place to start spreading the word.
3. Teach
It’s important to spread that message to your family, friends,
neighbours, and co-workers, but it’s also important to get the message to our
future leaders — our children.
we could start by asking your teacher if we could work on a project to have all
the kids at school bring in the old cell phones their parents no longer want,
and teach the students how to collect the devices and get them to a recycling
firm.
And it isn’t just schools that have a role to play here. Non-profit organizations,
municipal governments and businesses in the private sector can also get
involved in hosting community events that promote recycling and educating
people about our e-waste challenge.
4. Keep Learning
42
Just as the technology that creates smart phones and other devices
keeps changing, the same is true when it comes to e-waste. In the U.S., 25
states now have laws that aim to either prevent used electronics from being
sent to landfills, or that promote recycling. The European Union has
established new goals for increasing e-waste recycling rates. The United
Nations has launched the Step-Initiative to introduce a comprehensive
approach to handling E-Waste, while also preparing professionals to work in
the field of E-Waste management.
E- SURVEILLANCE
Electronic surveillance is the act of recording, observing or listening to
individuals in real-time with or without their knowledge. Electronic surveillance is
typically conducted secretively and does not interfere with an individual's normal
activities. Usually, a surveillance activity involves one or more individuals observing
and documenting another individual's actions using cameras, long-range
microphones and listening devices, as well as by monitoring cell, office, and home
phone services.
43
· Pen register: a device placed on a telephone line used to identify the
telephone numbers of calls made from the surveilled phone
· Photographic surveillance: includes visual equipment such as closed-circuit
television and digital cameras in various sizes used to photograph individuals
· Wired agents and informers: involves the planting of a recording or listening
device on a single person while engaged in conversations with other
individuals
E-GOVERNANCE
44
The objective of E-Governance is to bring about ‘Simple, Moral, Accountable,
Responsive and Transparent’ (SMART) governance. The rationale of E-governance
is in its need in reducing red tape; promotion of knowledge sharing to facilitate
improvements in quality of governance; fulfilling expectations of the people from
government; welfare of citizens, transparency and accountability; increase reach of
service delivery by government; speeding up government processes and decision
taking ability; equitable access to public service; internal efficiency; reducing costs
and improving revenues; improving quality of services etc.
Elements of E-Governance:
Basic elements of e-governance are:
1. Government
2. Citizens
3. Investors/Businesses
Types of E-Governance:
E-governance is of 4 types:
1. Government-to-Citizen(G2C):
45
database using online communication. The government departments can work
together. This service can increase international discretion and relations.
G2G services can be at the local level or at the international level. It can convey
with both global government and local government. It also provides safe and
secure inter-relationship between domestic or foreign government. G2G builds
a universal database for all members to upgrade service.
4. Government-to-Employee(G2E):
ADVANTAGES OF E-GOVERNANCE
· Speed
Technology makes communication swifter. Internet, smartphones have
enables instant transmission of high volumes of data all over the world.
· Saving Costs
A lot the Government expenditure goes towards the cost of buying
stationery for official purposes. Letters and written records consume a lot of
stationery. However, replacing them with smartphones and the internet can
saves crores of money in expenses every year.
· Transparency
The use of e-governance helps make all functions of the business
transparent. All Governmental information can be uploaded onto the internet.
The citizens access specifically access whichever information they want,
whenever they want it, at the click of a mouse, or the touch of a finger.
However, for this to work the Government has to ensure that all data as to be
made public and uploaded to the Government information forums on the internet.
· Accountability
Transparency directly links to accountability. Once the functions of the
government are available, we can hold them accountable for their actions.
46
DISADVANTAGES OF E-GOVERNANCE
E-CARE
e-care is an umbrella term referring to the automation of all aspects of the
care delivery processes across administrative, clinical and departmental boundaries
in the healthcare delivery system.
The beneficiary of the convergence of multiple technologies such as object-
oriented and adaptive applications that leverage the web to link disperate system and
enable automated, real time responses to inquires, clinical alerts etc.
BENEFITS OF E-CARE
· Request or schedule medical appointments.
· Request referrals.
· Request prescription renewals.
· View test results.
· View your health summary from your electronic health record.
· Communicate electronically and securely with your clinical team.
47