Give me all I pay fo Execution Guaantees in Electonic Commece Payment Pocesses Heiko Schuldt Andei Popovici Hans-Jög Schek Email: Database Reseach Goup Institute of Infomation Systems ETH Zentum, 8092 Züich, Switzeland schuldt,popovici,schek @inf.ethz.ch Abstact Electonic Commece ove the Intenet is one of the most apidly gowing aeas in todays business. Howeve, consideing the most impotant phase of Electonic Commece, the payment, it has to be noted that in most cuently exploited appoaches, suppot fo at least one of the paticipants is limited. Fom a geneal point of view, a couple of equiements fo coect payment inteactions exist, namely diffeent levels of atomicity in the exchange of money and goods of a single custome with diffeent mechants. In this pape, we identify the diffeent equiements paticipants demand on Electonic Commece payments fom the point of view of execution guaantees and pesent how payment inteactions can be implemented by tansactional pocesses. Finally, we show how these execution guaantees can be povided fo payment pocesses in a natual way by applying the ideas of tansactional pocess management to an Electonic Commece Payment Coodinato. 1 Intoduction Along with the enomous polifeation of the Intenet, Electonic Commece (E-Commece) is continuously gaining impotance. The spectum of applications that ae subsumed unde the tem E-Commece leads fom athe simple odes pefomed by Email to the puchase of shopping baskets consisting of seveal goods oiginating fom diffeent mechants by spending electonic cash tokens. Remakably, E-Commece is a vey intedisciplinay eseach aea. As existing appoaches ae poweed by diffeent communities (i.e., cyptogaphy, netwoking, etc.), they ae vey heteogeneous in natue and thus always focus on diffeent special poblems. Fom the point of view of the database community, atomicity popeties have been identified as one key equiement fo payment potocols in E-Commece [Tyg96, Tyg98]. The moe complex inteactions with consumes and mechants become, the moe dimensions of atomicity have to be addessed. In the simplest case, only money has to be tansfeed atomically fom the consume to the mechant. Howeve, consideing complex shopping baskets filled with (electonic) goods fom seveal mechants, atomicity may also be equied fo the puchase of all these goods oiginating fom diffeent possibly independent and autonomous souces, along with the atomic exchange of money and all goods. Due to thei distibuted natue, potocols that have been suggested to suppot payment atomicity in E- Commece impose high equiements on the paticipating instances (e.g., NetBill [CTS95]). Howeve, with a centalized payment coodinato, the complex inteactions of the vaious paticipants can be embedded within a payment pocess, thus educing the peequisites fo mechants and customes to paticipate in E-Commece. Tansactional pocess management [SAS99] can then be exploited in ode to povide the necessay execution guaantees fo tansactional E-Commece payment pocesses in a natual way. This pape is stuctued as follows: In Section 2, we povide a geneal famewok fo E-Commece payment inteactions. Based on this famewok, we analyze the diffeent atomicity equiements fo E Commece payment (Section 3). Then, in Section 4, we summaize tansactional pocess management and 1
pesent the stuctue of a tansactional payment pocess allowing the equied execution guaantees to be povided by a Payment Coodinato. Section 5 finally concludes the pape. 2 Schema fo Payment Potocols in E-Commece The desciption of sales inteactions in non-electonic makets [Sch98] encompasses thee phases: infomation, negotiation, and payment. Duing the infomation phase, a custome evaluates and compaes the offes of seveal mechants. Afte selecting the best offe, she negotiates with the chosen mechant the conditions fo the deal (negotiation). If they each an ageement, the last step (the payment) involves the money tansfe fom custome to mechant and the sevice (the mechant fulfills his contact). Most electonic payment systems focus only on the money tansfe of the last phase. Ou view of an electonic payment scheme also consides the systems and potocols fo accomplishing both the money tansfe and the sevice. 2.1 Paticipants An electonic payment scheme involves paticipants oiginating fom two distinct wolds: on the Intenet side thee ae the custome, the mechant and a thid entity, the payment seve which coodinates the two. The othe side is epesented by the financial wold with its popietay netwok infastuctue and potocols. The paticipants ae financial institutes and again the payment seve, that has to consistently tansfom the data flow on the Intenet side in coesponding eal wold money flow. The paticipants ae depicted in Figue 1. 