Transfer from http://baike.1688.com/doc/view-d36110860.html
E-commerce payment information flow typical structure 1 is shown. In the diagram, the trusted third party is the CA certification Center. Both the merchant and the customer must obtain their own certificate from the CA and then pass the CA certification. Obviously, each part of the information transmission, must be encrypted processing, information sources and purposes must be recognized in the e-commerce payment system, consumers and businesses are faced with threats:
False order: The impostor orders the goods in the name of the customer, and requests the customer to pay or return the goods; The merchant does not receive the payment after the goods are shipped; confidentiality loss: The PIN or password is lost during transmission, the merchant's order confirmation information is tampered with, and the electronic money and coins are lost: it may be physical damage or theft. This usually brings irreparable damage to the user. The corresponding security technologies are: Network security detection equipment (saftsuite) access device (Security authentication card) Browser/server Software (support SSL) certificate (VeriSign) (PKI-CA, public key encryption algorithm) commercial software (support electronic Payment) firewall (RSA BSAFE: Support RSA,DES,TRIPLEDES,RC2,RC4, etc.) protection of transmission line security (electromagnetic radiation shielding, etc.) anti-intrusion measures, ids,dids (intrusion detection system, distributed intrusion detection System) data encryption (the most basic security technology, such as links, nodes, End-to-end encryption, etc.) access control (according to role access control) authentication mechanism (message authentication, digital signature, terminal identification, etc.) routing mechanism (blocking inappropriate IP access, DOS attack prevention) traffic control (masking the frequency of communication, message length, message form, message address, etc.) data integrity control (to From the correct sender, data transfer to the correct receiver) port protection (anti-port scan, etc.) Virus Trojan prevention measures
From for notes (Wiz)
Security technology of electronic payment system
