Methods for protecting the digital money electronic payment system. The main ways to protect electronic money? Security measures for electronic payment systems
Electronic payment systems are one of the most popular types of working with electronic currency. Every year they are developing more and more actively, occupying a fairly large share of the market for working with currency. Technologies to ensure their safety are also developing along with them. Because today, not a single electronic payment system can exist without good technologies and security systems, which in turn ensure the safe transaction of monetary transactions. There are a lot of electronic payment systems themselves, as well as security technologies. Each of them has different operating principles and technologies, as well as its own advantages and disadvantages. In addition, a number of theoretical and practical issues remain unresolved, which determines the relevance of the research topic.
Each electronic payment system uses its own methods, encryption algorithms, and data transfer protocols to perform secure transactions and data transfer. Some systems use the RSA encryption algorithm and the HTTPs transfer protocol, while others use the DES algorithm and the SSL protocol to transfer encrypted data. The idea behind writing this article is to study and analyze a number of popular payment systems, namely the security technologies used in them, and find out which is the most advanced.
During the writing of the article, research was carried out on payment systems and an analysis of the security of existing payment systems. Four payment systems were analyzed (Webmoney, Yandex.Money, RauPa1 and E-Port) according to the same criteria. The systems were assessed using a multi-level system that includes nested parameters. Of course, all these criteria relate to the area information security. There are two main criteria: technical support for information security of payments and organizational and legal support. Each of these two parameters was assessed using a three-point system. The rating scale is exactly this, since the current development of electronic payment systems in our country is at such a level that most of their parameters can only be described with the words “yes or no.” Accordingly, if an electronic payment system best matches any parameter, it receives the highest score (3); if it does not respond at all, it receives the minimum score (0). If the system does not have this criterion in its explicit form, but if there are any services or capabilities associated with the missing one, we award an intermediate score - one or two.
When evaluating electronic payment systems, it should be remembered that under different conditions the value of the same parameter is not the same. For example, several services that significantly increase the level of protection can only be implemented by the user voluntarily; in addition, the very presence of these services in the system is valuable. The human factor has not been canceled and will never be canceled, so it is taken into account that the service can be either implemented or unrealized.
Technical support for transaction security
This is the first of the criteria - a set of parameters that, as is clear from its name, provides the technical side of information protection. Before this parameter, the following are included: cryptographic methods of encryption, authentication and access using a special hardware(in the most primitive case - using USB keys).
It's no secret that the main criterion for protecting information in technical terms is, of course, data encryption, and more specifically, the cryptographic algorithms with which they are implemented. It is also known that the longer the key, the more difficult it is to decrypt it and, accordingly, to gain access to confidential information. Three of the tested systems use the well-known and widely respected RSA algorithm: Webmoney, Yandex.Money, PayPal. E-Port uses encryption via the SSL protocol version 3.0. In fact, encryption is implemented using SSL keys, which are unique, they are generated during the session, and are called the session key. The length of the SSL key in the E-Port system varies from 40 to 128 bits, which is quite enough for an acceptable level of transaction security.
The next parameter in the technical support of information security of transactions is authentication, i.e. a set of solutions that the user needs to access his own personal information. Everything is simple here. The Webmoney and Yandex.Money systems use two criteria for access, while PayPal and E-Port use only one. In Webmoney, to access the system and make payments, you must enter a password and a special key. Yandex.Money works similarly: a password and a special wallet program are required. In all other systems, access is provided by password. However, in the E-Port system, in order to work using the SSL protocol, the web server of the potential client (and any other participant in the system) must have a special digital certificate received from one of the authorized companies. This certificate is used to authenticate the client's web server. The certificate security mechanism used in E-Port is certified by RSA Security. The third and final criterion in this study is access to the system using special hardware, such as USB keys.
Cryptographic encryption methods
Webmoney and Yandex.Money use a key with a length of 1024 bits (a very high indicator, it is almost impossible to crack such a key using a simple brute force method), and PayPal uses a key half as long - 512 bits. Accordingly, for the first two systems, using this criterion we obtain the maximum point – 3. PayPal, because it uses a shorter encryption key, gets two points. It remains only to evaluate E-Port by this parameter. Despite its use of the SSL protocol and even the key length of up to 128 bits, E-Port has some potential vulnerability: many older versions of browsers support encryption with keys of shorter length, so there is a possibility of hacking the received data; accordingly, for those who use the browser as a client for payment system, you need to work with it latest version(of course, this is not always convenient or possible). However, in the “encryption” column, E-Port can be given a score of 1.7: the system earned this rating thanks to the use of the progressive PGP protocol for encrypting email messages.
Authentication
The Webmoney and Yandex.Money systems use two criteria for access, while PayPal and E-Port use only one. In Webmoney, to access the system and make payments, you must enter a password and a special key. Yandex.Money works similarly: a password and a special wallet program are required. In all other systems, access is provided by password. However, in the E-Port system, the web server of the potential client is used to work using the SSL protocol.
According to Webmoney and Yandex.Money, they receive three points here, PayPal - 0 points, E-Port - one.
It’s even easier here than with the previous parameters. Of all the systems, only Webmoney PayPal has such an additional option; the latter do not provide such an opportunity. Thus, taking into account the weighting coefficient, Webmoney and PayPal received 1.5 points for this parameter, all others received zero.
After evaluating the two criteria, we can summarize. Based on the sum of the parameters considered, Webmoney turned out to be safe. Indeed, if the user uses all the security services it provides, he can remain virtually invulnerable to fraudsters. The second place was taken by the Yandex.Money system, the third by PayPal (this system is ideal for legal entities for its significant legal transparency of payments), and the last place was awarded to the E-Port system.
In addition, summing up the analysis of payment systems, we can say that the choice of an electronic payment system is not carried out according to one security parameter, even if it is one of the most important. Electronic payment systems also differ in the availability of services, ease of use - there are many other factors.
conclusions
Electronic payments are a natural stage in the development of telecommunications. Demand is high in those niches where there is a full-fledged product - a digital product, whose properties are well “overlaid” with the properties of online payment: instant payment, instant delivery, simplicity and brandlessness.
Internet payment system is a system for conducting payments between financial, business organizations and Internet users in the process of buying/selling goods and services via the Internet. It is the payment system that allows you to turn an order processing service or an electronic storefront into a full-fledged store with all the standard attributes: by selecting a product or service on the seller’s website, the buyer can make a payment without leaving the computer.
In an e-commerce system, payments are made subject to a number of conditions:
1. Maintaining confidentiality. When making payments via the Internet, the buyer wants his data (for example, credit card number) to be known only to organizations that have the legal right to do so.
2. Maintaining the integrity of information. Purchase information cannot be changed by anyone.
3. Authentication. Buyers and sellers must be confident that all parties involved in a transaction are who they say they are.
4. Means of payment. Possibility of payment using any means of payment available to the buyer.
6. Seller's risk guarantees. When trading on the Internet, the seller is exposed to many risks associated with product refusals and buyer dishonesty. The magnitude of the risks must be agreed upon with the payment system provider and other organizations included in the trading chain through special agreements.
7. Minimizing transaction fees. Transaction processing fees for ordering and paying for goods are naturally included in their price, so lowering the transaction price increases competitiveness. It is important to note that the transaction must be paid in any case, even if the buyer refuses the goods.
All these conditions must be implemented in the Internet payment system, which, in essence, are electronic versions of traditional payment systems.
Thus, all payment systems are divided into:
Debit (working with electronic checks and digital cash);
Credit (working with credit cards).
Debit systems
Debit payment schemes are built similarly to their offline prototypes: check and regular money. The scheme involves two independent parties: issuers and users. The issuer is understood as the entity that manages the payment system. It issues some electronic units that represent payments (for example, money in bank accounts). System users perform two main functions. They make and accept payments on the Internet using issued electronic units.
Electronic checks are analogous to regular paper checks. These are the payer's instructions to his bank to transfer money from his account to the payee's account. The operation occurs upon presentation by the recipient of the check at the bank. There are two main differences here. Firstly, when writing a paper check, the payer puts his real signature, and in the online version - an electronic signature. Secondly, the checks themselves are issued electronically.
Payments are made in several stages:
1. The payer issues an electronic check, signs it with an electronic signature and forwards it to the recipient. To ensure greater reliability and security, the checking account number can be encrypted with the bank's public key.
2. The check is presented for payment to the payment system. Next, (either here or at the bank serving the recipient) a check takes place electronic signature.
3. If its authenticity is confirmed, the goods are delivered or the service is provided. Money is transferred from the payer's account to the recipient's account.
The simplicity of the payment scheme (Fig. 43), unfortunately, is offset by the difficulties of its implementation due to the fact that check schemes have not yet become widespread and there are no certification centers for the implementation of electronic signatures.
An electronic digital signature (EDS) uses a public key encryption system. This creates a private key for signing and a public key for verification. The private key is stored by the user, and the public key can be accessed by everyone. The most convenient way to distribute public keys is to use certification authorities. Digital certificates containing the public key and information about the owner are stored there. This frees the user from the obligation to distribute his public key himself. In addition, certificate authorities provide authentication to ensure that no one can generate keys on behalf of another person.
Electronic money completely simulates real money. At the same time, the issuing organization - the issuer - issues their electronic analogues, called differently in different systems (for example, coupons). Next, they are purchased by users, who use them to pay for purchases, and then the seller redeems them from the issuer. When issued, each monetary unit is certified by an electronic seal, which is verified by the issuing structure before redemption.
One of the features of physical money is its anonymity, that is, it does not indicate who used it and when. Some systems, by analogy, allow the buyer to receive electronic cash in such a way that the connection between him and the money cannot be determined. This is done using a blind signature scheme.
It is also worth noting that when using electronic money There is no need for authentication, since the system is based on the release of money into circulation before its use.
Figure 44 shows a payment scheme using electronic money.
The payment mechanism is as follows:
1. The buyer exchanges real money for electronic money in advance. Storing cash with the client can be carried out in two ways, which is determined by the system used:
On your computer's hard drive;
On smart cards.
Different systems offer different exchange schemes. Some open special accounts to which funds from the buyer’s account are transferred in exchange for electronic bills. Some banks may issue electronic cash themselves. At the same time, it is issued only at the request of the client, followed by its transfer to the computer or card of this client and the withdrawal of the cash equivalent from his account. When implementing a blind signature, the buyer himself creates electronic bills, sends them to the bank, where, when real money arrives in the account, they are certified by a seal and sent back to the client.
Along with the convenience of such storage, it also has disadvantages. Damage to a disk or smart card results in irreversible loss of electronic money.
2. The buyer transfers electronic money for the purchase to the seller’s server.
3. The money is presented to the issuer, who verifies its authenticity.
4. If the electronic bills are genuine, the seller’s account is increased by the purchase amount, and the goods are shipped to the buyer or the service is provided.
