Title: A web transaction security scheme based on disposable credit card numbers

Authors: Mohammed Assora, James Kadirire, Ayoub Shirvani

Addresses: Anglia Ruskin University, Chelmsford, Essex CM1 1LL, UK. ' Anglia Ruskin University, Chelmsford, Essex CM1 1LL, UK. ' Anglia Ruskin University, Chelmsford, Essex CM1 1LL, UK

Abstract: Today, an e-commerce transaction is performed by sending the client|s credit card details over a SSL/TLS connection. This form of transaction raises many security threats. The most important one is the client authentication. Because the client normally does not have a public key certificate, the client|s authentication is achieved only by the credit card details. In addition, these details are stored unencrypted in the merchant|s database. A Disposable Credit Card Number (DCCN) is a technique to overcome these security threats. This paper presents a scheme for off-line generation of the DCCNs. The scheme uses a pre-shared secret key between the issuer and the client to generate Hashed Message Authentication Code for some selected data from the transaction. The scheme is secure and adds minimum overhead on the issuer and client. Furthermore, the generated DCCN has all the features of classical credit card details.

Keywords: e-commerce; transaction security; disposable credit card numbers; DCCN generation; off-line generation; electronic commerce; web transactions; electronic security; client authentication; hashed message authentication code.

DOI: 10.1504/IJESDF.2007.016864

International Journal of Electronic Security and Digital Forensics, 2007 Vol.1 No.2, pp.146 - 155

Published online: 26 Jan 2008 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article