The Glossary of Electronic Business Terms (стр. 6 )

Open card framework (OCF)

Standard providing computer user's access to secure information from a network by using a smart card as a network security key.

Open Financial Exchange (OFX)

OFX is a communications protocol developed jointly by Microsoft, Intuit, and CheckFree that allows financial institutions, businesses, and consumers to exchange financial data via the Internet. OFX enables to create uniform descriptions of financial data to be sent, perhaps using the SET protocol, that provides authentication currently lacking in SSL transactions.

Open Profiling Standard (OPS)

A standard that lets users to create a personal profile of preferences and interests that they want to share with merchants. The user can decide which personal profile information will be sent to the Web site database in response to its request and thus can protect his privacy. The Web site can use this information to personalise Web pages and collect marketing information.

Open Trading Protocol (OTP)

The protocol, also called “Internet Open Trading Protocol” (IOTP), was created by a global consortium of more than 30 vendors, financial institutions, and payment system organisations. Unlike OBI, which is designed for business-to-business transactions, OTP is aimed to ensure secure and efficient business-to-consumer transactions, regardless of the method of payment used. OTP aims to standardise a variety of activities that span over the entire e-business transaction life-cycle by specifying rules and methodologies to: 1) communicate the terms and conditions of a transaction, including offers for sale, agreements to purchase, and receipts for purchases; 2) acknowledge orders and arrange for delivery of goods and services digitally or physically; 3) support different payment mechanisms by complementing rather than replacing existing payment systems (OTP enables users to process payments from debit/credit cards using smart card technology); 4) provide support for issue and dispute resolution; 5) enable all parties in e-business transactions to keep detailed records of purchases. OTP is extensible: new trading features or approved payment mechanisms can be added if needed without disrupting any OTP protocol already in place. OTP can provide interoperability among catalog and order systems, payment systems, and customer support systems.

OPS – Open Profiling Standard

ORA – Organisational registration authority

Organisational registration authority (ORA)

An organisation, which registers users and vouches for their identity to a certification authority without issuing digital certificates.

OTP – Open Trading Protocol

P

Page view

A number of times one visitor views one Web page or its portion. If a person leaves a page and returns to it without leaving the Web site, two page views are counted. Page views are a more difficult to measure than the page hits but are much more useful and provide an accurate measure of the page popularity. See hit count.

Payment

The process of sending a payment instrument from a payer to a payee and acknowledging the payment by returning a message to the payer.

Payment authority

Financial institution or selling organisation that provides payments to the selling organisations and an invoice or debit to the buying organisation. See OBI.

Payment gateway

Server software that runs on financial processing and bank systems and provides the necessary connections between cardholder and merchant systems and financial processing and bank systems. Payment gateway accepts payment transactions from the Internet in a predefined format and passes them (usually in a different format) to the payment system. Examples of payment gateways include: 1. CyberCash’s Gateway Server; 2. GlobeSet’s GlobeSet Gateway; 3. VeriFone’s vGATE

Payment server

Payment server (also known as a virtual point of sale system) runs on a merchant’s system, sends transactions directly to financial institutions and provide access on the Internet for payment transaction management and reporting. Payment servers interoperate with commerce servers. Examples of payment servers include: 1. CyberCash’s CashRegister; 2. GlobeSet’s GlobeSet POS; 3. VeriFone’s Vpos.

Payment switch

A network service, provided on Web servers, that creates digital representations of conventional negotiable instruments (e. g. checks, drafts, notes, bonds) and forwards them to conventional financial institutions. The switch combines the payment URL with the encrypted buyer identification and password. After authentication of the buyer and the merchant, the switch authorises payment by the buyer to the designated financial institution. Once payment is assured, the switch sends an "access URL" to the buyer that confirms the purchase of an item to be delivered off-line or enables the delivery of an online product or service.

Payment system

A set of instruments, procedures and transfer systems that facilitate the circulation of money.

Payment technology

The collection of techniques that enables a value to be transferred from one organisation or individual to another. Whether a payment is made electronically or by way of cash or even barter, the same key requirements are involved: authentication, authorisation, non-repudiation, data integrity, and privacy.

Payment transaction application layer (PTAL)

An open standard which allows merchants to accept any type of electronic payment over the Internet.

Payment URL

A URL used by a payment switch that specifies a merchant, the merchant's payment switch, the URL of the online product being bought, the price, the digital signature of the payment URL, etc.

Pay-per-click

The payment scheme, which implies that each payment is made automatically and that a request for information means an agreement to pay for it. Typically it is used for paying very small amounts or micro-payments for information or entertainment received over the Internet.