One of the important distinguishing features of electronic money is the ability to make micropayments. This is due to the fact that the denomination of the banknotes may not correspond to real coins (for example, 37 kopecks).
Both banks and non-banking organizations can issue electronic cash. However, it has not yet been developed one system converting different types of electronic money. Therefore, only the issuers themselves can redeem the electronic cash they issued. In addition, the use of such money from non-financial structures is not guaranteed by the state. However, the low transaction cost makes electronic cash an attractive tool for online payments.
Credit systems
Internet credit systems are analogues of conventional systems that work with credit cards. The difference is that all transactions are carried out via the Internet, and as a result, the need for additional security and authentication measures.
The following are involved in making payments via the Internet using credit cards:
1. Buyer. A client with a computer with a Web browser and Internet access.
2. Issuing bank. The buyer's bank account is located here. The issuing bank issues cards and is the guarantor of the client’s financial obligations.
3. Sellers. Sellers are understood as E-Commerce servers where catalogs of goods and services are maintained and customer purchase orders are accepted.
4. Acquiring banks. Banks serving sellers. Each seller has a single bank in which he keeps his current account.
5. Internet payment system. Electronic components that act as intermediaries between other participants.
6. Traditional payment system. A set of financial and technological means for servicing cards of this type. Among the main tasks solved by the payment system is ensuring the use of cards as a means of payment for goods and services, using banking services, conducting mutual offsets, etc. Participants in the payment system are individuals and legal entities united through the use of credit cards.
7. Payment system processing center. An organization that provides information and technological interaction between participants in the traditional payment system.
8. Settlement bank of the payment system. A credit organization that carries out mutual settlements between payment system participants on behalf of the processing center.
The general payment scheme in such a system is shown in Figure 45.
1. The buyer in the electronic store creates a basket of goods and selects the payment method “credit card”.
Through the store, that is, the card parameters are entered directly on the store’s website, after which they are transferred to the Internet payment system (2a);
On the payment system server (2b).
The advantages of the second way are obvious. In this case, information about the cards does not remain in the store, and, accordingly, the risk of receiving them by third parties or being deceived by the seller is reduced. In both cases, when transferring credit card details, there is still a possibility of them being intercepted by attackers on the network. To prevent this, data is encrypted during transmission.
Encryption, naturally, reduces the possibility of data interception on the network, so it is advisable to carry out communications between buyer/seller, seller/Internet payment system, buyer/Internet payment system using secure protocols. The most common of them today are the SSL (Secure Sockets Layer) protocol, as well as the SET (Secure Electronic Transaction) standard, designed to eventually replace SSL when processing transactions related to payments for credit card purchases on the Internet.
3. The Internet payment system transmits an authorization request to the traditional payment system.
4. The next step depends on whether the issuing bank maintains an online database of accounts. If there is a database, the processing center sends the issuing bank a request for card authorization (see introduction or dictionary) (4a) and then (4b) receives its result. If there is no such database, then the processing center itself stores information about the status of cardholders’ accounts, stop lists and fulfills authorization requests. This information is regularly updated by the issuing banks.
The store provides a service or ships goods (8a);
The processing center transmits information about the completed transaction to the settlement bank (8b). Money from the buyer's account with the issuing bank is transferred through the settlement bank to the store's account with the acquiring bank.
To make such payments in most cases you need a special software. It can be supplied to the buyer (called an electronic wallet), the seller and his servicing bank.
Introduction
1. Electronic payment systems and their classification
1.1 Basic concepts
1.2 Classification of electronic payment systems
1.3 Analysis of the main electronic payment systems used in Russia
2. Security measures for electronic payment systems
2.1 Threats associated with the use of electronic payment systems
2.2 Technologies for protecting electronic payment systems
2.3 Analysis of technologies for compliance basic requirements to electronic payment systems
Conclusion
Bibliography
INTRODUCTION
A highly specialized topic of electronic payments and electronic money that was of little interest to few people 10 years ago has recently become relevant not only for businessmen, but also for end users. Probably every second person who even occasionally reads the computer or popular press knows the fashionable words “e-business” and “e-commerce”. The task of remote payment (transferring money over long distances) has moved from the special category to everyday. However, the abundance of information on this issue does not at all contribute to clarity in the minds of citizens. Both due to the complexity and conceptual lack of development of the problem of electronic payments, and due to the fact that many popularizers often work on the principle of a broken telephone, at the everyday level, everything, of course, is clear to everyone. But this is until the time comes for the practical development of electronic payments. This is where there is a lack of understanding of how appropriate the use of electronic payments is in certain cases.
Meanwhile, the task of accepting electronic payments is becoming increasingly important for those who are going to engage in commerce using the Internet, as well as for those who are going to make purchases via the Internet. This article is intended for both.
The main problem when considering electronic payment systems for a beginner is the diversity of their design and operating principles and the fact that, despite the external similarity of the implementation, quite different technological and financial mechanisms can be hidden in their depths.
The rapid development of the popularity of the global Internet has led to a powerful impetus for the development of new approaches and solutions in various areas of the world economy. Even such conservative systems as electronic payment systems in banks have succumbed to new trends. This was reflected in the emergence and development of new payment systems - electronic payment systems via the Internet, the main advantage of which is that clients can make payments (financial transactions), bypassing the grueling and sometimes technically difficult stage of physically transporting a payment order to the bank. Banks and banking institutions are also interested in implementing these systems, as they can increase the speed of customer service and reduce overhead costs for making payments.
Electronic payment systems circulate information, including confidential information, which requires protection from viewing, modification and imposition of false information. Developing appropriate Internet-centric security technologies is currently a major challenge. The reason for this is that the architecture, core resources and technologies Internet networks focused on organizing access or collection open information. However, recently approaches and solutions have appeared that indicate the possibility of using standard Internet technologies in building systems for secure transmission of information via the Internet.
The purpose of the RGR is to analyze electronic payment systems and develop recommendations for the use of each of them. Based on the goal, the following stages of performing the RGR are formulated:
1. Determine the main tasks of electronic payment systems and the principles of their functioning, their features.
2. Analyze the main electronic payment systems.
3. Analyze the threats associated with the use of electronic money.
4. Analyze security measures when using electronic payment systems.
1. ELECTRONIC PAYMENT SYSTEMS AND THEIR CLASSIFICATION
1.1 Basic concepts
Electronic payments. Let's start with the fact that it is legitimate to talk about the emergence of electronic payments as a type of non-cash payments in the second half of the twentieth century. In other words, the transfer of information about payments by wire has existed for a long time, but acquired a fundamentally new quality when computers appeared at both ends of the wires. Information was transmitted using telex, teletype, and computer networks that appeared at that time. A qualitatively new leap was expressed in the fact that the speed of payments has increased significantly and the possibility of their automatic processing has become available.
Subsequently, electronic equivalents of other types of payments also emerged - cash payments and other means of payment (for example, checks).
Electronic payment systems (EPS). We call an electronic payment system any complex of specific hardware and software, allowing for electronic payments.
Exist various ways and communication channels for access to EPS. Today, the most common of these channels is the Internet. The spread of EPS is increasing, access to which is carried out using mobile phone(via SMS, WAP and other protocols). Other methods are less common: by modem, by touch-tone telephone, by telephone through an operator.
Electronic money. Vague term. If you carefully consider what lies behind it, it is easy to understand that electronic money is an incorrect name for “electronic cash”, as well as electronic payment systems as such.
This misunderstanding in terminology is due to the freedom of translation of terms from English. Since electronic payments in Russia developed much more slowly than in Europe and America, we were forced to use firmly established terms. Of course, such names of electronic cash as “digital cash” (e-cash), “digital money”, “electronic cash” (digital cash)2 have a right to life.
In general, the term “electronic money” does not mean anything specific, so in the future we will try to avoid using it.
Electronic cash:
This is a technology that appeared in the 90s of the last century, allowing for electronic payments that are not directly tied to the transfer of money from account to account in a bank or other financial organization, that is, directly between persons - the final participants in the payment. Another important property of electronic cash is the anonymity of payments it provides. The authorization center that certifies the payment does not have information about who specifically transferred the money and to whom.
Electronic cash is one of the types of electronic payments. A unit of electronic cash is nothing more than a financial obligation of the issuer (bank or other financial institution), essentially similar to a regular bill of exchange. Payments using electronic cash appear where it becomes inconvenient to use other payment systems. A clear example is the reluctance of a buyer to provide information about his credit card when paying for goods on the Internet.
Having decided on the terminology, we can move on to the next stage of our conversation - let's talk about the classification of EPS. Since EPS mediate electronic payments, the division of EPS is based on different types of these payments.
In addition, the software and/or hardware technology on which the EPS mechanism is based plays a very important role in this matter.
1.2 Classification of electronic payment systems
Electronic payment systems can be classified based both on the specifics of electronic payments and on the basis of the specific technology underlying the electronic payment system.
Classification of EPS depending on the type of electronic payments:
1. According to the composition of payment participants (Table 1).
Table 1
| Type of electronic payments | Parties of payment | Analogue in the traditional cash settlement system | EPS example |
| Bank-to-bank payments | Financial institutions | no analogues | |
| B2B payments | Legal entities | Cashless payments between organizations | |
| С2B payments | End consumers of goods and services and legal entities - sellers | Cash and non-cash payments from buyers to sellers | Credit pilot |
| C2C payments | Individuals | Direct cash payments between individuals, postal and telegraphic transfers |
We will not further consider those electronic payment systems that are designed to serve electronic payments of the “bank-to-bank” type. Such systems are extremely complex, they affect to a greater extent the technological aspects of the functioning of the banking system, and they are most likely of no interest to the broad masses of our readers.
Additionally, it should be noted that there is another type of payment that logically does not quite fit into Table 1. According to formal criteria, it completely falls into the C2B area, but nevertheless cannot be provided by means of widespread EPS of this type. Micropayments are characterized by extremely small (cents or fractions of a cent) cost of goods. The most characteristic of all popular articles An example of a system that implements micropayments is the sale of jokes (for a cent per piece). Systems such as Eaccess and Phonepay are suitable for making micropayments.
2. By type of operations performed (Table 2).
table 2
| Type of electronic payments | Where are they used? | EPS example |
| Bank account management operations | "Client bank" systems with access via modem, Internet, mobile phone, etc. | Operations for managing a bank account of the Client System |
| Money transfer operations without opening a bank account | Money transfer systems computer networks, similar to postal and telegraphic transfers | |
| Transactions with card bank accounts | Debit and credit plastic cards | Cyberplat (Cyberpos) |
| Transactions with electronic checks and other non-cash payment obligations | Closed systems of intercorporate payments | Cyberplat (Cybercheck) |
| Transactions with electronic (quasi) cash | Calculations with physical persons, electronic analogues of tokens and prepaid cards used as money surrogates for paying for goods |
It should be noted that systems of the “client - bank” type have been known for quite a long time. You could access your bank account using a modem. Over the past decade, new opportunities have emerged to manage your account using the Internet, through a user-friendly web interface. This service was called “Internet banking” and did not introduce anything fundamentally new into payment systems of the “client-bank” type. In addition, there are other options for accessing a bank account, for example, using a mobile phone (WAP banking, SMS banking). In this regard, in this article we will not specifically dwell on this kind of EPS; we will only note that currently in Russia about 100 commercial banks provide Internet banking services, using more than 10 different EPS.
