[Abstract] This paper analyzes the security threats and security requirements of e-commerce under the open Internet environment, and puts forward the security technologies of e-commerce, including encryption, authentication, security protocols, firewall technology and VPN technology, and on this basis, puts forward reasonable security strategies of e-commerce.

[Keywords:] e-commerce encryption technology, authentication technology security strategy

With the continuous development of the Internet, e-commerce, as a product of the combination of network and commerce, is close to people's lives and is attracting more and more attention. However, due to the openness and anonymity of the Internet, there are inevitably a lot of security risks. In e-commerce, security is the core issue that must be considered, and network security solutions are required.

First, e-commerce security issues

In an open network environment such as the Internet, there are always security threats in e-commerce, which can be divided into four categories: 1. Interception and theft of information: if encryption measures are not taken or the encryption intensity is not enough to attack the illegal acquisition of user confidential information by various means. 2. Information distortion: The attacker uses various technologies and means to correct the information on the network halfway and send it to the destination, thus destroying the integrity of the information. 3. Information forgery: Attackers decrypt data or commercial legal information through the network, impersonate legitimate users or send false information to deceive their customers. 4. Transaction denial: refers to the unilateral denial of the transaction by both parties or one party.

The security threats faced by e-commerce The emergence of e-commerce has led to the demand for security, including confidentiality, integrity, authentication, non-repudiation and effectiveness.

Second, e-commerce security technology

For e-commerce security technology, including encryption, authentication technology and e-commerce security protocol, firewall technology.

1. encryption technology

In order to ensure the security of data and transactions, prevent fraud, and confirm the true identity of both parties to the transaction, e-commerce should use encryption technology, which means to protect data security by using codes or passwords. As an explicit data encryption, after being expressed, it is converted into ciphertext by a certain encryption algorithm. We call this process as encryption, and the process of expressing ciphertext through decryption algorithm is called decryption. The encryption algorithm used as the key parameter. The longer the key length, the longer the space bar, and the more time it takes to traverse the key space, the less likely it is to be deciphered. Encryption technology can be divided into two categories: symmetric encryption technology and asymmetric encryption technology. In symmetric encryption technology, DES (Data Encryption Standard) algorithm is a typical representative. Usually asymmetric encryption technology is represented by RSA (Rivest Shamir Adleman) algorithm.

Step 2 prove

Commonly used security authentication technologies are:

(1) digital signature. Signature is a measure to ensure the authenticity and validity of documents, just like generating handwritten signatures. The way is to combine hash function with public key algorithm to generate a hash value from the text of the message sender, and encrypt the hash value with its own private key to form the digital signature of the sender; Then send this digital signature to the receiver as an attachment to the message body and a report message; The message receiver calculates the original hash value from the first message received, and then decrypts the digital signature attached to the message with the public key of the sender; If the two hash values are the same, the receiver can confirm that the digital signature belongs to the sender.

(2) Digital certificate. CA digital certificate is a document issued for the identity of both parties to the transaction, which is digitally signed by CA, including the personal information of the applicant's certificate (public key owner) and the public key file. Digital certificate based on public key system (PKI) is a security tool to verify the identities of two parties in e-commerce transactions. Because it is digitally signed by a certification center, no third party can modify the contents of the certificate. Only when the parties to any transaction apply for the corresponding digital certificate can they participate in online secure e-commerce transactions.

(3) Digital time stamp. In order to prevent the information signed by electronic documents from being modified during the transaction, digital timestamps provide corresponding security. Digital Time Stamp Service (DTS) is provided by specialized agencies. Digital time stamp is an encrypted certificate after the document is formed, which includes three parts: the document needs to add a time stamp summary; Date and time when DTS document was received; DTS digital signature agency.