Perfect forward secrecy (PFS)

An approach adopted in some encryption methodologies where a single key permits access only to data protected by that key. This key must not be used to derive any additional keys, and if it was derived from some other keys, these must not be used to derive any more keys.

Personal identification number (PIN)

Identification number that a cardholder needs to indicate for performing a transaction.

Personal wallet

Wallet that stores all information on the customer's computer or on a smart card, complies with a public standard (such as SET) and can enable payments to all merchants without direct involvement of another party. Some personal wallets allow complex financial transactions to be entered, usually via a keyboard.

Personalisation

In particular, tailoring information presented on a Web site to individuals or groups based on profile information, demographics, or prior activities. See explicit profiling, implicit profiling, user profile, case-based personalisation, rules-based personalisation, collaborative filtering, cookie.

PFS – Perfect forward secrecy

PGP – Pretty Good Privacy

Phased expiry schedule

Digital coins expire in phases according to the specifications of the coinage to which they belong. After the first expiry date, coins can no longer be used in payments but can still be deposited back into the holder's account or exchanged for new coins of equal value. After the final expiry date (determined by the Issuer) it will become necessary to make a special request to the bank, and the Issuer may require some time to check the validity of the expired coins before they can be reissued.

PIN – personal identification number

Portal

A gateway or main entrance to the Web. It is intended to be the first site the Internet users connect to and provides at least some of the following essential functions: a catalog of Web sites, a search engine, a Web-based e-mail, and personalised news and services. The typical examples are: Yahoo and Netscape Netcenter.

Prepaid card

A card on which value is stored, and for which the holder has paid the issuer in advance. See also multipurpose prepaid card, stored-value card and electronic purse.

Presentment

Presentment of a negotiable instrument (e. g. a check) as a demand for payment.

Pretty Good Privacy (PGP)

Set of freeware programs written originally by Philip Zimmermann to allow Internet users to have access to high quality encryption services for an electronic mail and data, that successfully defied government restrictions on the public availability of this capability.

Private communications technology (PCT)

Enhancement of the SSL standard proposed by Microsoft.

Private key

The key that is used in an asymmetric cryptosystem for signing and/or decrypting messages and is kept secret by the owner. See asymmetric cryptosystem.

Private use certificate

A digital ID card issued by a private certification authority for private use only (e. g., for intranets or other commercial activities, like home banking).

Profile: A definition of customer preferences, behaviors or demographics.

Psychographic

Segmenting customers by: 1. personality (traits, attitudes, and habits); 2. motives for buying 3. lifestyles (beliefs, income, education), etc.

PTAL – Payment transaction application layer

Public and private key cryptography

The system that uses one pair of keys for each user which are designated as public key and private key. See asymmetric cryptosystem, public key and private key.

Public key

A publicly available key used in an asymmetric cryptosystem to encrypt a message and to verify a digital signature. See asymmetric cryptosystem, private key.

Public key cryptography – see asymmetric cryptosystem

Public key encryption

The same as public and private key cryptography. See asymmetric cryptosystem, public and private key cryptography.: A method of encrypting electronic data. Developed to account for weaknesses in symmetric encryption, public key encryption does not require the transmission of decoding keys themselves.

Public key infrastructure (PKI)

Underlying technical and institutional framework that allows public-key encryption technology to be deployed widely. The PKI will determine the policies for issuance of digital certificates, will issue and revoke certificates, and will save the information needed for subsequent validation of the certificates. It will include certification authorities organised both in hierarchies and in peer-to-peer networks. Supported applications could include: a secure e-mail, payment protocols, electronic checks, EDI, IP network security, electronic forms, and digitally signed documents. The PKI involves means of authentication and encryption, and a system that uses public-key cryptography. See public and private key cryptography, asymmetric cryptosystem, digital certificate, and certification authority.

Public use certificate

General purpose digital ID card issued by a recognised certification authority.

Purse – see electronic purse

R

Real time transaction

A transaction (e. g., Internet payment transaction) that is processed (e. g., checked and validated) immediately (e. g., after a customer completes the order form).

Remote wallet

Remote or server-side wallet that stores financial information on the Web so it can be used with a community of merchants. It provides cross-site support but interposes a new party between customer and merchant. This kind of wallets may be provided by a bank or a portal.

Repudiation

The case where the holder of a certificate denies signing a particular document and/or validity of the signature because, for example, the certificate is no longer in the hands of the proper owner (and thus it is out of owner's control).

Requisitioner

A person, who wishes to purchase goods, accesses online catalogs of suppliers and places an order (a requisition) with the supplier. See OBI.

Revenue-sharing agreement

Agreement according to which publishers receive a commission, paid upon sale, for sales that result from an ad.