Classification of EPS depending on the technology used:
One of the most important qualities of EPS is its resistance to burglary. This is perhaps the most discussed characteristic of such systems. As can be seen from Table 3, when solving the problem of system security, most approaches to building an electronic security system are based on the secrecy of a certain central database containing critical information. At the same time, some of them add to this secret base These additional levels of protection are based on the durability of the hardware.
In principle, there are other technologies on the basis of which EPS can be built. For example, not long ago there was a report in the media about the development of an EPS based on CDR disks built into a plastic card. However similar systems are not widely used in world practice, and therefore we will not focus on them.
Table 3
| Technology | What is the stability of the system based on? | EPS example |
| Systems with a central server client bank, funds transfer | Secrecy of access keys | Telebank (Guta-bank), "Internet Service Bank" (Avtobank) |
| Smart cards | Hardware resistance of smart cards to hacking | Mondex, ACCORD |
| Magnetic cards and virtual credit cards | Assist, Elite |
|
| Scratch cards | Secrecy of the database with scratch card numbers and codes | E-port, Creditpilot, Webmoney, Paycash, Rapira |
| File/wallet in the form of a program on the user’s computer | Cryptographic strength of the information exchange protocol | |
| Paid phone call | Secrecy of the central database with pin codes and hardware stability of the smart telephone network | Eaccess, Phonepay |
1.3 Analysis of the main electronic payment systems used in Russia
Currently, quite a lot of electronic payment systems are used on the Russian Internet, although not all of them are widely used. It is characteristic that almost all Western payment systems used on the RuNet are linked to credit cards. Some of them, for example, PayPal, officially refuse to work with clients from Russia. The most widely used systems today are:
CyberPlat refers to mixed type systems (from the point of view of any of the above classifications). In fact, we can say that within this system, three separate ones are collected under one roof: the classic “client-bank” system, which allows clients to manage accounts opened with banks participating in the system (11 Russian banks and 1 Latvian); CyberCheck system, which allows you to make secure payments between legal entities connected to the system; and an Internet acquiring system, that is, processing payments accepted from credit cards - CyberPos. Among all Internet acquiring systems available on the Russian market, CyberPlat provides processing of the largest number of types of credit cards, namely: Visa, Mastercard/Eurocard, American Express7, Diners Club, JCB, Union Card; it has announced its imminent connection to the STB-card system and ACCORD card/Bashcard. Unofficially, company employees claimed that they were exploring the possibility of interfacing with other Russian card systems. In addition to the above, the CyberPlat company provides processing of scratch cards of the E-port payment system and announced the upcoming commissioning of a gateway with the Paycash system.
Currently, to increase the level of protection against payments from stolen credit cards, the company is developing specialized PalPay technology, which allows the seller to check whether the buyer really has access to the bank account associated with the credit card or only knows its details. The introduction of this technology into operation has not yet been officially announced.
The CyberCheck system is of great interest for organizing work with corporate partners. Its main feature (compared to accepting payments by credit cards) is the impossibility of the payer refusing to make a payment after the fact. In other words, receiving payment confirmation from CyberCheck is as reliable as receiving such confirmation from the bank where the merchant's account is located. All these characteristics make CyberPlat perhaps the most advanced and interesting for EPS sellers on the Russian Internet.
The Assist system in terms of processing payments from credit cards is in many ways a functional analogue of CyberPlat. In Moscow, its interests are represented by Alfa Bank. A total of 5 banks are connected to the system. The Internet acquiring subsystem allows you to accept payments from Visa, Mastercard/Eurocard, STB-card. As of September, payments from other card systems declared on the Assist system server were not actually accepted. However, according to unofficial information, in the near future it will be possible to accept Diners Club cards, Cirrus Maestro and Visa Electron debit cards. Interestingly, this type of card is usually not accepted by acquiring companies, but due to its low cost, these cards are very common. Typically, refusal to accept debit cards is motivated by security concerns. Perhaps ASSIST will be able to get around this problem by using the SET protocol, the support of which was announced by the company just the other day. Unlike the traditional method of paying with plastic cards on the Internet, which allows the card owner to refuse the payment made from it (charge-back), the SET protocol guarantees the authenticity of the transaction, significantly reducing the risk for the seller.
The method of settlements using electronic certificates purchased from an Internet provider, announced on the Assist website, is quite interesting as it opens up new lines of business for providers, however, according to available information, due to legal difficulties, until recently it was not actually used by anyone. However, again according to unofficial information, this state of affairs will soon change - already in the fall of 2001 we may see the first practical implementation of this method of calculation.
In addition to the CyberPlat and Assist card systems mentioned in the descriptions, there are others that have gained some popularity in the market. Discover/NOVUS is widely distributed in North America and may be of interest to those electronic stores that serve a Western audience. We are not aware of any domestic acquiring companies that would process cards of this system, but there are a number of proposals from intermediaries representing the interests of Western acquirers. Among the Russian card systems, after STB and Union Card, the most noticeable on the market are Zolotaya Korona, Sbercard (Sberbank), Universal Card and ICB-card (Promstroybank), as well as the already mentioned ACCORD card/Bashcard . "ICB-card" is processed by a couple of small acquiring companies, the acceptance of payments via the Internet from Zolotaya Korona and Sbercard cards is supposedly provided directly by issuers and/or related companies, and in the case of Universal Card, it does not seem to be provided by anyone.
Paycash and Webmoney are positioned by their developers as electronic cash systems, but upon closer examination, only Paycash can rightfully claim such status.
The development of Paycash was initiated by the Tavrichesky Bank, but currently other banks are connected to the system, for example, Guta Bank.
From a technological point of view, Paycash provides an almost complete imitation of cash payments. From one electronic wallet (a specialized program installed by the client on his computer), money can be transferred to another, while ensuring the anonymity of the payment in relation to the bank. The system has become quite widespread in Russia and is currently making attempts to enter the world market.
The bottleneck of Paycash is the procedure for transferring money to an electronic wallet. Until recently the only way to do this was to go to a bank branch and transfer money to the system account. True, there were alternatives - for users of the Guta Bank Telebank system, it was possible to transfer money from an account at Guta Bank without leaving home, but in some cases, apparently, it was easier to transfer them directly to the seller’s account - electronic store without using Paycash as an intermediary. It was also possible to transfer money via Western Union or postal/wire transfer, but the attractiveness of this route was limited by the high level of fees. For residents of St. Petersburg, there is a very exotic opportunity - to call a courier to your home for money. Wonderful, but, alas, not all of us live in the Northern capital.
It is still not possible to transfer money to Paycash from credit cards. This is due to the fact that companies that support the operation of card systems provide their clients with the opportunity of the so-called “charge back” - refusal to make a payment “retrospectively”. "Charge back" is a mechanism that protects the owner of a credit card from fraudsters who can use its details. In the event of such a refusal, the burden of proof falls on the seller that the goods were actually delivered to the real cardholder and that payment should be made. But in the case of Paycash, this kind of proof is basically impossible - for quite obvious reasons. The above-mentioned gateway with CyberPlat, which is under development, is also intended to solve this problem.
In the meantime, to unpack this bottleneck in the system, PayCash made two fairly reasonable moves - it issued prepaid scratch cards and provided payment acceptance through the Contact transfer system, whose rates are significantly lower than postal rates (2.2% versus 8%).
The Webmoney system is one of the “pioneers” in the electronic payment market in Russia. Currently it has an international character. According to some information, Webmoney has representatives not only in the republics of the former USSR, but also in foreign countries. The system operator is the autonomous non-profit organization "VM Center".
The operating mode of Webmoney is very similar to working with electronic cash, only a careful and meticulous analysis makes it possible to make sure that in fact Webmoney does not provide complete anonymity of payments, that is, they are not hidden from the owners of the system themselves. However, the practice of Webmoney has shown that this property is rather beneficial, allowing in some cases to combat fraud. Moreover, as a separate paid service, VM Center offers certification of legal entities and individuals, which naturally deprives him of anonymity in relation to other participants in the system. This opportunity is necessary primarily for those who want to organize an honest electronic store and intend to convince potential buyers of their reliability. Webmoney allows you to open accounts and transfer funds in two currencies: rubles and dollars.
To access the system, the “electronic wallet” program is used. Additional features of the system are the transfer of short messages from wallet to wallet, as well as credit transactions between wallet owners. However, in our opinion, few people will agree to lend to anonymous people via the Internet without the ability to forcibly collect the loan in case of non-repayment.
Unlike Paycash, Webmoney initially provided the ability to both transfer regular cash to a wallet and cash out the contents of wallets without the tedious procedures of filling out payment orders at the bank, but in a rather strange, from a legal point of view, way. In general, the legal support of Webmoney in terms of its work with organizations has long caused many complaints.
This was the reason that while end users were actively installing “wallets” for themselves, many electronic stores refused to use this EPS. True, at present this situation has somewhat improved, and the active marketing position of Webmoney owners leads to the fact that the image of the system is constantly improving. One of interesting features This marketing strategy was that almost immediately after its entry into the market, everyone was given the opportunity to make money in this system (some may remember the “Nails” project and its later development - visiting.ru). Just like Paycash, Webmoney issues prepaid scratch cards designed for depositing money into the system.
Two systems based on scratch cards: E-port (Avtokard-holding) and KreditPilot (Kreditpilot.com), are like twin brothers. Both assume that the buyer will first buy a scratch card with a secret code somewhere in a wide distribution network or by ordering it by courier at home, and then begin to pay online using this code with stores that accept payments from these systems. E-port additionally offers the possibility of creating “virtual” scratch cards by transferring money to the company’s account through a bank or through the “Webmoney” system.
The Rapida system, which began operating in September 2001, just like the previous two, offers depositing money into the user’s account through scratch cards or payment at a bank participating in the system. Additionally, the possibility of working in the “Client-Bank” mode and transferring money to the accounts of legal entities that are not participants in the system, as well as to individuals without opening a bank account, is stated. Access to the system is provided not only via the Internet, but also by telephone using tone dialing. In general, the system looks technologically advanced and very interesting, but so far not enough time has passed since its launch into operation to be able to talk about the prospects.
EPS, which allow payment to be made in the same way as for long-distance calls (after the fact, based on an invoice from the telephone company), first appeared in the United States and were intended to pay for access to pornographic resources. However, due to the systematic fraudulent actions of many owners of such systems, they did not gain popularity among buyers, and sellers were not particularly happy with them, since these systems tended to significantly delay payments.