2.2 Steps of an E-Commece Tansaction Pio to the payment tansaction, the paticipants ae involved in an initialization phase, depicted in Figue 1 by dashed aows. Both custome and mechant have to establish accounts within the financial institutes issue (o acquie, esp.). The tansfomation of electonic money into eal money is pefomed using these accounts. Also in this phase the custome eceives fom his bank a custome secet which enables him to pefom electonic payments. The custome secet is visible only fo the custome heself, fo the issuing bank and (eventually) fo the payment seve. The most common fom of the custome secet is a cedit cad numbe, in electonic cash schemes (such as ecash [Dig99]), the custome secet is an E-cash token. Because account opeations ae athe less often than payments, we can conside them as pat of the initialization phase. Almost all the payment schemes contain the five following steps, maked in Figue 1: Negotiation (1): the custome selects the desied sevice o mechandise she wants fom the mechant, and negotiates with the mechant the pice of the sevice. The esult of this step is the Ode Infomation. The Ode Infomation is a potocol of the negotiation phase, including sevice (mechandise) and pice specification. Payment ode (2): the custome sends Payment Infomation (PI) and Ode Infomation ( ) to the mechant. The is the custome s view of the ageement with the mechant. Payment authoization (3): the mechant fowads PI,, and additional data to the payment seve. is the mechant s view of the ageement with the custome. The payment seve diectly o indiectly veifies the validity of the payment infomation, the consistency of the payment using and. It eventually tigges the eal wold money tansfe using its ole on the non-intenet side. At the end of the payment authoization, the mechant eceives a confimation message C fom the payment seve (4). Puchase esponse (5): The mechant sends himself a confimation to the custome. In case of electonic (non-tangible) goods, the puchase esponse can be immediately followed by the mechandise o the sevice itself. 2
Custome negotiation (1) (5) (2) (3) C (4) Mechant Payment Seve Issue Financial Netwok Acquie Figue 1: Geneic payment steps In most existent payment potocols, the payment seve is invoked by the mechant. This is no intinsic estiction, and communication between custome and payment seve is also possible. 2.3 Chaacteistics of Payment Potocols Seveal citeia seve as classification models of electonic payment schemes. Stating fom the moment of tansfomation of eal money into electonic money, payment potocols can be split in pe-paid systems and pay-by-instuction ones. Atomicity is anothe item, which will be discussed in detail late. Some potocols intoduce the notion of povability, which is the ability of each paty to pove thei coect inteactions. Anonymity is especially addessed by cash-based-systems. Thee ae also implementation issues like scalability, flexibility, efficiency, ease of use and off-line opeation, which ae also impotant because of the lage numbe of uses expected. 3 Atomicity in Electonic Commece One key equiement in E-Commece is to guaantee atomic inteactions between the vaious paticipants in E-Commece payment. As E Commece and thus also payment takes place in a highly distibuted and heteogeneous envionment, vaious aspects of atomicity can be identified: aside of money and goods atomicity [Tyg96, Tyg98], also the atomic inteaction of a custome with multiple mechants is needed. In what follows, we analyze and classify these diffeent atomicity equiements in detail. Money Atomicity The basic fom of atomicity in E-Commece is associated with the tansfe of money fom the custome to the mechant. This is denoted by the tem money atomicity [Tyg96]. As no viable E-Commece payment solution can exist without suppoting this atomicity popety, multiple solutions have been poposed o ae aleady established [MV96, Dig99]. Howeve, the atomicity popety is tightly coupled with the potocol achitectue and design. Cetified Atomic Delivey Aside of money, also goods have to be tansfeed. Theefoe, a futhe equiement is that the delivey takes place atomically. This can even be einfoced in that both associated paties custome and mechant equie the necessay infomation in ode to pove that the goods sent (o eceived, esp.) ae the ones both paties ageed to in the initial negotiation phase (cetified atomic delivey, encompassing the goods atomicity and the cetified delivey descibed in [Tyg96]). This stengthened equiement esults fom the fact that in contast to taditional distibuted database tansactions whee only technical failues have to be addessed in E Commece also faudulent behavio of paticipants has to be coped with. Especially when dealing with goods that can be tansfeed electonically, the combination of money atomicity and cetified delivey is 3
