Secure Internet Credit-Card Processing

Security continues to be the fly in the Internet commerce ointment. Secure protocols such as Secure Sockets Layer (SSL) and S-HTTP can protect credit-card data as it passes over the Internet between the consumer and the merchant. However, they do nothing to ensure that the merchant accepts payments only from the authorized cardholder or to protect consumers against theft of decrypted credit-card numbers.

Ideally, order information, confirmation, and charge approvals are all digitally signed by the entities generating them. Encrypting all the transaction messages adds protection from prying eyes. While Secure Electronic Transaction (SET) is designed to satisfy merchants, consumers, and especially the credit-card issuers that transactions are hand led securely, lack of a firm specification has hindered efforts to implement it (though IBM, MasterCard, and Danish Payment Systems began live tests of SET in December 1996).

For those who couldn't wait, CyberCash began secure credit-card transactions in April 1995, using a combination of digital signatures and public-key encryption. All three of the storefront packages support CyberCash, which will change from its own protocol (documented in RFC 1898) to SET once the specification is in place.

The credit-card purchase process using CyberCash goes like this:

1. The consumer decides to make a purchase from a Web merchant's store, based on transaction information provided by the merchant.

2. The consumer clicks on a Pay button , launching the CyberCash digital wallet, which prompts for a choice of credit card. T he transaction information is digitally signed by the consumer's wallet, encrypted, and sent to the merchant.

3. The merchant server signs, encrypts, and forwards the transaction information to the CyberCash server. Credit-card numbers are encrypted with the CyberCash public key, so merchants never have to handle them directly.

4. The CyberCash server decrypts and certifies the transaction data and forwards it through a private network to the merchant's bank for authorization.

5. The merchant's bank processes the charge automatically. The bank then returns an approval or denial to CyberCash, which passes it on to the merchant. Finally, the merchant passes it on to the consumer.

Most transactions take fewer than 20 seconds. CyberCash also offers the CyberCoin service for small transactions (under $10) linked to a consumer's checking account.