Two domestic implementations of a similar concept - Phonepay and Eaccess - are at the very beginning of their journey. Both systems assume that in order to make a payment, the client must make a call to a certain long-distance number in the code 8-809 (provided, apparently, by the MTU-inform company), after which some key information will be dictated to him by the robot. In the case of Eaccess, this is a pin code used to access a paid information resource, and in the case of Phonepay, it is a universal “digital coin” consisting of 12 digits of one of the five denominations hard-coded in the system. Looking at the systems’ websites, it can be noted that e -access is still gradually developing, increasing the number of stores connected to the system, but Phonepay has not connected a single store that does not belong to the developers to its system.
In my opinion, such systems in Russia have very definite prospects related to the ease of access to them by the end user, however, the scope of their application will be limited to sales information resources. The long delay in receiving payments (the system will transfer them to the store no earlier than the buyer pays the telephone bill) makes trading in material assets using these EPS a rather unprofitable activity.
Finally, another type of electronic transfer system should be mentioned - specialized systems of transfers between individuals, competing with traditional postal and telegraphic transfers. The first to occupy this niche were such foreign systems as Western Union and Money Gram. Compared to traditional transfers, they provide greater speed and reliability of payment. At the same time, they have a number of significant disadvantages, the main one of which is the high cost of their services, reaching up to 10% of the transfer amount. Another problem is that these systems cannot be used legally to systematically accept payments for goods. However, for those who simply want to send money to family and friends, it makes sense to turn their attention to these systems, as well as their domestic analogues(Anelik and Contact). So far, neither Paycash nor Webmoney are able to compete with them, since it is not possible to receive cash by pulling it out of an electronic wallet somewhere in Australia or Germany. The Rapida EPS claims this possibility, but so far there are no details on the website, and the geography of the system’s offices cannot be compared with systems already available on the market.
Owners of electronic stores, apparently, should think first of all about accepting money from credit cards and electronic cash systems - Webmoney and Paycash. Based on the totality of consumer characteristics, in our opinion, none of the systems available on the Russian market for accepting payments from credit cards can compete with CyberPlat. All other systems are subject to optional use, especially if you remember that the same E-port does not have to be installed separately, since its cards are serviced by CyberPlat.
2. PROTECTION MEANS FOR ELECTRONIC PAYMENT SYSTEMS
2.1 Threats associated with the use of electronic payment systems
Let's consider possible threats destructive actions of an attacker in relation to this system. To do this, let’s look at the main targets of an attacker’s attack. The main target of an attacker is financial assets, or rather their electronic substitutes (surrogates) - payment orders circulating in the payment system. In relation to these tools, an attacker can pursue the following goals:
1. Theft of financial assets.
2. Introduction of counterfeit financial assets (violation of the financial balance of the system).
3. System malfunction ( technical threat).
The specified objects and targets of the attack are abstract in nature and do not allow for the analysis and development of the necessary measures to protect information, therefore Table 4 provides a specification of the objects and targets of the attacker’s destructive effects.
Table 4 Model of possible destructive actions of an attacker
| Object of influence | Purpose of influence | Possible mechanisms for implementing the impact. |
| HTML pages on the bank's web server | Substitution for the purpose of obtaining information entered into a payment order by the client. | Attack on the server and substitution of pages on the server. Substitution of pages in traffic. Attack on the client’s computer and substitution of the client’s pages |
| Client information pages on the server | Obtaining information about client(s) payments | Attack on the server. Traffic attack. Attack on the client's computer. |
| Payment order data entered by the client into the form | Receiving information entered into the payment order by the client. | Attack on the client’s computer (viruses, etc.). An attack on these instructions when they are sent through traffic. Attack on the server. |
| Private client information located on the client’s computer and not related to the electronic payment system | Obtaining confidential client information. Modification of client information. Disabling the client's computer. | The whole complex known attacks to a computer connected to the Internet. Additional attacks that arise as a result of the use of payment system mechanisms. |
| Information from the bank's processing center. | Disclosure and modification of processing center information and local network jar. | Attack on a local network connected to the Internet. |
This table shows the basic requirements that any electronic payment system via the Internet must satisfy:
Firstly, the system must ensure the protection of payment order data from unauthorized changes and modifications.
Secondly, the system should not increase the attacker’s ability to organize attacks on the client’s computer.
Thirdly, the system must protect data located on the server from unauthorized reading and modification.
Fourthly, the system must provide or support a system for protecting the bank’s local network from influence from the global network.
During the development of specific electronic payment information protection systems, this model and the requirements must be subject to further detail. However, such detail is not required for the current presentation.
2.2 Technologies for protecting electronic payment systems
For some time, the development of WWW was hampered by the fact that html pages, which are the basis of WWW, are static text, i.e. with their help it is difficult to organize an interactive exchange of information between the user and the server. Developers proposed many ways to extend HTML's capabilities in this direction, many of which were never widely adopted. One of the most powerful solutions that represented a new stage in the development of the Internet was Sun's proposal to use Java applets as interactive components connected to HTML pages.
A Java applet is a program that is written in the Java programming language and compiled into special bytecodes, which are the codes of some virtual computer - a Java machine - and are different from the codes of Intel family processors. Applets are hosted on a server on the Internet and downloaded to the user’s computer whenever an HTML page is accessed that contains a call to this applet.
To execute applet code, a standard browser includes an implementation of a Java engine that interprets the bytecodes into machine instructions on an Intel family of processors (or another family of processors). The capabilities inherent in Java applet technology, on the one hand, allow you to develop powerful user interfaces, organize access to any network resources via URL, easily use TCP/IP, FTP, etc. protocols, but, on the other hand, they make it impossible to access directly computer resources. For example, applets do not have access to file system computer and connected devices.
A similar solution to expand the capabilities of the WWW is Microsoft's technology - Active X. The most significant differences between this technology and Java is that components (analogues of applets) are programs in code Intel processor and the fact that these components have access to all computer resources, as well as Windows interfaces and services.
Another less common approach to extending the capabilities of the WWW is that of Netscape's Plug-in for Netscape Navigator technology. It is this technology that seems to be the most optimal basis for building information security systems for electronic payments via the Internet. For further discussion, let's look at how this technology solves the problem of protecting Web server information.
Let's assume that there is some Web server and the administrator of this server it is required to restrict access to some part of the server's information array, i.e. organize so that some users have access to some information, but others do not.
Currently, a number of approaches are proposed to solve this problem, in particular, many OS, under which the Internet servers operate, require a password to access some of their areas, i.e. require authentication. This approach has two significant drawbacks: firstly, the data is stored on the server itself in clear text, and secondly, the data is transmitted over the network also in clear text. Thus, an attacker has the opportunity to organize two attacks: on the server itself (password guessing, password bypass, etc.) and an attack on traffic. Facts of such attacks are widely known to the Internet community.
Another well-known approach to solving the problem of information security is the approach based on SSL (Secure Sockets Layer) technology. When using SSL, a secure communication channel is established between the client and the server through which data is transferred, i.e. The problem of transmitting data in clear text over the network can be considered relatively solved. The main problem with SSL is the construction of the key system and control over it. As for the problem of storing data on the server in clear form, it remains unresolved.
Another important disadvantage of the approaches described above is the need for their support from both the server and network client software, which is not always possible or convenient. Especially in systems aimed at mass and unorganized clients.
The approach proposed by the author is based on protecting html pages themselves, which are the main carrier of information on the Internet. The essence of the protection is that files containing HTML pages are stored on the server in encrypted form. In this case, the key with which they are encrypted is known only to the person who encrypted it (the administrator) and clients (in general, the problem of building a key system is solved in the same way as in the case of transparent file encryption).
Clients access secure information using Netscape's Plug-in for Netscape technology. These modules are programs, more precisely software components, which are associated with certain file types in the MIME standard. MIME is an international standard that defines file formats on the Internet. For example, the following file types exist: text/html, text/plane, image/jpg, image/bmp, etc. In addition, the standard defines a mechanism for setting custom types files that can be defined and used by independent developers.
So, plug-ins are used that are associated with specific MIME file types. The connection is that when the user accesses files of the corresponding type, the browser launches the Plug-in associated with it and this module performs all the actions to visualize the file data and process the user’s actions with these files.
The most well-known plug-in modules include modules that play videos in avi format. Viewing these files is not included in the standard capabilities of browsers, but by installing the appropriate Plug-in you can easily view these files in the browser.
Further, all encrypted files are defined as MIME type files in accordance with the established international standard. "application/x-shp". A Plug-in is then developed using Netscape technology and protocols to associate with the file type. This module performs two functions: firstly, it asks for a password and user ID, and secondly, it does the work of decrypting and outputting the file to the browser window. This module is installed in accordance with the standard order established by Netscape on the browsers of all client computers.
At this point, the preparatory stage of work is completed and the system is ready for operation. During operation, clients access encrypted HTML pages using their standard address (URL). The browser determines the type of these pages and automatically launches the module we developed, transferring to it the contents of the encrypted file. The module authenticates the client and, upon successful completion, decrypts and displays the contents of the page.
When performing this entire procedure, the client gets the feeling of “transparent” encryption of pages, since all the work of the system described above is hidden from his eyes. At the same time, all standard features inherent in html pages, such as the use of pictures, Java applets, CGI scripts, are preserved.
It is easy to see that this approach solves many information security problems, because in open form it is located only on clients’ computers; data is transmitted over the network in encrypted form. An attacker, pursuing the goal of obtaining information, can only carry out an attack on a specific user, and no server information security system can protect against this attack.
Currently, the author has developed two information security systems based on the proposed approach for the Netscape Navigator (3.x) browser and Netscape Communicator 4.x. During pre-test It was found that the developed systems can function normally under the control of MExplorer, but not in all cases.
It is important to note that these versions of systems do not encrypt objects associated with an HTML page: pictures, script applets, etc.
System 1 offers protection (encryption) of the actual html pages as a single object. You create a page and then encrypt it and copy it to the server. When accessing an encrypted page, it is automatically decrypted and displayed in a special window. Security system support is not required from the server software. All encryption and decryption work is carried out on the client's workstation. This system is universal, i.e. does not depend on the structure and purpose of the page.
System 2 offers a different approach to protection. This system ensures that protected information is displayed in some area of your page. The information is in an encrypted file (not necessarily in html format) on the server. When you go to your page, the security system automatically accesses this file, reads data from it and displays it in a certain area of the page. This approach allows you to achieve maximum efficiency and aesthetic beauty, with minimal versatility. Those. the system turns out to be oriented to a specific purpose.
This approach can also be applied when building electronic payment systems via the Internet. In this case, when accessing a certain page of the Web server, the Plug-in module is launched, which displays the payment order form to the user. After the client fills it out, the module encrypts the payment data and sends it to the server. At the same time, he may require an electronic signature from the user. Moreover, encryption and signature keys can be read from any media: floppy disks, electronic tablets, smart cards, etc.