an impotant issue. In [CHTY96], this is ealized by a customized Two-Phase-Commit potocol [GR93]. Distibuted Puchase Atomicity In many E-Commece applications, inteaction of customes is not limited to a single mechant. Conside, fo instance, a custome who wants to puchase specialized softwae fom a mechant. In ode un this softwae, she also needs an opeating system which is, howeve, only available fom a diffeent mechant. As both goods individually ae of no value fo the custome, she needs the guaantee to pefom the puchase tansaction with the two diffeent mechants atomically in ode to get both poducts o none. Distibuted puchase atomicity addesses the encompassment of inteactions with diffeent independent mechants into one single tansaction. Most cuently deployed payment coodinatos suppot only money atomicity while some advanced systems addess also distibuted puchase atomicity. Howeve, all thee dimensions ae to ou best knowledge not povided by existing systems and potocols although the highest level of guaantees would be suppoted and although this is equied by a set of eal-wold applications. This lack of suppot fo full atomicity in E-Commece payment is addessed by ou cuent eseach activities whee we apply tansactional pocess management (section 4) to ealize an E-Commece Payment Coodinato. 4 Tansactional Pocesses fo E-Commece Payments In this section, we intoduce the theoy of tansactional pocess management that povides a citeion fo the coect execution of pocesses with espect to ecovey (when failues of single pocesses have to be consideed) and concuency contol (when multiple paallel pocesses access shaed esouces simultaneously) and we point out how this theoy can be applied fo payments in E Commece. 4.1 Tansactional Pocess Management In conventional databases, concuency contol and ecovey ae well undestood poblems. Unfotunately, this is not the case when tansactions ae gouped into entities with highe level semantics, such as tansactional pocesses. Although concuent pocesses may access shaed esouces simultaneously, consistency has to be guaanteed fo these executions. Tansactional pocess management [SAS99] has to enfoce consistency fo concuent executions and, at the same time, to cope with the added stuctue found in pocesses. In paticula, and unlike in taditional tansactions, pocesses intoduce flow of contol as one of the basic semantic elements. Thus, it has to be taken into consideation that pocesses aleady impose odeing constaints among thei diffeent opeations and among thei altenative executions. Similaly, pocesses integate invocations to applications with diffeent atomicity popeties (e.g., activities may o may not be semantically compensatable). The main components of tansactional pocess management consist of a coodinato acting as top level schedule and seveal tansactional coodination agents [SSA99] one fo each subsystem paticipating in tansactional pocesses acting as lowe level schedules. Pocesses encompass activities which ae invocations in subsystems scheduled by the coodinato. The coodinato s task is to execute tansactional pocesses coectly with espect to concuency contol and ecovey. Fistly, the execution guaantees to be povided include guaanteed temination, a moe geneal notion of atomicity than the standad all o nothing semantics which is ealized by patial compensation and altenative executions. Secondly, the coect paallelization of concuent pocesses is equied and thidly, by applying the ideas of the composite systems theoy [ABFS97], a high degee of paallelism fo concuent pocesses is to be povided. The key aspects of tansactional pocess management can be biefly summaized as follows: The coodinato acts as a kind of tansaction schedule that is moe geneal than a taditional database schedule in that it i.) knows about popeties of activities (compensatable, etiable, o pivot, taken fom the flex tansaction model [MRSK93, ZNBB94]), ii.) knows about altenative executions paths in case of failues, and iii.) knows about semantic commutativity of activities. 4
Based on this infomation, the coodinato ensues global coectness but only unde the assumption that the activities within the pocesses to be scheduled themselves povide tansactional functionality (such as, fo instance, atomicity, compensatability, ode-pesevation, etc.). 4.2 Tansactional Payment Pocesses Accoding to [MWW98], tade inteactions between customes and mechants can be classified in thee phases: pe-sales, sales and post-sales. While the sales phase has a well-defined stuctue (especially the payment pocessing, see section 2), this is in geneal not the case fo the pe-sales and the post-sales phase. Due to this well-defined stuctue, pocesses ae a highly appopiate means to implement the inteactions that have to be pefomed fo payment puposes. Futhemoe, all atomicity equiements fo payments in E Commece can be ealized in an elegant way by applying the ideas of tansactional pocess management in an E-Commece Payment Coodinato. These pocesses ae extensions of anonymous atomic tansactions descibed in [CHTY96], they ely on electonic cash token as means of payment, and ae pimaily designed fo the puchase of electonically available goods that ae tansfeed in an encypted way to the custome pio to the payment. Futhemoe, the idea of tansactional payment pocesses is to encompass all inteactions between the paticipants (custome, mechants and bank). To this end, and in contast to the cuently applied payment schemes, the payment has to be initiated by the custome by invoking a payment pocess at the Payment Coodinato 1. The