Smart card giant Gemplus SA has teamed up with Verifone Inc to develop a new smart card-based secure transaction system for electronic commerce. The system will be based on the Secure Electronic Transaction protocol, with a new version of Verifone’s vWallet software developed to process the transactions. The transaction process will begin when the consumer accesses the vWallet software. The smart card is then inserted into the card reader which is attached to a personal computer. The user then has to enter a personal identification number, just as bank card holders do when they want to withdraw money from a cash machine. The number unlocks the smart card and the authentication process begins. When the user sends their credit card details to the merchant, the merchant does not actually see it because it goes straight to the financial institution, likely to be a bank. The bank will then confirm there are sufficient – or not sufficient funds as the case may be – on the credit card to enable the transaction to proceed. The system is based on the SET Secure Electronic Transaction standard, which John Landwehr, Gemplus director of product marketing sees as a good potential standard. He sees the problems of establishing SET as a standard as a political battle, rather than technical. According to Landwehr, financial institutions need to lower their transaction charges to merchants operating electronic commerce sites and entice them away from the commonly used Secure Sockets Layer and towards SET. The new vWallet technology is currently being trialed in France as part of the e-Comm pilot, an electronic commerce project involving Gemplus, Visa International Inc, and France Telecom among others. The companies involved believe this technology to be the first to combine smart cards and SET, in France which has 25 million smart cards in circulation. Landwehr is of the opinion that the smart card will penetrate the US market in the future, but not imminently. The emergence of GSM in the US will help smart cards to gather momentum, as will the introduction of the electronic purse. He said: Once wallets become more available, purchasing over the web will become much simpler. But it is not going to happen overnight. With SET and its ‘trusted third party’ authentication certificates, Landwehr believes this will help regulate and prevent fraud in electronic commerce. Although smart cards are being used mainly in Europe at the moment and have yet to make a dent on the US, Netscape Communications Corp – which along with Microsoft Corp uses SSL to communicate with its browser – is keeping an eye on the market and has formed a partnership with smart card security company Litronic Inc. Privately held Orange County, California-based Litronic has three smart card enabled products that support the Communicator browser adding security that conforms to the RSA Labs public key cryptography standard, PKCS#11. Netscape spokesperson Tim Nicholls says he can see the benefits of smart card based web transactions, and when and if SET becomes a standard Netscape will support it. Netscape is covering its back from all directions to make sure it is ready for whatever standard is adopted. At the moment the security process surrounding web-based transactions are complicated, and Nicholls hopes they will get simpler as time goes on, the ideal smart card security being held in a user name and password that has to be known in order to access the device.
Content from our partners