2.3 Analysis of technologies for compliance with basic requirements for electronic payment systems
Above we described three technologies that can be used to build payment systems over the Internet: this is a technology based on Java applets, Active-X components and plug-in modules. Let's call them technologies J, AX and P, respectively.
Consider the requirement that an attacker's ability to attack a computer should not be increased. To do this, let's analyze one of the possible types of attacks - substitution of the corresponding client protection modules by an attacker. In the case of technology J, these are applets, in the case of AX, submersible components, in the case of P, these are plug-in modules. It is obvious that an attacker has the opportunity to replace the protection modules directly on the client’s computer. The mechanisms for implementing this attack are beyond the scope of this analysis; however, it should be noted that the implementation of this attack does not depend on the protection technology in question. And the security level of each technology is the same, i.e. they are all equally unstable to this attack.
The most vulnerable point in J and AX technologies, from the point of view of substitution, is their downloading from the Internet. It is at this moment that an attacker can carry out a substitution. Moreover, if an attacker manages to replace these modules on the bank’s server, then he gains access to all volumes of payment system information circulating on the Internet.
In the case of technology P, there is no danger of substitution, since the module is not downloaded from the network - it is permanently stored on the client’s computer.
The consequences of substitution are different: in the case of J-technology, an attacker can only steal the information entered by the client (which is a serious threat), and in the case of Active-X and Plug-in, an attacker can obtain any information to which the client running on the computer has access.
Currently, the author is not aware of specific methods for implementing Java applet spoofing attacks. Apparently these attacks are developing poorly, since the resulting opportunities for stealing information are practically absent. But attacks on Active-X components are widespread and well known.
Let's consider the requirement to protect information circulating in the electronic payment system via the Internet. It is obvious that in this case technology J is inferior to both P and AX in one very significant issue. All information security mechanisms are based on encryption or electronic signature, and all corresponding algorithms are based on cryptographic transformations that require the introduction of key elements. Currently, the length of key elements is on the order of 32-128 bytes, so requiring the user to enter them from the keyboard is almost impossible. The question arises: how to enter them? Since P and AX technologies have access to computer resources, the solution to this problem is obvious and well known - keys are read from local files, floppy disks, tablets or smart cards. But in the case of technology J, such input is impossible, which means you have to either require the client to enter a long sequence of meaningless information, or, by reducing the length of key elements, reduce the strength of cryptographic transformations and therefore reduce the reliability of security mechanisms. Moreover, this reduction is very significant.
Let's consider the requirement that the electronic payment system must organize the protection of data located on the server from unauthorized reading and modification. This requirement stems from the fact that the system involves placing confidential information intended for the user on the server. For example, a list of payment orders sent to him with a note about the processing results.
In the case of technology P, this information is presented in the form of HTML pages, which are encrypted and placed on the server. All actions are performed in accordance with the algorithm described above (encrypting HTML pages).
In the case of J and AX technologies, this information can be placed in some structured form in a file on the server, and components or applets must perform operations to read and visualize the data. All this generally leads to an increase in the total size of applets and components, and, consequently, to a decrease in the loading speed of the corresponding pages.
From the point of view of this requirement, technology P wins due to its greater manufacturability, i.e. lower development overhead, and greater resistance to substitution of components as they pass through the network.
As for the last requirement to protect the banking local network, it is fulfilled through the competent construction of a system of firewalls (firewalls) and does not depend on the technologies in question.
Thus, the above was carried out preliminary comparative analysis technologies J, AX and P, from which it follows that technology J should be used if maintaining the degree of security of the client’s computer is significantly more important than the strength of cryptographic transformations used in electronic payment systems.
Technology P seems to be the most optimal technological solution underlying payment information security systems, since it combines the power standard application Win32 and protection against attacks via the Internet. The practical and commercial implementation of projects using this technology is carried out, for example, by the Russian Financial Communications company.
As for AX technology, its use seems to be ineffective and unstable to attacks by intruders.
CONCLUSION
Electronic money is increasingly clearly beginning to become our everyday reality, which, at a minimum, must be taken into account. Of course, no one will abolish ordinary money in the next fifty years (probably). But not being able to manage electronic money and missing out on the opportunities that they bring with them means voluntarily erecting an “iron curtain” around oneself, which has been moved with such difficulty over the past fifteen years. Many large companies offer payment for their services and goods through electronic payments. This saves the consumer a lot of time.
Free software for opening your electronic wallet and for all work with money is maximally adapted for mass computers, and after a little practice does not cause any problems for the average user. Our time is the time of computers, the Internet and e-commerce. People who have knowledge in these areas and the appropriate tools achieve tremendous success. Electronic money is money that is becoming more widespread every day, opening up more and more opportunities for a person who has access to the Internet.
The purpose of the calculation and graphic work was to complete and solve the following tasks:
1. The main tasks of electronic payment systems and the principles of their functioning, their features are determined.
2. The main electronic payment systems are analyzed.
3. The threats associated with the use of electronic money are analyzed.
4. The means of protection when using electronic payment systems are analyzed.
BIBLIOGRAPHICAL LIST
1. Antonov N.G., Pessel M.A. Money circulation, credit and banks. -M.: Finstatinform, 2005, pp. 179-185.
2. Bank portfolio - 3. -M.: Somintek, 2005, pp. 288-328.
3. Mikhailov D.M. International payments and guarantees. M.: FBK-PRESS, 2008, pp. 20-66.
4. Polyakov V.P., Moskovkina L.A. Structure and functions of central banks. Foreign experience: Textbook. - M.: INFRA-M, 2006.
5. Gaikovich Yu.V., Pershin A.S. Security of electronic banking systems. - M: United Europe, 2004
6. Demin V.S. and others. Automated banking systems. - M: Menatep-Inform, 2007
7. Krysin V.A. Business safety. - M: Finance and Statistics, 2006
8. Linkov I.I. and others. Information divisions in commercial structures: how to survive and succeed. - M: NIT, 2008
9. Titorenko G.A. and others. Computerization of banking activities. - M: Finstatinform, 2007
10. Tushnolobov I.B., Urusov D.P., Yartsev V.I. Distributed networks. - St. Petersburg: Peter, 2008
12. Aglitsky I. State and prospects of information support for Russian banks. - Banking technologies, 2007 No. 1.
Tutoring
Need help studying a topic?
Our specialists will advise or provide tutoring services on topics that interest you.
Submit your application indicating the topic right now to find out about the possibility of obtaining a consultation.
3. Protection of electronic payments
The problem of bank security is especially acute, since bank information, firstly, it represents real money, and secondly, it affects the confidential interests of a large number of bank clients.
E-commerce market size in 2000
| Market size and characteristics | Estimate, dollars |
| Total cost of all Internet product purchases | 4.5-6 billion |
| Total cost of all purchases per average buyer | 600-800 |
| Cost of average purchase per Internet transaction | 25-35 |
| Full volume of Internet purchase transactions | 130-200 million |
| Share of online product purchases | 60-70% |
| Share of purchases of delivered goods | 30-40% |
General scheme of functioning of electronic payment systems
A bank that has entered into an agreement with the system and received the appropriate license can act in two capacities - as an issuer of payment instruments of this system, accepted for payment by all other participating banks, and as an acquiring bank, servicing enterprises that accept payment instruments of this system for payment, issued by other issuers, and accepting these means of payment for cashing in its branches.
The payment acceptance procedure is quite simple. First of all, the cashier of the enterprise must verify the authenticity of the card using the appropriate characteristics.
When paying, the company must transfer the client's card details to a special check using a copying machine - imprinter, enter the amount for which the purchase was made or services were provided into the check, and obtain the client's signature.
A check issued in this way is called a slip. In order to safely conduct transactions, the payment system recommends lower limits on amounts for various regions and types of business for which payments can be made without authorization. If the limit amount is exceeded or if there is doubt about the client’s identity, the company is obliged to carry out an authorization process.
Without dwelling on the technical aspects of the procedure, we point out that during authorization, the company actually gains access to information about the status of the client’s account and thus gets the opportunity to establish the ownership of the card by the client and his payment ability in the amount of the transaction. One copy of the slip remains with the company, the second is transferred to the client, the third is delivered to the acquiring bank and serves as the basis for reimbursement of the payment amount to the company from the client’s account.
In recent years, POS terminals have become widely popular, using which there is no need to fill out slips. The card details are read from the magnetic stripe on the reader built into the POS terminal, the transaction amount is entered from the keyboard, and the terminal, through the built-in modem, applies for authorization to the appropriate payment system. In this case, the technical capabilities of the processing center are used, the services of which are provided to the merchant by the bank. In this case, the company reports to the bank with a copy of the cash register tape with a sample of the client’s signature and batch files that the terminal generates at the close of the operating day.
In recent years, more and more attention has been drawn to banking systems using microprocessor cards.
Externally, these storage media are no different from ordinary cards, except for the memory chip or microprocessor soldered inside the card and the contact plate petals displayed on its surface.
The fundamental difference between these cards and all of the above is that they directly carry information about the client’s account status, since they themselves are a transit account. It is clear that each collection point for such cards must be equipped with a special POS terminal (with a chip reader).
In order to be able to use the card, the client must load it from his account at the bank terminal. All transactions are made in OFF-LINE mode during the dialogue card - terminal or client card - merchant card.
Such a system is almost completely safe due to the high degree of security of the chip and the full debit payment scheme. In addition, although the card itself is significantly more expensive than a regular one, the system during operation turns out to be even cheaper due to the fact that the OFF-LINE mode does not use the telecommunications load.
Electronic payments using plastic bank cards various types represent a fairly flexible and universal mechanism for settlements in the chain “Bank 1 - Client - Enterprise - Bank 2” and interbank settlements of the type “Bank 1 - ... - Bank N”. However, it is the versatility of these payment instruments that makes them a particularly attractive target for fraud. The annual cost of abuse-related losses amounts to a significant amount, although relatively small compared to total turnover.
The security system and its development cannot be considered in isolation from the methods of illegal transactions with plastic cards, which can be divided into 5 main types of crimes.
1. Operations with counterfeit cards.
This type of fraud accounts for the largest share of payment system losses. Due to the high technical and technological security of real cards, homemade cards are rarely used recently and can be identified using simple diagnostics.
As a rule, stolen card blanks are used for counterfeiting, on which the bank and client details are applied. Being technically highly equipped, criminals can even write information on the magnetic stripe of a card or copy it, in a word, perform counterfeiting at a high level.
The perpetrators of such actions are, as a rule, organized criminal groups, sometimes colluding with employees of issuing banks who have access to information about customer accounts and transaction procedures. Paying tribute to the international criminal community, it should be noted that counterfeit cards appeared in Russia almost simultaneously with the beginning of the development of this sector of the banking market.
