Risken att en obehörig part kan komma över och använda en enskild konsuments identitets-handlingar är stor, samtidigt som individens möjlighet att kontrollera hur och när dess iden-titet används är liten. Problemformuleringen som skulle besvaras var hur identitetsstölder och bedrägerier på internet kunde minimeras samtidigt som konsumenten får ett ökat infly-tande över hanteringen av sin identitet. Målsättningen var att centralisera och skapa ett gemensamt förhållningssätt för identitets-hantering på internet till förmån för konsumenterna, och på så vis minimera spridning av egna lösningar för identitetshantering hos enskilda aktörer. Lösningen resulterade i en systemmodell med förutsättningar för att autentisera konsumen-ten, hantera filter för hur enskilda identitetshandlingar får användas på internet, samt för att möjliggöra kommunikation med konsumenten genom att skicka notifikationer om händelser som uppstått kopplat till en specifik identitet. Genom en användarportal skulle konsumen-ten kunna administrera sina filter för olika e-tjänster och webbutiker samt få en överblick över specifika händelser som inträffat. En prototyp togs fram för att demonstrera systemmodellens grundläggande funktionalitet i praktiken. Denna kom att innefatta funktionalitet för att autentisera konsumenten, skicka notifikationer om händelser och kontrollera existerande filter för en specifik identitet. Pro-totypen kom att bestå av ett förenklat system enligt den modell som tagits fram, med ett tillhörande API samt två modeller motsvarande en webbutik och en betalningsväxel som skulle nyttja funktionaliteten genom att anropa systemets API. Lösningen utvärderades baserat på det uppnådda resultatet från intervjuer med experter inom problemområdet och genomförd funktionskontroll av den framtagna prototypen. Ge-nom utvärderingen kunde slutsatsen dras att identitetsbaserade bedrägerier med stor sanno-likhet skulle sjunka drastiskt och att den enskilde konsumentens inflytande och medveten-het skulle stärkas. Den största bidragande faktorn till slutsatsen ansågs främst vara det kon-sistenta och standardiserade sätt som skapats för autentisering av och kommunikation med konsumenten. På så vis skulle aktörerna själva avsätta delar av den funktionalitet och de säkerhetsrisker som ansågs finnas i anslutning till hanteringen av identiteter på internet. Svårigheterna med den föreslagna lösningen ansågs vara att få konsumenter, webbutiker och betalningsväxlar att ansluta sig till ett centralt system då man av affärsmässiga skäl väljer att behålla särskilda delar internt. / There's a high risk that an unauthorized party can gain access to and use a consumer's iden-tity. This while the ability to control how and when a personal identity is used is small. The question to be answered were regarding how identity theft and online fraud could be mi-nimized and give the consumers a greater influence and more control over the management of their identity online. The goal was to centralize and establish a common approach for identity management on-line, with greater benefits for consumers. Through central service individual consumers would be able to set conditions for which online shops and services would be able to access their identities and grant access in each specific transaction. This would remove the need for non-central control of identities and as a result remove the need for independent storage of identity information. The solution would result in a system model with the potential to authenticate the consu-mer, managing conditions for how individual identity documents may be used online and to provide the consumer with a online history by sending notifications of events that has occurred with regard to a specific identity. A prototype was developed to demonstrate the basic functionality in practice. This included the functionality to authenticate the consumer with Mobile BankID, send notifications about events and check existing conditions regarding a specific identity. This prototype came to consist of a simplified system according to the model developed, an associated API, and two models representing an online store and a payment provider that would utilize the functionality of the system by calling the API. The proposed solution was evaluated through two interviews with experts in the fields of IT Security and e-commerce. The conclusion was that identity fraud would probably drop drastically and the individual consumer influence and awareness would be fortified. The main reason for this was considered to be primarily through the consistent and standardized way for authentication of and communication with the consumer. This would remove the individual risk for online services. The challenge with this proposed solution is believed to be getting consumers, online re-tailers and payment providers to accept a central solution instead of relying on internally developed and disconnected solution.

<p>The purpose of this thesis work was to make a survey of current on-line payment technologies and find out which are they and how do they work? Compare and analyze them from a security point of view, as well as a usability point of view. What is good? What is bad? What is lacking?</p><p>To achieve this purpose, an overview of the current on-line payment technologies was acquired through academic books and papers, Internet sites, magazines. Basic cryptographic and security related techniques were studied for the security analysis of current on-line payment systems.</p><p>In this work, various current on-line payment systems were classified into two groups [Macro and Micro on-line payment systems]. This classification was based on the mode of on-line payment transactions. To analyze these on-line payment systems, a set of payment system requirements were formed [Security Issues, Usability Issues, Anonymity, Scalability etc].</p><p>Under the category of Macro payment system, Credit Card payment system, Debit Card payment system, Stored Value Card payment system, Electronic Check payment system, Electronic Cash payment system, Electronic account transfer payment system and mobile payment system transactions were examined.</p><p>Under the category of Micro payment system, Hash Chain based Payment System, Hash Collisions and Hash sequences based Payment Systems, Shared Secrete Keys based Payment Systems and Probability based payment systems were examined.</p><p>Based on the requirements of payment system, these on-line payment systems were analyzed and compared. In the analysis phase, the advantages and drawbacks of these payment systems were figured out.</p><p>It was found from the study that the credit card based payment systems are the most widely used means of conducting on-line payments. It is evident that credit card based payment systems satisfy stakeholder requirements the best, as they offer more flexible payment options, having a large user-base, benefit from familiarity and simplicity of use and also allow international payments. The other on-line payment systems lack this flexibility</p><p>It can also be extracted from the study that users want more simplified, convenient and secure on-line payment systems. Thus the futuristic on-line payment systems will have all secure payment options into one system.</p>

The purpose of this thesis work was to make a survey of current on-line payment technologies and find out which are they and how do they work? Compare and analyze them from a security point of view, as well as a usability point of view. What is good? What is bad? What is lacking? To achieve this purpose, an overview of the current on-line payment technologies was acquired through academic books and papers, Internet sites, magazines. Basic cryptographic and security related techniques were studied for the security analysis of current on-line payment systems. In this work, various current on-line payment systems were classified into two groups [Macro and Micro on-line payment systems]. This classification was based on the mode of on-line payment transactions. To analyze these on-line payment systems, a set of payment system requirements were formed [Security Issues, Usability Issues, Anonymity, Scalability etc]. Under the category of Macro payment system, Credit Card payment system, Debit Card payment system, Stored Value Card payment system, Electronic Check payment system, Electronic Cash payment system, Electronic account transfer payment system and mobile payment system transactions were examined. Under the category of Micro payment system, Hash Chain based Payment System, Hash Collisions and Hash sequences based Payment Systems, Shared Secrete Keys based Payment Systems and Probability based payment systems were examined. Based on the requirements of payment system, these on-line payment systems were analyzed and compared. In the analysis phase, the advantages and drawbacks of these payment systems were figured out. It was found from the study that the credit card based payment systems are the most widely used means of conducting on-line payments. It is evident that credit card based payment systems satisfy stakeholder requirements the best, as they offer more flexible payment options, having a large user-base, benefit from familiarity and simplicity of use and also allow international payments. The other on-line payment systems lack this flexibility It can also be extracted from the study that users want more simplified, convenient and secure on-line payment systems. Thus the futuristic on-line payment systems will have all secure payment options into one system.