| Name: | Description: | Size: | Format: | |
|---|---|---|---|---|
| 2.38 MB | Adobe PDF |
Authors
Advisor(s)
Abstract(s)
O roubo de informação respeitante a cartões de crédito é uma ameaça ao comércio electrónico. Os sistemas de pagamento introduziram o conceito do CVV2 como forma de mitigar o risco baseado no princípio de que estes valores não deveriam ser armazenados uma vez completa a transação. Sistemas, comunicações e bases de dados comprometidos resultam na captura ilícita desta credencial de autenticação frustrando assim o seu propósito inicial.
Este estudo propõe a criação de CVVs dinâmicos (enhanced CVVs) como forma de contrariar estes ataques. Desta forma, o compromisso de todos os elementos presentes numa ou mais transações não são suficientes para garantir o sucesso na autenticação de transações subsequentes.
É essencial que qualquer novo método de pagamento tome em conta os factores determinantes para que seja aceite por todas entidades participantes. Este estudo propõe dois métodos de CVVs dinâmicos: Matriz de CVVs e CVVs Longos. Os métodos propostos baseiam-se na infraestrutura atual de pagamentos baseados em cartões, com o objectivo de mitigar as maiores ameaças atuais, tendo o cuidado de manter o delicado equilíbrio dos factores determinantes para todos os participantes.
Ambos os métodos são analisados na vertente da segurança de forma a avaliar, e comparar, o nível de resistência perante situações de compromisso de transações. Questões relativas à implementação e à migração são igualmente analisadas de forma a determinar os impactos respeitantes à adoção dos métodos propostos.
Theft of credit card information is an increasing threat to e-commerce. Payment systems introduced CVV2 as a method to mitigate the threat based on the principle that these values would not be stored once the transaction has completed. Compromised systems, communications and databases result in the unlawful capture of this authentication credential and therefore thwart its initial purpose. This study proposes the creation of dynamic CVVs (enhanced CVV2s) in order to counter these attacks. Thus a compromise of all the elements in one or more transactions will not be sufficient to guarantee successful authentication of subsequent payments. It is essential for success, that any new payment scheme take into account the key factors determinant for the acceptance of each of the participating parties. Two implementation schemes of enhanced CVVs are proposed: Matrix CVVs and Long CVVs. The proposed methods build upon the current card based e-payment infrastructure with the objective of mitigating present day threats whilst maintaining the delicate equilibrium of key factors for all participating parties. Both schemes are analysed at a security level so as to evaluate, and compare, the level of resistance function of the number of previously compromised transactions. Implementation and migration issues are equally analysed so as to determine the impacts of adoption of the proposed schemes.
Theft of credit card information is an increasing threat to e-commerce. Payment systems introduced CVV2 as a method to mitigate the threat based on the principle that these values would not be stored once the transaction has completed. Compromised systems, communications and databases result in the unlawful capture of this authentication credential and therefore thwart its initial purpose. This study proposes the creation of dynamic CVVs (enhanced CVV2s) in order to counter these attacks. Thus a compromise of all the elements in one or more transactions will not be sufficient to guarantee successful authentication of subsequent payments. It is essential for success, that any new payment scheme take into account the key factors determinant for the acceptance of each of the participating parties. Two implementation schemes of enhanced CVVs are proposed: Matrix CVVs and Long CVVs. The proposed methods build upon the current card based e-payment infrastructure with the objective of mitigating present day threats whilst maintaining the delicate equilibrium of key factors for all participating parties. Both schemes are analysed at a security level so as to evaluate, and compare, the level of resistance function of the number of previously compromised transactions. Implementation and migration issues are equally analysed so as to determine the impacts of adoption of the proposed schemes.
Description
Keywords
Pagamentos electrónicos Comércio electrónico Número de cartão de crédito CVC2 CVV2 Problema do colecionador de cromos E-payments E-commerce Credit card number Coupon collectors problem