2. Transactions with stolen/lost cards.
It is possible to cause major damage using a stolen card only if the fraudster knows the client’s PIN code. Then it becomes possible to withdraw a large amount from the client’s account through a network of electronic tellers - ATMs before the issuing bank of the stolen card has time to put it on the electronic stop list (list of invalid cards).
3. Multiple payments for services and goods for amounts not exceeding the “floor limit” and not requiring authorization. To make payments, the criminal only needs to forge the client’s signature. However, with this scheme, the most attractive object of abuse becomes inaccessible - cash. This category includes crimes involving cards stolen while being sent by the issuing bank to its clients by mail.
4. Mail/Telephone Order Fraud.
This type of crime appeared in connection with the development of the service for delivering goods and services by mail or telephone order of the client. Knowing the credit card number of his victim, the criminal can indicate it on the order form and, having received the order at the temporary place of residence, escape.
5. Multiple withdrawals from the account.
These crimes are usually committed by employees legal entity, accepting payment from a client for goods and services by credit card, and is carried out by issuing several payment checks for one payment fact. Based on the submitted checks, more money is credited to the company’s account than the cost of the goods sold or services provided. However, after completing a number of transactions, the criminal is forced to close or leave the enterprise.
To avoid such actions, card users are advised to be more attentive to the documents signed when making transactions (even for small amounts).
The methods used by security departments can be divided into two main categories. The first and, perhaps, the most important level is related to the technical security of the plastic card itself. Now we can say with confidence that from a technological point of view, the card is better protected than banknotes, and it is almost impossible to make it yourself without the use of sophisticated technologies.
Cards of any payment system meet strictly established standards. The map has a standard form. The bank's identification number in the system (BIN code) and the client's bank account number, his first and last name, the card's expiration date are embossed and placed in strictly established positions on the front side of the card. There is also a payment system symbol made in a holographic way. The last four digits of the card number are embossed (pressed in relief) directly onto the holographic symbol, making it impossible to copy the hologram or re-emboss the code without destroying the symbol.
On the back of the card there is a magnetic stripe and an area with a sample signature of the owner. The details of the payment system itself, security marks, symbols that prevent information from being copied are recorded on the magnetic strip in strictly defined positions and using cryptographic algorithms, and the information printed on the front side of the card is duplicated. The owner's signature sample area has a special coating. At the slightest attempt to make erasures or forward the signature, the coating is destroyed and a substrate of a different color appears with the security symbols of the payment system.
The remaining surface area of the card is entirely at the disposal of the issuing bank and is decorated in an arbitrary manner with the bank’s symbols, its advertising and information necessary for clients. The card itself is protected by characters that are only visible under ultraviolet light.
Technical protection measures also include the protection of bank communications, banking networks from illegal intrusions, breakdowns and other external influences leading to leakage or even destruction of information. Protection is carried out by software and hardware and is certified by authorized payment system organizations.
The second category of protection measures includes measures to prevent information leakage from bank departments for working with plastic cards. The main principle is a clear delineation of the official responsibilities of employees and, in accordance with this, limiting access to classified information to an extent not exceeding the minimum required for work.
These measures reduce the risk and possibility of criminals colluding with employees. Thematic seminars are held for employees to improve their skills. Payment systems regularly distribute security bulletins, in which they publish official material and statistics on crimes involving cards, report signs of criminals and signs of counterfeit cards entering illegal circulation. Through bulletins, staff are trained and preventive and special activities aimed at reducing crime are organized.
Particular attention is paid to the personnel selection of department employees. All security matters are the responsibility of a dedicated security officer. Among preventive measures, the most important place is occupied by work with clients aimed at increasing the cultural level of handling “plastic money”. Careful and careful handling of the card significantly reduces the likelihood of becoming a victim of a crime.
Analysis of violations in the electronic settlement and payment system
It is well known among specialists that Norway's rapid fall in World War II was largely due to the fact that the British Royal Navy codes were broken by German cryptographers who used exactly the same methods that the Royal Navy's Room 40 specialists used against Germany in the previous war.
Since World War II, a veil of secrecy has been lifted over government use of cryptography. This is not surprising, and it is not only due to the Cold War, but also to the reluctance of bureaucrats (in any organization) to admit their mistakes.
Let's look at some of the ways ATM fraud has actually been committed. The goal is to analyze the designers' ideas aimed at the theoretical invulnerability of their product and learn lessons from what happened.
Let's start with a few simple examples that show several types of scams that can be carried out without much technical gimmickry, as well as the banking procedures that allow them to happen.
It is well known that the magnetic stripe on a customer's card must contain only his account number, and his personal identification number (PIN) is obtained by encrypting the account number and taking four digits from the result. Thus, the ATM must be able to perform encryption or otherwise perform PIN verification (eg, interactive query).
Winchester Crown Court in England recently convicted two criminals who used a simple but effective scheme. They stood in queues at ATMs, looked at customers' PIN codes, picked up cards rejected by the ATM and copied account numbers from them onto blank cards, which were used to rob customers' accounts.
This trick was used (and reported) several years ago at a New York bank. The perpetrator was a fired ATM technician, and he managed to steal $80,000 before the bank, which had a security presence in the area, caught him in the act.
These attacks were successful because the banks printed the customer's entire account number on the bank card and, in addition, there was no cryptographic redundancy on the magnetic stripe. You would think that the New York Bank's lesson would be learned, but no.
Another type of technical attack relies on the fact that many ATM networks do not encrypt messages and do not perform authentication procedures when authorizing a transaction. This means that an attacker can record a response from the bank to the ATM “I authorize payment” and then replay the recording until the ATM is empty. This technique, known as “evisceration,” is not only used by outside attackers. There is a known case where bank operators used a network control device to “gut” ATMs along with accomplices.
Test transactions are another source of problems
For one type of ATM, a fourteen-digit key sequence was used to test dispense ten notes. A certain bank printed this sequence in its manual for using remote ATMs. Three years later, money suddenly began disappearing. They continued until all banks using this type of ATM enabled software patches to prevent the test transaction.
The fastest growing scams are those involving the use of false terminals to collect customer accounts and PIN codes. Attacks by this species were first described in the United States in 1988. Fraudsters have built a machine that accepts any card and dispenses a pack of cigarettes. This invention was placed in a store, and PIN codes and data from magnetic cards were transmitted via a modem. The trick spread all over the world.
Technicians also steal money from customers, knowing that their complaints will likely be ignored. At one bank in Scotland, a helpdesk engineer attached a computer to an ATM and recorded customers' account numbers and PINs. He then forged the cards and stole money from the accounts. Once again, clients complained to blank walls. The bank was publicly criticized by one of Scotland's top legal officials for this practice.
The purpose of using a four-digit PIN is that if someone finds or steals another person's bank card, there is a one in ten thousand chance of guessing the code at random. If only three attempts are allowed to enter the PIN, then the probability of withdrawing money from a stolen card is less than one in three thousand. However, some banks have managed to reduce the diversity provided by four figures.
Some banks do not follow the pattern of obtaining a PIN by cryptographically converting the account number, but using a randomly selected PIN (or allowing customers to choose) and then cryptotransforming it to remember it. In addition to allowing the customer to choose a PIN that is easy to guess, this approach introduces some technical pitfalls.
Some banks keep an encrypted PIN value on file. This means that the programmer can obtain the encrypted value of his own PIN and search the database for all other accounts with the same PIN.
One large UK bank even wrote an encrypted PIN code on the card's magnetic stripe. It took the criminal community fifteen years to realize that they could replace the account number on the magnetic stripe of their own card and then use it with their own PIN to steal from an account.
For this reason, the VISA system recommends that banks combine the customer's account number with their PIN before encrypting. However, not all banks do this.
More sophisticated attacks so far have been linked to simple implementation and operating procedure errors. Professional security researchers have tended to view such blunders as uninteresting and have therefore focused on attacks that exploit more subtle technical flaws. Banking also has a number of security weaknesses.
Although high-tech attacks on banking systems are rare, they are of interest from a public point of view, since government initiatives such as the EU Information Security Technology Evaluation Criteria (ITSEC) aim to develop a set of products that are certified against known technical errors. The proposals underlying this program are that the implementation and process procedures of the products concerned will be essentially error-free, and that the attack requires technical training comparable to that of government security agency personnel. Apparently, this approach is more appropriate for military systems than for civilian ones.
To understand how more sophisticated attacks are carried out, it is necessary to look at banking security in more detail.
Issues related to security modules
Not all security products are of equal quality, and few banks have the trained experts to distinguish good products from mediocre ones.
In real practice, there are some problems with encryption products, in particular, the old IBM 3848 security module or the modules currently recommended for banking organizations.
If the bank does not have hardware-implemented security modules, the PIN code encryption function will be implemented in software with corresponding undesirable consequences. Security module software may have breakpoints for debugging of software products by the manufacturer's engineers. This fact was brought to attention when one of the banks decided to include it in the network and the system engineer of the manufacturer was unable to ensure the operation of the required gateway. To get the job done, he used one of these tricks to extract PINs from the system. The existence of such breakpoints makes it impossible to create reliable procedures for managing security modules.
Some security module manufacturers themselves facilitate such attacks. For example, a method is used to generate working keys based on the time of day and, as a result, only 20 key bits are actually used, instead of the expected 56. Thus, according to probability theory, for every 1000 keys generated, two will match.
This makes possible some subtle abuses in which an attacker manipulates bank communications so that transactions from one terminal are replaced by transactions from another.
The programmers of one bank did not even bother with the troubles associated with entering client keys into encryption programs. They simply installed pointers to the key values in a memory area that is always reset to zero when the system starts. The result this decision it turned out that the real and test systems used the same key storage areas. The bank's technicians realized that they could obtain customer PIN codes on testing equipment. Several of them contacted local criminals to select PIN codes for stolen bank cards. When the bank's security manager revealed what was happening, he died in a car accident (and the local police "lost" all the relevant material). The bank did not bother to send out new cards to its customers.
One of the main purposes of security modules is to prevent programmers and staff accessing computers from obtaining key bank information. However, the secrecy provided by the electronic components of security modules often does not withstand cryptographic penetration attempts.
Security modules have their own master keys for internal use, and these keys must be maintained in a specific location. A backup copy of the key is often maintained in an easily readable form, such as a PROM, and the key may be read from time to time, for example when control of a set of zone and terminal keys is transferred from one security module to another. In such cases, the bank is completely at the mercy of the experts in the process of performing this operation.
Problems associated with design technologies
Let's briefly discuss ATM design technology. In older models, the encryption program code was located in the wrong place - in the control device, and not in the module itself. The control device was supposed to be placed in close proximity to the module in a certain area. But a large number of ATMs are currently not located in close proximity to the bank building. At one UK university, an ATM was located on campus and sent unencrypted account numbers and PIN codes to telephone line to the control unit of the branch, which was located several miles from the city. Anyone who bothered to use a phone line tapping device could counterfeit cards by the thousands.