stuctue of a tansactional payment pocess can be seen in figue 2. The pecedence odes ae depicted by solid acs while fo the pefeence ode, dotted acs ae used. Fo each activity, the associated temination popety (compensatable, pivot, etiable) is also given. c Receive Payment Ode c Check validity of token (Bank) Receive Key (Mechant) c c Receive Key (Mechant) Check Timeout p p Send Keys to Custome Abot Notify Custome Notify Bank Notify Mechants Money tansfe (Bank) Send confimation to Mechants Commit Figue 2: Stuctue of Payment Pocess When a payment pocess is invoked, the custome fist has to specify the payment infomation and all bilateally ageed ode infomation (and thus also all diffeent mechants) that have to be encompassed within one single payment tansaction. Theefoe, a tuple!#"%$'&)(* with ode infomation!#" and mechant identifie & fo each poduct + with,.-/+0-1 has to be sent to the Payment Coodinato 1 Like in the taditional case, the custome has in the initial negotiation phase to agee upon the way the payment is pocessed with all mechants. 5
(eceive payment ode). Then, the value and validity of the payment infomation is checked (check validity of token). Given the validity of the payment infomation, the Payment Coodinato contacts all mechants, asks them to validate the ode infomation!#"2(* and in the case of successful validation, collects fo each poduct + the key needed fo decyption (eceive keys). When all keys aive within a given peiod of time (check timeout) 2, the Payment Coodinato sends all keys to the custome, sends a money tansfe ode to the bank in ode to cedit the mechant s accounts, and sends a confimation about the successful temination of the payment to all mechants (commit of payment). Othewise when the customes view on the ode infomation!#"#(* and the mechants view!43(* do not match fo some +, when some keys ae not available, when the timeout is exceeded, o when the validation of the payment infomation fails no exchange will take place (abot of payment) but appopiate notifications ae sent to all paticipants. Based on the pecedence and pefeence odes as well on the temination popeties of each activity, it can be shown that this tansactional payment pocess is coectly defined and thus povides guaanteed temination. Futhemoe, it has to be shown that by all coect teminations, the desied semantics of atomic payment inteactions (with espect to all thee dimensions of atomicity) is povided. To this end, all possible executions have to be consideed. Wheneve some failue occus pio to the temination of the check timeout activity, all peviously executed steps ae semantically compensated by sending a notification about the failue of the payment pocess to all paticipants (since this notification is also sent to the custome, she does not lose he payment infomation but can spent it late within othe payments). Afte the successful tansfe of the keys to the custome, the payment pocess is also teminated coectly since the eal-wold money tansfe has peviously been ensued by the bank (in the check validity of token step). Finally, when the tansfe of keys to the custome fails (e.g., since she cannot be contacted), also appopiate notifications ae sent to all paticipants and no eal-wold money tansfe takes place (again, the payment infomation can be used by the custome fo futhe payments). This tansactional payment pocess now povides money atomicity, cetified atomic delivey and distibuted puchase atomicity simultaneously. Since it is guaanteed that the payment infomation is only tansfeed in eal-wold money flow when the pocess teminates coectly and since no mechant eceives this payment infomation diectly, the custome is able to spent it again in the abot case of a payment pocess without being accused of double-spending. Fo cetified atomic delivey, the same aguments as given in [CHTY96] hold: the Payment Coodinato pesistently stoes pocess infomation and is thus in the case of custome complaints able to veify whethe the ode infomation matches the goods deliveed. Finally, since the pocess only teminates coectly when all mechants agee to commit, distibuted puchase atomicity is also povided. Aside of atomicity, also anonymity of the custome and povability have been identified as secuity aspects of payment potocols. Tansactional payment pocesses do not povide total anonymity (since the Payment Coodinato needs to contact the custome in ode to tansfe the keys needed to decypt all goods), but at least they povide patial anonymity. The custome may hide he identity (e.g., the IP addess of the host she is using) to the mechants by applying anonymizing techniques (such as, fo instance, [Ano99]). In ode to hide the identity of the custome to the bank when issuing electonic cash token, cyptogaphic blinding techniques [CFN88] can be applied. Since the Payment Coodinato stoes all pocess infomation (including the ode infomation) pesistently, the poof of the paticipation of a custome in a tansaction and the sevice odeed in this tansactions is possible (total povability). By