安全电子交易协议

安全电子交易的国际标准之一

安全电子交易协议(secure Electronic Transaction简称SET) 由威士(VISA)国际组织、万事达(MasterCard)国际组织创建，结合IBM、Microsoft、Netscope、GTE等公司制定的电子商务中安全电子交易的一个国际标准。

简介

中文

其主要目的是解决信用卡电子付款的安全保障性问题，这包括：保证信息的机密性，保证信息安全传输，不能被窃听，只有收件人才能得到和解密信息；保证支付信息的完整性，保证传输数据完整接收，在中途不被篡改；认证商家和客户，验证公共网络上进行交易活动包括会计机构的设置、会计人员的配备及其职责权利的履行和会计法规、制度的制定与实施等内容。合理、有效地组织会计工作，意义重大，它有助于提高会计信息质量，执行国家财经纪律和有关规定；有助于提高经济效益，优化资源配置。会计工作的组织必须合法合规。讲求效益，必须建立完善的内部控制制度，必须有强有力的组织保证。

英文原文

People today pay for online purchases by sending their credit card details to the merchant. A protocol such as SSL or TLS keeps the card details safe from eavesdroppers, but does nothing to protect merchants from dishonest customers or vice-versa. SET addresses this situation by requiring cardholders and merchants to register before they may engage in transactions. A cardholder registers by contacting a certificate authority, supplying security details and the public half of his proposed signature key. Registration allows the authorities to vet an applicant, who if approved receives a certificate confirming that his signature key is valid. All orders and confirmations bear digital signatures, which provide authentication and could potentially help to resolve disputes.

A SET purchase involves three parties: the cardholder, the merchant, and the payment gateway (essentially a bank). The cardholder shares the order information with the merchant but not with the payment gateway. He shares the payment information with the bank but not with the merchant. A set dual signature accomplishes this partial sharing of information while allowing all parties to confirm that they are handling the same transaction. The method is simple: each party receives the hash of the withheld information. The cardholder signs the hashes of both the order information and the payment information. Each party can confirm that the hashes in their possession agrees with the hash signed by the cardholder. In addition, the cardholder and merchant compute equivalent hashes for the payment gateway to compare. He confirms their agreement on the details withheld from him.

All parties are protected. Merchants do not normally have access to credit card numbers. Moreover, the mere possession of credit card details does not enable a criminal to make a SET purchase; he needs the cardholder’s signature key and a secret number that the cardholder receives upon registration. The criminal would have better luck with traditional frauds, such as ordering by telephone. It is a pity that other features of SET (presumably demanded by merchants) weaken these properties. A merchant can be authorized to receive credit card numbers and has the option of accepting payments given a credit card number alone.

SET is a family of protocols. The five main ones are cardholder registration, merchant registration, purchase request, payment authorization, and payment capture. There are many minor protocols, for example to handle errors. SET is enormously more complicated than SSL, which merely negotiates session keys between the cardholder’s and merchant’s Internet service providers. Because of this complexity, much of which is unnecessary, the protocol is hardly used. However, SET contains many features of interest:

The model is unusual. In the registration protocols, the initiator possesses no digital proof of identity. Instead, he authenticates himself by filing a registration form whose format is not specified. Authentication takes place outside the protocol, when the cardholder’s bank examines the completed form.

The dual signature is a novel construction. The partial sharing of information among three peers leads to unusual protocol goals.

SET uses several types of digital envelope. A digital envelope consists of two parts: one, encrypted using a public key, contains a fresh symmetric key K and identifying information; the other, encrypted using K, conveys the full message text. Digital envelopes keep public-key encryption to a minimum, but the many symmetric keys complicate the reasoning. Most verified protocols distribute just one or two secrets.

SET系统的组成

SET支付系统主要由持卡人（CardHolder）、商家（Merchant）、发卡行（Issuing Bank）、收单行（Acquiring Bank）、支付网关（Payment Gateway）、认证中心（Certificate Authority）等六个部分组成。对应地，基于SET协议的网上购物系统至少包括电子钱包软件、商家软件、支付网关软件和签发证书软件。

工作流程

1）消费者利用自己的PC机通过因特网选定所要购买的物品，并在计算机上输入订货单、订货单上需包括在线商店、购买物品名称及数量、交货时间及地点等相关信息。

2）通过电子商务服务器与有关在线商店联系，在线商店作出应答，告诉消费者所填订货单的货物单价、应付款数、交货方式等信息是否准确，是否有变化。

3）消费者选择付款方式，确认订单签发付款指令。此时SET开始介入。

4）在SET中，消费者必须对订单和付款指令进行数字签名，同时利用双重签名技术保证商家看不到消费者的账号信息。

5）在线商店接受订单后，向消费者所在银行请求支付认可。信息通过支付网关到收单银行，再到电子货币发行公司确认。批准交易后，返回确认信息给在线商店。

6）在线商店发送订单确认信息给消费者。消费者端软件可记录交易日志，以备将来查询。

7）在线商店发送货物或提供服务并通知收单银行将钱从消费者的账号转移到商店账号，或通知发卡银行请求支付。在认证操作和支付操作中间一般会有一个时间间隔，例如，在每天的下班前请求银行结一天的帐。

前两步与SET无关，从第三步开始SET起作用，一直到第六步，在处理过程中通信协议、请求信息的格式、数据类型的定义等SET都有明确的规定。在操作的每一步，消费者、在线商店、支付网关都通过CA（认证中心）来验证通信主体的身份，以确保通信的对方不是冒名顶替，所以，也可以简单地认为SET规格充分发挥了认证中心的作用，以维护在任何开放网络上的电子商务参与者所提供信息的真实性和保密性。

全国各地天气预报查询

上海市

云南省

云南省

云南省

云南省

云南省