Even in cases where one of the best products is purchased, there are a large number of options in which incorrect implementation or ill-conceived technological procedures lead to troubles for the bank. Most security modules return a range of return codes for each transaction. Some of them, such as “key parity error,” give a warning that the programmer is experimenting with a module that is actually being used. However, few banks have bothered to write the device driver needed to intercept these warnings and act accordingly.
There are cases where banks have entered into subcontracts for all or part of the ATM system with firms that “provide related services” and transferred PIN codes to these firms.
There have also been cases where PIN codes were shared between two or more banks. Even if all bank personnel are considered trustworthy, outside firms may not maintain bank-specific security policies. The staff at these firms are not always properly vetted, are likely to be underpaid, nosy, and reckless, which can lead to fraud being conceived and executed.
Many of the described management mistakes are based on the lack of development of the psychological part of the project. Bank branches and computer centers should follow standard procedures when completing their day's work, but only those control procedures whose purpose is clear are likely to be strictly followed. For example, sharing the keys to the branch safe between the manager and the accountant is well understood: it protects them both from having their families taken hostage. Cryptographic keys are not often packaged in a user-friendly form and are therefore unlikely to be used correctly. A partial answer could be devices that actually resemble keys (modeled on the cryptographic keys of nuclear weapons fuses).
Much could be written about improving operational procedures, but if the goal is to prevent any cryptographic key from falling into the hands of someone who has the technical ability to abuse it, then there must be an explicit goal in the manuals and training courses. The principle of “security by obscurity” often does more harm than good.
Key distribution
Key distribution poses a particular problem for bank branches. As you know, the theory requires that each of the two bankers enter their own key component, so that their combination gives the terminal's master key. The PIN code, encrypted on the terminal master key, is sent to the ATM during the first transaction after maintenance.
If the ATM technician receives both key components, he can decrypt the PIN and counterfeit cards. In practice, branch managers who hold the keys are almost happy to hand them over to the engineer as they don't want to stand next to the ATM while it is being serviced. Moreover, entering a terminal key means using a keyboard, which older managers consider beneath their dignity.
It is common practice to mismanage keys. There is a known case when an engineer from the maintenance staff was given both microcircuits with master keys. Although dual control procedures existed in theory, security officials handed over the chips because the last keys were used and no one knew what to do. An engineer could do more than just forge cards. He could have walked away with the keys and stopped all bank ATM operations.
It is not uninteresting that keys are more often stored in open files than in protected ones. This applies not only to ATM keys, but also to keys for bank-to-bank settlement systems such as SWIFT, which handle transactions worth billions. It would be wise to use initialization keys, such as terminal keys and zone keys, only once and then destroy them.
Cryptanalytic threats
Cryptanalysts probably pose the least threat to banking systems, but they cannot be completely discounted. Some banks (including large and well-known ones) still use homegrown cryptographic algorithms created in the years before DES. In one data network, blocks of data were simply “scrambled” by adding a constant. This method was not criticized for five years, despite the fact that the network was used by more than 40 banks. Moreover, all the insurance, audit and security experts of these banks apparently read the system specifications.
Even if a “respectable” algorithm is used, it may be implemented with inappropriate parameters. For example, some banks have implemented the RSA algorithm with key lengths ranging from 100 to 400 bits, even though the key length must be at least 500 bits in order to provide the required level of security.
You can also find a key using brute force, trying out all possible encryption keys until you find a key that a specific bank uses.
The protocols used in international networks to encrypt working keys using zone keys make it easy to attack the zone key in this way. If the zone key has been opened once, all PlN codes sent or received by the bank over the network can be decrypted. A recent study by Canadian Bank experts found that an attack of this kind on DES would cost around £30,000 per zone key. Consequently, the resources of organized crime are quite sufficient for such a crime, and such a crime could be carried out by a sufficiently wealthy individual.
Probably, the specialized computers necessary to find the keys were created in the intelligence services of some countries, including in countries that are now in a state of chaos. Consequently, there is a certain risk that the custodians of this equipment could use it for personal gain.
All systems, small and large, contain software bugs and are subject to human error. Banking systems are no exception, and anyone who has worked in industrial production realizes this. Branch settlement systems tend to become larger and more complex, with many interacting modules that have evolved over decades. Some transactions will inevitably be executed incorrectly: debits may be duplicated or an account may be incorrectly changed.
This situation is not new to the financial controllers of large companies, who maintain a special staff to reconcile bank accounts. When an erroneous debit appears, these employees request relevant documentation for review and, if documentation is missing, receive a refund of the incorrect payment from the bank.
However, ATM customers do not have this option to repay disputed payments. Most bankers outside the US simply say there are no bugs in their systems.
Such a policy leads to certain legal and administrative risks. Firstly, it creates the possibility of abuse, since the fraud is hidden. Secondly, this leads to evidence that is too complex for the client, which was the reason for simplifying the procedure in US courts. Third, there is the moral hazard associated with indirectly encouraging bank employees to steal based on the knowledge that they are unlikely to be caught. Fourthly, this is an ideological flaw, since due to the lack of centralized recording of customer claims, there is no possibility of properly organized control over cases of fraud.
The impact on business activity associated with ATM losses is difficult to accurately estimate. In the UK, the Economic Secretary to the Treasury (the minister responsible for regulating banking) stated in June 1992 that such errors affect at least two transactions out of three million made every day. However, under recent litigation pressure, this figure has been revised first to 1 in 250,000 erroneous transactions, then 1 in 100,000, and finally 1 in 34,000.
Since customers who make complaints are usually rebuffed by bank employees and most people are simply unable to notice a one-time withdrawal from their account, the best guess is that about 1 in 10,000 incorrect transactions occur. Thus, if With the average customer using an ATM once a week for 50 years, we can expect one in four customers to experience problems using ATMs in their lifetime.
Cryptographic system designers are at a disadvantage due to a lack of information about how system failures occur in practice rather than how they might occur in theory. This disadvantage feedback leads to the use of an incorrect threat model. Designers focus their efforts on what in the system can lead to failure, rather than focusing on what usually causes errors. Many products are so complex and tricky that they are rarely used correctly. The consequence is the fact that most errors are associated with the implementation and maintenance of the system. A specific result has been a spate of ATM fraud, which has not only led to financial losses, but also to miscarriages of justice and decreased confidence in the banking system.
One example of the implementation of cryptographic methods is the cryptographic information protection system using the EXCELLENCE digital signature.
The EXCELLENCE software cryptographic system is designed to protect information processed, stored and transmitted between IBM-compatible personal computers using cryptographic encryption, digital signature and authentication functions.
The system implements cryptographic algorithms that comply with state standards: encryption - GOST 28147-89. The digital signature is based on the RSA algorithm.
The key system with strict authentication and key certification is built on the X.509 protocol and the principle of open RSA key distribution, which are widely used in international practice.
The system contains cryptographic functions for processing information at the file level:
and cryptographic functions for working with keys:
Each network subscriber has his own private and public key. Each user's secret key is recorded on his individual key floppy disk or individual electronic card. The secrecy of the subscriber's key ensures the protection of the information encrypted for him and the impossibility of forging his digital signature.
The system supports two types of key information media:
Each network subscriber has a file directory of public keys of all system subscribers, protected from unauthorized modification, along with their names. Each subscriber is obliged to keep his private key secret.
Functionally, the EXCELLENCE system is implemented in the form of a software module excell_s.exe and runs on the MS DOS 3.30 and higher operating system. Parameters for executing functions are passed in the form command line DOS. Additionally, a graphical interface is supplied. The program automatically recognizes and supports 32-bit operations on the Intel386/486/Pentium processor.
For embedding into others software systems a variant of the EXCELLENCE system has been implemented, containing basic cryptographic functions for working with data in RAM in the following modes: memory - memory; memory - file; file - memory.
Forecast for the beginning of the 21st century
The share of bank management that will take effective measures to solve the information security problem should increase to 40-80%. The main problem will be service (including former) personnel (from 40% to 95% of cases), and the main types of threats will be unauthorized access (UNA) and viruses (up to 100% of banks will be subject to virus attacks).
The most important measures to ensure information security will be the highest professionalism of information security services. For this banks will have to spend up to 30% of profits on information security.
Despite all the measures listed above, an absolute solution to the problem of information security is impossible. At the same time, the effectiveness of a bank’s information security system is entirely determined by the amount of funds invested in it and the professionalism of the information security service, and the possibility of violating a bank’s information security system is entirely determined by the cost of overcoming the security system and the qualifications of fraudsters. (In foreign practice, it is believed that it makes sense to “hack” a security system if the cost of overcoming it does not exceed 25% of the value of the information being protected).
Chapter 4 examined the features of the approach to protecting electronic banking systems. A specific feature of these systems is a special form of electronic data exchange - electronic payments, without which no modern bank can exist.
Electronic data exchange (EDE) is the computer-to-computer exchange of business, commercial, and financial electronic documents. For example, orders, payment instructions, contract proposals, invoices, receipts, etc.
The EOD ensures prompt interaction between trading partners (clients, suppliers, resellers, etc.) at all stages of preparing a trade transaction, concluding a contract and implementing a delivery. At the stage of contract payment and funds transfer, EDI can lead to the electronic exchange of financial documents. This creates an effective environment for trade and payment transactions:
* It is possible to familiarize trading partners with offers of goods and services, select the required product/service, clarify commercial conditions (cost and delivery time, trade discounts, warranty and service obligations) in real time;
* Ordering goods/services or requesting a contract proposal in real time;
* Operational control of the delivery of goods, receipt of accompanying documents (invoices, invoices, component lists, etc.) by e-mail;
* Confirmation of completion of delivery of goods/services, issuance and payment of invoices;
* Execution of bank credit and payment transactions. The advantages of OED include:
* Reducing the cost of operations by switching to paperless technology. Experts estimate the cost of processing and maintaining paper documentation at 3-8% of the total cost of commercial transactions and delivery of goods. The benefit from the use of EED is estimated, for example, in the US automotive industry at more than $200 per manufactured car;
* Increasing the speed of settlement and money turnover;
* Increasing the convenience of calculations.
There are two key strategies for developing EED:
1. EOD is used as a competitive advantage, allowing for closer interaction with partners. This strategy has been adopted by large organizations and is called the Extended Enterprise Approach.
2. EDI is used in some specific industrial projects or in initiatives of associations of commercial and other organizations to increase the efficiency of their interaction.
Banks in the United States and Western Europe have already recognized their key role in the spread of EDI and the significant benefits that come from closer interaction with business and personal partners. OED helps banks provide services to clients, especially small ones, those who previously could not afford to use them due to their high cost.
The main obstacle to the widespread dissemination of EDI is the variety of presentations of documents when exchanging them via communication channels. To overcome this obstacle, various organizations have developed standards for submitting documents in EED systems for various industries:
QDTI - General Trade Interchange (Europe, international trade);
MDSND - National Automated Clearing House Association (USA, National Association of Automated Clearing Houses);
TDCC - Transportation Data Coordinating Committee;
VICS - Voluntary Interindustry Communication Standard (USA, Voluntary Interindustry Communication Standard);
WINS - Warehouse Information Network Standards information network commodity warehouses).