executing payment pocesses by a centalized Payment Coodinato, the monitoing of the state of a payment inteaction is facilitated compaed to the distibution found in cuent payment potocols. Howeve, all paticipants (and especially the custome) have to tust this centalized Payment Coodinato. But since in the case of these payment pocesses only infomation about the mechants involved in a deal and the pizes of goods is available to the Payment Coodinato but no infomation about the single goods, this is equivalent to the amount and kind of data cedit cad oganizations collect when customes pefom payments with thei cedit cads. 2 This activity only geneates a log enty making the decision pesistent; although it can technically be compensated, it is teated as pivot since compensation of the pocess is no longe allowed. 6
5 Conclusion This pape povides a detailed analysis of equiements paticipants in E-Commece payment impose with espect to atomicity issues. Diffeent levels of atomicity can be identified which, howeve, ae not simultaneously povided by existing appoaches. Using the notion of pocesses, it has been shown that all payment inteactions can be embedded into a single payment pocess whee all possible levels of execution guaantees can be povided while at the same time the peequisites of the paticipants ae educed. Finally, by applying the ideas of tansactional pocess management, it has been shown how a Payment Coodinato suppoting atomic and povable payment pocesses can be developed. This pocess-based Payment Coodinato is cuently being implemented within the WISE system [AFH5 99]. Based on this implementation, we will in ou futue wok extend the analysis of payment pocesses to futhe popeties (such as, fo instance, anonymity, scalability, o flexibility). Ou goal is to decouple these popeties, to identify the building blocks needed to ealize them and to flexibly geneate payment pocesses with use-defined popeties by plugging togethe the building blocks needed. Refeences [ABFS97] G. Alonso, S. Blott, A. Feßle, and H.-J. Schek. Coectness and Paallelism in Composite Systems. In Poceedings of the ACM Symposium on Pinciples of Database Systems (PODS 97), Tucson, Aizona, May 12-15 1997. [AFH5 99] G. Alonso, U. Fiedle, C. Hagen, A. Lazcano, H. Schuldt, and N. Weile. WISE: Business to Business E-Commece. In Poceedings of the 9687 Intenational Wokshop on Reseach Issues in Data Engineeing. Infomation Technology fo Vitual Entepises (RIDE-VE 99), pages 132 139, Sydney, Austalia, Mach 1999. [Ano99] [CFN88] Anonymize.com, 1999. http://www.anonymize.com. D. Chaum, A. Fiat, and M. Nao. Untaceable Electonic Cash. In Poceedings of Advances in Cyptogaphy (CRYPTO 88), pages 319 327. Spinge, 1988. [CHTY96] J. Camp, M. Hakavy, D. Tyga, and B. Yee. Anonymous Atomic Tansactions. In Poceedings of the 29;: Usenix Wokshop on Electonic Commece, pages 123 133, Novembe 1996. [CTS95] [Dig99] [GR93] [HS98] B. Cox, D. Tyga, and M. Sibu. NetBill Secuity and Tansaction Potocol. In Poceedings of the 1<6 USENIX Wokshop on Electonic Commece, pages 77 88, July 1995. DigiCash, 1999. http://www.digicash.com/. J. Gay and A. Reute. Tansaction Pocessing: Concepts and Techniques. Mogan Kaufmann, 1993. A. Hemanns and M. Saute, editos. Management Handbuch Electonic Commece. Vahlen, 1998. In Geman. [MRSK93] S. Mehota, R. Rastogi, A. Silbeschatz, and H. Koth. A Tansaction Model fo Multidatabase Systems. Bulletin of the Technical Committee on Data Engineeing, 16(2), June 1993. [MV96] MasteCad and Visa. Secue Electonic Tansaction Specification. MasteCad and Visa, daft edition, June 1996. Book 1: Business Desciption, Book 2: Pogamme s Guide, Book 3: Fomal Potocol Specification (Slightly evised vesion of Book 3 appeaed August 1, 1997). [MWW98] P. Muth, J. Weissenfels, and G. Weikum. What Wokflow Technology can do fo Electonic Commece. In Poceedings of the EURO-MED NET Confeence, 1998. 7
[SAS99] [Sch98] [SSA99] [Tyg96] [Tyg98] H. Schuldt, G. Alonso, and H.-J. Schek. Concuency Contol and Recovey in Tansactional Pocess Management. In Poceedings of the ACM Symposium on Pinciples of Database Systems (PODS 99), pages 316 326, Philadelphia, Pennsylvania, USA, May 31-June 2 1999. B. Schmidt. Elektonische Mäkte Mekmale, Oganisation und Potentiale. In: [HS98]. 1998. In Geman. H. Schuldt, H.-J. Schek, and G. Alonso. Tansactional Coodination Agents fo Composite Systems. In Poceedings of the 3=>: Intenational Database Engineeing and Applications Symposium (IDEAS 99), pages 321 331, Montéal, Canada, August 1999. D. Tyga. Atomicity in Electonic Commece. In Poceedings of the 15687 Annual ACM Symposium on Pinciples of Distibuted Computing, pages 8 26, May 1996. D. Tyga. Atomicity vesus Anonymity: Distibuted Tansactions fo Electonic Commece. In Poceedings of the 24687 Confeence on Vey Lage Databases (VLDB 98), New Yok, USA, August 1998. [ZNBB94] A. Zhang, M. Nodine, B. Bhagava, and O. Bukhes. Ensuing Relaxed Atomicity fo Flexible Tansactions in Multidatabase Systems. In Poceedings of the ACM SIGMOD Confeence, pages 67 78, 1994. 8