Revocation

Process where a certification authority Invalidation ofesinvalidates a previously issued certificate by the certification authority.

Revoke a certificate

To make a certificate permanently ineffective from a specified time. Revocation is effected by notation or inclusion the certificate in a set of revoked certificates, and does not imply that a revoked certificate is destroyed or made illegible.

Root CA – root certification authority

Root certificate

The first certificate (with its associated public and private keys) from which all other certificates issued by a particular certification authority and associated subsidiary certification authorities are derived. See certification hierarchy.

Root certification authority (Root CA)

The highest-level certification authority in the certification hierarchy. See root certificate, certification hierarchy.

Rules-based personalisation

Application of a set of predefined rules to a content (e. g, territorial region), a customer type (e. g., "big spender"), a customer profile data (e. g., car owner), etc. to identify Web site content to be presented to the customer. See collaborative filtering, case-based personalisation.

S

SCF – Smart Card Forum

SCM – supply chain management

Seal of Assurance – see WebTrust

Secret key – see symmetric cryptography

Secure Courier

A protocol developed by Netscape which encrypts portions of online transaction data in "secure digital envelopes" so that they can be sent by consumers to financial institutions without being understood by intermediaries (e. g. merchants) or by unauthorised parties. The protocol is based on SSL and provides functionality similar to CyberCash.

Secure Electronic Payment Protocol (SEPP)

An electronic payment protocol developed and supported by IBM, Netscape, GTE, and others.

Secure Electronic Transaction (SET)

An open, vendor-neutral, non-proprietary, license-free specification developed by MasterCard and Visa that provides a method of securing payment card transactions over open networks. Co-developers and supporters include virtually all the major players in the electronic commerce area, including Microsoft, CyberCash, GTE, IBM, Netscape, RSA Data Security, Terisa Systems, and VeriSign. It is designed to ensure security for bank card transactions over the Internet. SET uses asymmetric cryptography to provide confidentiality of information, ensure payment integrity, and authenticate all participants in a card-based payment transaction. It denies merchants access to credit card information, thus keeping it secure between the buyer and the credit card issuer. See also Open Financial Exchange.

Secure hash code -

A condensed version of the document, which is created by applying a hash function to an electronic version of the document and from which it is computationally infeasible to identify or recreate the original document without extrinsic knowledge of their correspondence. See also message digest, hash function, digital signature.

Secure hash function -

A mathematical algorithm that translates one record into another, generally a smaller one (the hash code), such that – (a) a record yields the same hash result every time the algorithm is executed using the same record as an input, (b) it is computationally infeasible to reconstitute the record from the hash result produced by the algorithm, and (c) it is computationally infeasible that two records can be found that produce the same hash result using the algorithm. See also message digest, hash function, digital signature.

Secure Hypertext Transfer Protocol (S-HTTP)

A version of HTTP, developed by Netscape, that provides general security of transactions in the Internet.

Secure server

A server that uses the Secure Sockets Layer (SSL) protocol to provide security and privacy, by encrypting data for transfer over TCP/IP networks, including the Internet.

Secure Sockets Layer (SSL)

A protocol designed by Netscape Communications for authentication and encryption over TCP/IP networks, including the Internet. SSL is used mostly (but not exclusively) to create a secure link between Web browsers and Web servers, providing privacy, authentication, and message integrity. Secure Socket Layer uses a system of public and private key authentication combined with other schemes. It is more simple but less secure than SET.

Secure Web server

A Web server that allows the secure transmission of confidential data, such as credit card information and commonly uses the Secure Sockets Layer protocol to encrypt transmissions.

Security

With regard to the Internet, security can be broken into at least two broad areas, host security and transaction security. Host security involves protecting a server from malicious or destructive behaviour of people who try to break into and/or disrupt a server or cause it to crash. Transaction security refers to the protection of financial and sensitive information sent over or stored on the Internet.

Security certificate

The certificate that is required by the SSL protocol to establish a secure connection and contains: the certificate owner, the certificate issuer, the validity period, an encrypted information that can be used to verify the contents of the certificate. In order for a SSL connection to be created both sides must have a valid Security Certificate. See also certification authority, SSL.

Segmentation

Breaking down into definable subcategories.

Selling organisation – see OBI

Sell Side: Processes for companies to sell their products, including catalogs, transaction processors, payment processors, and supply chain management methods and tools. Processes occurring downstream from the company with trading partners, distributors, end consumers, etc.

Sell-side electronic business application

Applications used by sellers for marketing and selling their products on the Web, as well as for handling order management and fulfilment (e. g., software for providing electronic catalogs, shopping baskets, personalisation, order management, and payment).