Design and Implementation of Challenge Response Protocol for Enhanced e-Commerce Security

The environment of the proposed Scan2Pass is described in detail. Confidentiality is provided at the application level in the system to protect user credential in both entities (the user and the server) for preventing brute force and dictionary attacks. A security mechanism is also provided to maintain confidentiality at the transport level. The HTTP Strict Transport Security in the system ensures that all connections between entities will be upgraded to HTTPS only. This way guarantees that all data and sensitive information transmitting between both sides are protected. The implementation of Scan2Pass presents a possible deployment of the system and describes the components of the prototype. Implementation and testing confirm that the proposed Scan2Pass is fast and easy to use and learn. In particular, users without much experience with smartphones can easily use the proposed system after seeing it done only once. Therefore, the proposed system model is convenient for users because of the absence of the burden of carrying a separate hardware token or extra charges from the short message service. The design and implementation of a challenge–response protocol for enhanced e-commerce security are also elaborated.