In October 1993, the international group UN/ECE published the first version of the EDIFACT standard. The developed set of syntax rules and commercial data elements was formalized in the form of two ISO standards:
ISO 7372 - Trade Data Element Directory;
ISO 9735 - EDIFACT - Application level syntax rules.
A special case of EOD is electronic payments - the exchange of financial documents between clients and banks, between banks and other financial and commercial organizations.
The essence of the concept of electronic payments is that messages sent over communication lines, properly executed and transmitted, are the basis for performing one or more banking operations. In principle, no paper documents are required to perform these operations (although they may be issued). In other words, the message sent over the communication lines carries information that the sender has performed some operations on his account, in particular on the correspondent account of the receiving bank (which can be a clearing center), and that the recipient must perform the operations specified in the message. Based on such a message, you can send or receive money, open a loan, pay for a purchase or service, and perform any other banking transaction. Such messages are called electronic money, and the execution of banking operations based on sending or receiving such messages is called electronic payments. Naturally, the entire process of making electronic payments requires reliable protection. Otherwise, the bank and its clients will face serious trouble.
Electronic payments are used for interbank, trade and personal payments.
Interbank and trade settlements are made between organizations (legal entities), which is why they are sometimes called corporate. Settlements involving individual clients are called personal.
Most major thefts in banking systems are directly or indirectly related to electronic payment systems.
There are many obstacles on the way to creating electronic payment systems, especially global ones, covering a large number of financial institutions and their clients in different countries. The main ones are:
1. Lack of uniform standards for operations and services, which significantly complicates the creation of unified banking systems. Each large bank strives to create its own EOD network, which increases the costs of its operation and maintenance. Duplicate systems make them difficult to use, creating mutual interference and limiting customer capabilities.
2. Increased mobility of the money supply, which leads to an increase in the possibility of financial speculation, expands the flows of “wandering capital”. This money can change the situation on the market and destabilize it in a short time.
3. Failures and failures of technical tools and software errors when making financial settlements, which can lead to serious complications for further settlements and loss of confidence in the bank on the part of clients, especially due to the close intertwining of banking ties (a kind of “error propagation”). At the same time, the role and responsibility of system operators and administration, who directly manage information processing, increases significantly.
Any organization that wants to become a client of any electronic payment system, or organize its own system, must be aware of this.
To operate reliably, an electronic payment system must be well protected.
Trade settlements are made between various trading organizations. Banks participate in these settlements as intermediaries when transferring money from the account of the paying organization to the account of the recipient organization.
Merchant settlement is extremely important to the overall success of an electronic payments program. The volume of financial transactions of various companies usually constitutes a significant part of the total volume of bank transactions.
The types of trade settlements vary greatly for different organizations, but when they are carried out, two types of information are always processed: payment messages and auxiliary (statistics, reports, notifications). For financial organizations, the greatest interest is, of course, information from payment messages - account numbers, amounts, balance, etc. For trading organizations, both types of information are equally important - the first provides a clue to the financial state, the second helps in decision-making and policy development.
The most common types of trading settlements are:
* Direct deposit.
The meaning of this type of settlement is that the organization instructs the bank to make certain types of payments to its employees or clients automatically, using pre-prepared magnetic media or special messages. The conditions for making such payments are agreed upon in advance (source of financing, amount, etc.). They are used mainly for regular payments (payments of various types of insurance, loan repayments, salaries, etc.). Institutionally, direct deposit is more convenient than, for example, payments using checks.
Since 1989, the number of employees using direct deposit has doubled to 25% of the total. More than 7 million Americans today receive their paychecks through direct deposit. For banks, direct deposit offers the following benefits:
Reducing the volume of tasks associated with processing paper documents and, as a result, saving significant amounts;
Increase in the number of deposits, since 100% of the volume of payments must be deposited.
In addition to banks, both owners and workers benefit; convenience is increased and costs are reduced.
* Calculations using OED.
The data here is invoices, invoices, component sheets, etc.
To implement the EDI, the following set of basic services is required:
Email according to the X.400 standard;
File transfer;
Point-to-point communication;
On-line access to databases;
Mailbox;
Transformation of information presentation standards.
Examples of currently existing trade settlement systems using EDI include:
National Bank and Royal Bank (Canada) are connected to their customers and partners using the IBM Information Network;
Bank of Scotland Transcontinental Automated Payment Service (TAPS), founded in 1986, connects Bank of Scotland with customers and partners in 15 countries through correspondent banks and automated clearing houses.
Electronic interbank settlements are mainly of two types:
* Clearing settlements using the powerful computer system of the intermediary bank (clearing bank) and correspondent accounts of banks participating in settlements in this bank. The system is based on the offset of mutual monetary claims and obligations of legal entities with the subsequent transfer of the balance. Clearing is also widely used on stock and commodity exchanges, where the settlement of mutual claims of transaction participants is carried out through a clearing house or a special electronic clearing system.
Interbank clearing settlements are carried out through special clearing houses, commercial banks, between branches and branches of one bank - through the head office. In a number of countries, the functions of clearing houses are performed by central banks. Automated clearing houses (ACHs) provide services for the exchange of funds between financial institutions. Payment transactions are mainly limited to either debits or credits. Members of the AKP system are financial institutions that are members of the AKP Association. The association is formed in order to develop rules, procedures and standards for the implementation of electronic payments within a geographic region. It should be noted that ACP is nothing more than a mechanism for moving funds and accompanying information. They do not perform payment services themselves. ACPs were created to complement paper financial document processing systems. The first automatic transmission appeared in California in 1972; there are currently 48 automatic transmissions operating in the United States. In 1978, the National Automated Clearing House Association (NACHA) was created, uniting all 48 ACH networks on a cooperative basis.
The volume and nature of operations are constantly expanding. ACPs are beginning to perform business settlements and electronic data exchange transactions. After three years of efforts by various banks and companies, the CTP (Corporate Trade Payment) system was created to automatically process credits and debits. According to experts, the trend of expanding automatic transmission functions will continue in the near future.
* Direct settlements, in which two banks communicate directly with each other using loro nostro accounts, possibly with the participation of a third party playing an organizational or supporting role. Naturally, the volume of mutual transactions must be large enough to justify the costs of organizing such a settlement system. Typically, such a system unites several banks, and each pair can communicate directly with each other, bypassing intermediaries. However, in this case, there is a need for a control center that deals with the protection of interacting banks (distribution of keys, management, control of functioning and registration of events).
There are quite a lot of such systems in the world - from small ones connecting several banks or branches to giant international ones connecting thousands of participants. The most famous system of this class is SWIFT.
Recently, a third type of electronic payments has emerged - electronic check truncation, the essence of which is to stop the route of sending a paper check to the financial institution where it was presented. If necessary, its electronic analogue “travels” further in the form of a special message. Forwarding and repayment of an electronic check is carried out using ACH.
In 1990, NACHA announced the first phase of testing of the national pilot program "Electronic Check Truncation". Its goal is to reduce the cost of processing huge amounts of paper checks.
Sending money using an electronic payment system includes the following steps (depending on the specific conditions and the system itself, the order may vary):
1. A certain account in the first bank’s system is reduced by the required amount.
2. The correspondent account of the second bank in the first increases by the same amount.
3. A message is sent from the first bank to the second bank containing information about the actions being performed (account identifiers, amount, date, conditions, etc.); in this case, the sent message must be appropriately protected from forgery: encrypted, provided with a digital signature and control fields, etc.
4. The required amount is debited from the correspondent account of the first bank in the second.
5. A certain account in the second bank is increased by the required amount.
6. The second bank sends the first a notification about the account adjustments made; this message must also be protected against tampering in a manner similar to protecting a payment message.
7. The exchange protocol is recorded for both subscribers and, possibly, for a third party (at the network control center) to prevent conflicts.
There may be intermediaries along the way of message transmission - clearing centers, intermediary banks in the transfer of information, etc. The main difficulty of such calculations is confidence in their partner, that is, each subscriber must be sure that his correspondent will perform all the necessary actions.
To expand the use of electronic payments, standardization of the electronic presentation of financial documents is being carried out. It was started in the 70s within two organizations:
1) ANSI (American National Standard Institute) published ANSI X9.2-1080, (Interchange Message Specification for Debit and Credit Card Message Exchange Among Financial Institute). In 1988, a similar standard was adopted by ISO and called ISO 8583 (Bank Card Originated Messages Interchange Message Specifications - Content for Financial Transactions);
2) SWIFT (Society for Worldwide Interbank Financial Telecommunications) has developed a series of standards for interbank messages.
In accordance with the ISO 8583 standard, a financial document contains a number of data elements (details) located in certain fields of a message or electronic document (electronic credit card, message in X.400 format or document in EDIFACT syntax). Each data element (ED) is assigned its own unique number. A data element can be either mandatory (that is, included in every message of this type) or optional (may be absent in some messages).
The bit scale determines the composition of the message (those EDs that are present in it). If a certain digit of the bit scale is set to one, this means that the corresponding ED is present in the message. Thanks to this method of encoding messages, the overall length of the message is reduced, flexibility is achieved in the presentation of messages with many EDs, and the ability to include new EDs and message types into an electronic document of a standard structure is provided.
There are several methods for electronic interbank payments. Let's consider two of them: payment by check (payment after the service) and payment by letter of credit (payment for the expected service). Other methods, such as payment via payment requests or payment orders, have a similar organization.
Payment by check is based on a paper or other document containing the payer's identification. This document is the basis for transferring the amount specified in the check from the owner's account to the bearer's account. Payment by check includes the following steps:
Receiving a check;
Submitting a check to the bank;
Request for a transfer from the check owner's account to the drawer's account;
Money transfer;
Notice of payment.
The main disadvantages of such payments are the need for an auxiliary document (check), which can be easily forged, as well as the significant time required to complete the payment (up to several days).
Therefore, recently this type of payment as payment by letter of credit has become more common. It includes the following steps:
Notification of the bank by the client about the provision of a loan;
Notification of the recipient's bank about the provision of a loan and transfer of money;
Notifying the recipient about receiving the loan.
This system allows you to make payments in a very short time. Notification of a loan can be sent by (electronic) mail, floppy disks, magnetic tapes.
Each of the types of payments discussed above has its own advantages and disadvantages. Checks are most convenient for paying small amounts, as well as for irregular payments. In these cases, the delay in payment is not very significant, and the use of credit is inappropriate. Payments using a letter of credit are usually used for regular payments and for significant amounts. In these cases, the absence of a clearing delay allows you to save a lot of time and money by reducing the money turnover period. The common disadvantage of these two methods is the need to spend money on organizing a reliable electronic payment system.
