The Internet has been around since 1969 and the World Wide Web appeared in the early 1990s. Recently more and more businesses have been using the Web for Electronic Commerce - instead of physically going to a store to buy items, customers access the Web site of a business to order items and charge them to credit cards for delivery by a shipper to their home.

The figures on page 587 of the text show the estimates of the Census Bureau on how much E-commerce occurs. During the first quarter of the year 2000, $5 billion of retail goods were sold over the Web (0.7% of total U.S. Retail Sales.) The amount grows higher and higher each year so during the first quarter of the year 2005, $19.8 billion of retail goods were sold on the Web (2.3% of total U.S. Retail Sales.)

Sections (13.2.1) and (13.2.2) in the text give some advice to anyone contemplating setting up an E-commerce site.

(13.2.3) - Anatomy of a Transaction

An E-commerce web site has three goals:

• Draw potential customers to the site.
• Keep them there.
• Set up optimum conditions for the customers to complete their purchases.

As shown in Figure 13.3:

• a database is a collection of files,
• a file is a set of records,
• each record contains a number of fields,
• each field uses a number of bytes, and
• each byte contains eight bits.

As an example, Figure 13.6 shows an employees file of a corporation. The file contains a record or tuple for each of the five employees and each record has six fields showing six attributes of the employee - each employee has a unique ID so that is a primary key of this file.

     SELECT ID, LastName, FirstName, Birthdate, PayRate, HoursWorked
     FROM Employees
     WHERE ID = 123;

     SELECT LastName, FirstName, PayRate
     FROM Employees
     WHERE LastName = 'Kay';

Figure 13.7 shows the InsurancePolicies file for this corporation.

The description and monthly cost of each insurance plan is kept in the InsurancePlans file as shown in Figure 13.8.

The SQL query:

     SELECT LastName, FirstName, PlanType
     FROM Employees, InsurancePolicies
     WHERE LastName = 'Takasano'
     AND FirstName = 'Frederick' 
     AND ID = EmployeeID; 

Information security means protecting data (both stored in a computer and transmitted over a network) so unauthorized persons can't read it and change it.

Data can be encrypted so one needs to know the decoding key to read it. Another important aspect of information security on the Internet is authentication - is the Web site you are communicating with really the right Web site or is it some other site pretending to be the right site?

(13.4.1) - Encryption Overview

Cryptography is the science of secret writing - a message plaintext is encoded into ciphertext before it is sent to keep its meaning secret if it is intercepted by the wrong parties. Only the party that knows how to decrypt the ciphertext can restore the plaintext.

(13.4.2) - Simple Encryption Algorithms

The simplest encryption algorithms are shift ciphers. For example shift the letters in the alphabet three places:

     PlainText:  ABCDEFGHIJKLMNOPQRSTUVWXYZ
     CipherText: DEFGHIJKLMNOPQRSTUVWXYZABC

     PlainText:  ABCDEFGHIJKLMNOPQRSTUVWXYZ
     CipherText: NAOBPCQDRESFTGUHVIWJXKYLZM

1. Group the plaintext into 2-character blocks.

2. Substitute a number in the range of 0 to 25 for each character in each block: S(A) = 1, S(B) = 2, ..., S(Z) = 0.

3. If S₁ and S₂ are the two numbers in a block then calculate C₁ and C₂ in the ciphertext with: C₁ = S₁*3 + S₂*2
   C₂ = S₁*5 + S₂*3 using modulo 26 arithmetic.

But 35 = 9 in modulo 26 arithmetic so the ciphertext is (22 9).

Decoding uses the following algorithm.

1. If C₁ and C₂ are the two numbers in a ciphertext block then calculate S₁ and S₂ in the plaintext with: S₁ = C₁*23 + C₂*2
   S₂ = C₁*5 + C₂*23 using modulo 26 arithmetic.

2. Substitute a character in the alphabet for each number in each plaintext block: S(A) = 1, S(B) = 2, ..., S(Z) = 0.

3. Combine the 2-character plaintext blocks to get the original plaintext.

So the characters in this plaintext block are DE.

(13.4.3) - DES

DES (Data Encryption Standard) is a much more complicated encryption algorithm shown in Figure 13.11.

(13.4.4) - Public Key Systems

The encryption algorithms described above are symmetric because encryption and decryption use the same key. An asymmetric algorithm uses different keys for encryption and decryption. A public-key system uses an asymmetric algorithm where the encryption key is broadcast to every one but the decryption key is kept secret.

The most popular public-key system is RSA, named for its developers Rivest, Shamir, and Adleman. It is based on the mathematics of number theory and its security depends on the fact that it is very difficult to find the factors of the product of two very large prime numbers. To develop an RSA public-key system a Web site:

1. Picks two different very large prime numbers, P and Q (each number should have hundreds of digits.)
2. Calculates N = P * Q.
3. Calculates M = (P - 1 ) * (Q - 1 ).
4. Picks its public-key, E, to be some number relatively prime to M (the GCD of E and M = 1.)
5. Tells the world that the numbers in its public-key are E and N.
6. Calculates its private-key, D, so that D * E = 1 modulo M - the Web site keeps P, Q, and D secret.

To reply to the client with plaintext R, the Web-site uses its private-key to calculate S = R ^D modulo N and sends ciphertext S to the client. When the client receives S from the Web-site he/she uses the public-key to calculate the plaintext R = S ^E modulo N.

To keep this example simple, we pick some small prime numbers, P = 5 and Q = 11. Then N = 5 * 11 = 55 and M = 4 * 10 = 40. We pick public-key E = 7 and calculate the private-key D = 23 ( 7 * 23 = 161 = 1 modulo 40.)

Plaintext T can be any integer from 0 to N-1 = 54. A client can use the tables below to find the ciphertext U = T ⁷ modulo 55 for any T.

When the Web-site receives ciphertext U from a client it can use its private-key to calculate T = U ²³ modulo 55. Here, since there are only 55 possible values for T we can easily search the second row of these tables to find U and read the corresponding value of T in the first row.

Note that there are nine values of T (0, 1, 10, 11, 21, 34, 44, 45, and 54) where U = T. For any RSA public-key system where N > 9 there will be nine of the N possible plaintext values where ciphertext = plaintext.

Figure 13.12 in the text shows how a client and a Web site can exchange data securely.

1. The client sends a request to initiate RSA/DES encryption.
2. The Web server responds with its authentication certificate and its public-key.
3. The client uses the server's public-key to send the DES key it wants to use. An eavesdropper doesn't know the server's private-key and can't read the DES key.
4. The Web server uses the DES key to sends its acknowledgment to the client.
5. The client and the Web server use the DES key to exchange data securely.