Donghua Xu, Chenghuai Lu and Andre L. M. dos Santos
Georgia Institute of Technology
USA

The blooming e-commerce is demanding better methods to protect online users' privacy, especially the credit card information that is widely used in online shopping. Holding all these data in a central database of the web sites would attract hackers' attacks, impose unnecessary liability on the merchant web sites, and raise the customers' privacy concerns. In this paper we introduce and discuss in details the secure distributed storage of sensitive information using HTTP cookie encryption. We are able to employ One-Time Pads to encrypt the cookies, because encryption and decryption are both done by the server, an interesting characteristic overlooked by the existing systems. We implemented this protocol and showed that it is simple, fast and easy to program with.

Keywords: cookie encryption, OTP, e-commerce

Read Paper (in PDF)