[Back| Home| Programs| Documentation| Internet| People]


Math 187 Internet Security Page

Have you wanted to buy something over the Internet and wondered, "How safe is it send my credit card information over the net?" What about banking over the Internet, how does that work? Is it safe to bank over the Internet? If I can access my bank account over the net what prevents someone else from accessing my account?

Even if have never asked yourself these questions chances are you will soon. The amount of commerce done over the Internet grows larger every day and will continue to grow as long as people trust that their financial information is kept safe. Banks are also beginning to take advantage of the Internet by allowing their customers make transactions over the web and access account information through a Internet browser.

Sites like Amazon.com, the largest book store in the world, and CDNow, the worlds largest music store, are "stores" that consumers can only visit over the web. In order to make a first time customer a repeat customer, these sites must provide their customers with a high level of security without forcing the average customer to learn a lot about Internet security. In fact even sites like studentlink use encryption so that a student can only access his or her grades and classes. After reading this you should leave knowing how Internet transactions are kept safe.


This document should dispel some of the myths that all Internet transactions are dangerous. By no means does mean that all Internet transactions are safe, but if implemented correctly Internet purchases are just as safe, or even safer, than making a purchase over the phone.

Encryprtion

Just how can these transactions be so safe? A multitude of technologies creates the level of security that is found in today's commercial sites. The backbone of all these technologies is encryption. All methods of computer security rely on encryption, the process of making data unreadable to anyone who doesnít know the "key". Without encryption computer security would not exist. There are multiple methods of encryption each with different advantages and disadvantages such as the speed of the encryption and decryption process and how safe the encryption actually is.

Certificates

Anyone who has ever been in an Internet chat room knows that you can pretend to be anyone. So how do web sites make sure you are who you say you are, and more importantly how do you know that the web site you have connected to is really a valid business and site? I would like to know that I am really sending my credit card information to a real Internet store and not a store put up by a scam artist who just wants my credit card information. The solution is to have Internet ID's. Digital certificates are used like an Internet driver's license, they to prove a person's or a web site's entity. With digital certificates you can be certain that a person or web site is the entity that they claim to be.

SSL

The next question that should be asked is how does one make an site "secure," or what exactly is a secure site. The simple answer is that a secure site uses an Internet feature called SSL. SSL stands for Secure Sockets Layer, which is an Internet protocol that encrypts all of the communications between the site, say CDNow, and the client, you or me. This method of making a web site secure uses multiple methods of encryption and relies on certificates to authenticate a web siteís identity. For these reasons, and its ease at which SSL can be implemented, SSL is generally the encryption protocol used to encrypt you Internet credit card transactions. More importantly, the consumer, you and I, have to do nothing extra to use SSL. That is the beauty of Secure Sockets layer, the consumer does not have to do anything extra to benefit from secure SSL transactions. In order to fully understand SSL please read the sections about encryption and digital certificates first because SSL based on the two technologies.

PKI
Finally, how can all these technologies be deployed in a large scale to make secure infrastructure for large amounts of people? A solution would be very useful to large corporations who have lots of data that must be kept a secret and lots of employees to keep track of. How would a large corporation may only let a specific group of employees have access to a limited amount of data. A good solution would encrypt the sensitive data and also make sure that the person requesting the data is really that person. The digital solution to this problem is PKI, or Public Key Infrastructure. There are many different ways to create a PKI and this link will explain the PKI solutions.

More PKI

This page will describe the PKI solution that a large corporation would use. This form of PKI uses encryption, SSL, and personal certificates to authenticate users and control access to computer networks and data . This PKI implementation is also the way a bank could use PKI since banks must be sure that only the owner of an account is allowed access to the account.

PGP

What about the average person, someone who just wants to encrypt e-mail or a couple of files on your home computer. For this person the solution is PGP. PGP is a encryption system designed for the average computer user, but uses the most secure and advanced encryption system to date. PGP is another example of a PKI, but a PKI implementation for a non-homogenous set of people. In other words it is the PKI solution that the Internet community could use and does use.



These topics above are just a broad overview of computer security and the technology that is currently being used. I hope after reading all of this you will feel better about purchasing items over the web. Moreover, you should also be able tell whether or not a site is secure and whether or not you should trust a site.

Links

This site is just an overview of the different Internet security options. For more detailed and technical explanation of the different technologies follow the links on this page. The links on this page are organized by topic, the links are also where most of the information used to create this document came from. Please read more, knowledge is power.




Send your comments and sugestions to
rrwallac@ucsd.edu


Contact information URL: http://sdcc10.ucsd.edu/~rrwallac e-mail: rrwallac@ucsd.edu


 
 
[Back| Home| Programs| Documentation| Internet| People]