Copyright ©1997 NetDox, Inc. All Rights Reserved. CONFIDENTIAL 1 DATE HERE Julie Grace - NetDox, Inc. Emerging Internet Commerce

Copyright ©1997 NetDox, Inc. All Rights Reserved. CONFIDENTIAL1DATE HERE

Julie Grace - NetDox, Inc.

Emerging Internet Commerce

Copyright ©1997 NetDox, Inc. All Rights Reserved. CONFIDENTIAL2

FINANCIAL SERVICES & THE INTERNET

Internet commerce transactions can benefit companies and customers by providing cost efficiencies in policy origination, claims processing and business development.

• Auto insurance policies are being sold on-line in the UK by Eagle Star• AOL, Yahoo! Financial and InsWeb are providing insurance

information to customers and lead generation information to insurers in the US

• Citicorp chairman John Reed estimates that 80% of the costs associated with customer service can be eliminated with an effective technology strategy (Yahoo! News 4/15/98)

On-line purchases provide a 4% higher profit margin

than other sales mediums.


EXPERT PROJECTIONS

Made Projected Actual

1997 E-Commerce 1991 $150B $8B

2002 E-Commerce 1997 $327B ?

$500B ?

$1500B ?

Source: Forrester Research, Yankee Group, Cisco, 1997


INTERNET COMMERCE EXAMPLE

Customer Alice in San Francisco

Broker Bob in Chicago

“Did Bob receive my information?”

“Is anyone reading myinformation while it

travels the Internet?”

“How do I know for certain that Bob is the one who

received my information?”

“Did this information really come from Alice?”

“Can I count on the Internet to deliver my important information on time?”


TRUST DEFINED

SECURITY

TRUST = RELIABILITY

ACCOUNTABILITY


SECURITY

“Is anyone reading my information while it travels the Internet?”


SECURITY

• Avoiding It

• Private Networks

• Virtual Private Networks

• Cryptography• Symmetric Encryption• Asymmetric Encryption

There are a number of ways companies are addressing security concerns for electronic communications:


Scramble the contents of a message, making it unreadable

Unscramble the contents of an encrypted message, making it readable again

If the key used to scramble and unscramble is the same, it is a symmetric key

INFORMATION

+ = + =

SYMMETRIC KEY

ENCRYPTED INFORMATION

SYMMETRIC KEYS


SYMMETRIC KEY

INFORMATION

Symmetric encryption key is a computer code used to:

SYMMETRIC ENCRYPTION


Asymmetric keys split the function of a symmetric key into two parts:

INFORMATION

+ = + =

PUBLIC KEY



PRIVATE KEY

INFORMATION

Information encrypted with the private key can only be decrypted with the public key, and vice versa

ASYMMETRIC KEYS

ALICE BOB BENEFIT

Encrypt with Bob’s Public Key

Decrypt withBob’s Private Key

Confidentiality:Only Bob can open

Encrypt withAlice’s Private Key

Decrypt withAlice’s Public Key

Proof of Authorship:Only Alice can send

ASYMMETRIC ENCRYPTION


SYMMETRIC & ASYMMETRIC COMPARED

Symmetric Encryption Relatively easy-to-use Several security and administration issues...

Need to share the symmetric encryption key with the recipient

• Must use an “out-of-band” method

Anyone who acquires the session key can use it to:• Decrypt the message you sent

Asymmetric Encryption Enhanced security and flexibility Requires longer keys which greatly increases processing time


SYMMETRIC & ASYMMETRIC COMBINED

Get advantages of both by using them together

INFORMATION

+ =

SYMMETRIC KEY


+

BOB’SASYMMETRIC

PUBLIC KEY

SYMMETRIC KEY

=

ENCRYPTED SYMMETRIC

KEY


INFORMATION

+

SYMMETRIC KEY

=

ENCRYPTED SYMMETRIC

KEY

=+

BOB’SASYMMETRIC

PRIVATEKEY

SYMMETRIC KEY

ALICE BOB


RELIABILITY

“Can I count on the Internet to deliver my information on time?”


RELIABILITY

No single entity “owns” the Internet, therefore no one completely controls its reliability.

Companies are addressing the challenge of reliability with:

• Hardware - reliable mail servers, web servers, routers

• Software - reliable email packages, languages

• Connectivity - reliable Internet Service Providers (ISPs)

• Information - status confirmation


ACCOUNTABILITY

“Did this information really come from Alice?”


ACCOUNTABILITY

Companies who enable Internet Commerce must be accountable for:

IntegrityThe information has not been altered in transit

IdentityThe sender and recipient are who they claim to be

Non-RepudiationProviding indisputable proof of a transaction after the fact

Financial GuaranteesAssuming liability for information exchanges


INTEGRITY

A digital hash is a computed number that uniquely represent information If the document changes in the slightest, so does the digital hash

INFORMATION

DIGITAL FINGERPRINT

HASHING FUNCTION

DIGITAL HASH

=


INTEGRITY

A digital hash ensures information was not altered in transit

INFORMATION

HASHING FUNCTION

ALICE’S DIGITAL HASH

INFORMATION

HASHING FUNCTION

BOB’S DIGITAL HASH

?=

ALICE’S DIGITAL HASH

Alice sends both the message and her hash of the message to Bob

Bob does his own hash of the message and compares it to the hash Alice sent


IDENTITY

Combine a digital hash with encryption to produce a digital signature which provides proof of authorship

MESSAGE

HASHING FUNCTION

DIGITAL HASH+

ALICE’SPRIVATE KEY

=Alice

DIGITAL SIGNATURE


IDENTITY

Digital certificates bind an identity to a public encryption key

+

ALICE

ALICE’S PUBLIC KEY

CERTIFICATE AUTHORITY

ALICE INFOEmail AddressEmployerEtc.

ALICE’S DIGITAL CERTIFICATE


DIGITAL CERTIFICATE INDUSTRY UPDATE

• Recent survey* of 50 Fortune 1,000 firms, 72% plan to use digital certificates within 2 years

• Financial Services industry is leading the way of digital certificate use for intercompany electronic commerce

• Why use digital certificates? “Non-repudiation. We need to be sure that when someone appears to initiate a message, they’re the ones who really did it.” (Commercial Bank)

* Forrester Research, Inc. 1997


NON-REPUDIATION

Non-repudiation takes several forms

• Digital certificates to prove authorship

• Archive transaction records to prove information exchanged at a specific date and time

• Archived transaction content to prove exact details of an information exchange


FINANCIAL GUARANTEES

Companies assuming liability for services and products that enable Internet commerce is an important step forward.

• VeriSign and IDMetrix insure digital certificates

• NetDox insures Internet messages

• AT&T guarantees network (Internet) access

• BBN Internet Service takes full responsibility for delivery of data packets from source to destination


SUMMARY

Building trust through security, reliability, and accountability will enable

businesses to harness the power of Internet Commerce.


MORE INFORMATION

Cryptography: RSA website - www.rsa.com

Digital Certificates: Entrust - www.entrust.com

GTE - www.gte.com

IDMetrix - www.idmetrix.com

VeriSign - vwww.verisign.com

World Wide Web Security:World Wide Web Security FAQ - www.w3.org

NetDox:www.netdox.com

Documents

Copyright ©1997 NetDox, Inc. All Rights Reserved. CONFIDENTIAL 1 DATE HERE Julie Grace - NetDox, Inc. Emerging Internet Commerce