E-commerce has grown exponentially over the past decade. In addition, consumers are increasingly using the Internet to perform various other transactions such as banking, information gathering, etc. However, security associated with these on-line transactions has always been a cause for concern for all users. These concerns about security has both hindered growth of on-line transactions and undermined consumer confidence in on-line transactions. One of the major areas of concern for consumers is protecting their sensitive information from getting into the hands of criminals.
One of the predominant ways of stealing sensitive consumer information such as credit card numbers, birth dates, social security numbers, etc. is to hack into a merchant website or into a consumer's computer and steal this information. It is more difficult to compromise a merchant website since most of the reputed merchants use sophisticated technology to keep out the criminals. However, consumer communication devices, e.g., a computer, often lack adequate protection against unauthorized access making them an easy target for stealing sensitive information.
Hackers use numerous techniques such as, Cross-Site Scripting (CSS), Cross-Site Request Forgery (CSRF), Phishing, Cross-frame Scripting, Man-in-the-Middle (MIM), browser cache attacks, cookie exposure, etc. to gain access to sensitive consumer and/or merchant information. One of the predominant methods to conduct these attacks is via an Internet browser, e.g., Internet Explorer, that may be resident on a consumer computer this is usually used to conduct on-line communications and e-commerce transactions.
Conventional techniques for preventing such attacks include providing a sand-boxed environment for conducting on-line transactions. However, even the sandbox solutions are not immune from CSRF attacks that exploit the trust a website has for a user of the website.
What is needed is a system and method to alleviate and mitigate these threats and to provide a secure environment for conducting on-line transactions.