2014 IEEE Students’ Conference on Electrical, Electronics and Computer Science

Online Payment System using Steganography and

Visual Cryptography

Souvik Roy1 and P. Venkateswaran2

Department of Electronics & Tele-Communication Engineering
Jadavpur University, Kolkata-700032, India
([email protected], [email protected])

Abstract—A rapid growth in E-Commerce market is seen in The rest of the paper is organized as follows: Section II
recent time throughout the world. With ever increasing gives brief description of text based steganography and visual
popularity of online shopping, Debit or Credit card fraud and cryptography. Section III contains related works. Section IV
personal information security are major concerns for customers, presents the proposed steganography method. Section V
merchants and banks specifically in the case of CNP (Card Not provides method of transaction in online shopping. Section VI
Present). This paper presents a new approach for providing presents proposed payment method. Section VII concludes the
limited information only that is necessary for fund transfer paper
during online shopping thereby safeguarding customer data and
increasing customer confidence and preventing identity theft.
The method uses combined application of steganography and II. STEGANOGRAPHY AND VISUAL CRYPTOGRAPHY
visual cryptography for this purpose. Steganography is the art of hiding of a message within
another so that hidden message is indistinguishable. The key
Keywords—Information security; Steganography; Visual concept behind steganography is that message to be transmitted
Cryptography; Online shopping
is not detectable to casual eye. Text [4], image [5], video [6],
audio [7] are used as a cover media for hiding data in
I. INTRODUCTION steganography. In text steganography, message can be hidden
Online shopping is the retrieval of product information via by shifting word and line [4], in open spaces [8], in word
the Internet and issue of purchase order through electronic sequence [9]. Properties of a sentence such as number of
purchase request, filling of credit or debit card information and words, number of characters, number of vowels, position of
shipping of product by mail order or home delivery by courier vowels in a word are also used to hide secret message. The
[1]. Identity theft and phishing are the common dangers of advantage of preferring text steganography over other
online shopping. Identity theft is the stealing of someone’s steganography techniques is its smaller memory requirement
identity in the form of personal information and misuse of that and simpler communication [10].
information for making purchase and opening of bank accounts Visual Cryptography (VC), proposed by Naor et al. in [11],
or arranging credit cards. In 2012 consumer information was is a cryptographic technique based on visual secret sharing
misused for an average of 48 days as a result of identity theft used for image encryption. Using k out of n (k, n) visual secret
[2]. Phishing is a criminal mechanism that employs both social sharing scheme a secret image is encrypted in shares which are
engineering and technical subterfuge to steal consumers’ meaningless images that can be transmitted or distributed over
personal identity data and financial account credentials. In 2nd an untrusted communication channel. Only combining the k
quarter of 2013, Payment Service, Financial and Retail Service shares or more give the original secret image.
are the most targeted industrial sectors of phishing attacks [3].
Secure Socket Layer (SSL) encryption prevents the
interception of consumer information in transit between the III. RELATED WORK
consumer and the online merchant. However, one must still A brief survey of related work in the area of banking
trust merchant and its employees not to use consumer security based on steganography and visual cryptography is
information for their own purchases and not to sell the presented in this section. A customer authentication system
information to others. using visual cryptography is presented in [12] but it is
specifically designed for physical banking. A signature based
In this paper, a new method is proposed, that uses text
authentication system for core banking is proposed in [13] but
based steganography and visual cryptography, which
it also requires physical presence of the customer presenting
minimizes information sharing between consumer and online
the share. [14] proposes a combined image based
merchant but enable successful fund transfer from consumer’s
steganography and visual cryptography authentication system
account to merchant’s account thereby safeguarding consumer
for customer authentication in core banking. A message
information and preventing misuse of information at merchant
authentication image algorithm is proposed in [15] to protect
side. The method proposed is specifically for E-Commerce but
against e-banking fraud. A biometrics in conjunction with
can easily be extended for online as well as physical banking.
visual cryptography is used as authentication system [16].

978-1-4799-2526-1/14/$31.00 ©2014 IEEE

 IV. PROPOSED TEXT BASED STEGANOGRAPHY METHOD ƒ Choosing of suitable letters from table 1 corresponding
Proposed text based steganography uses characteristics of to the 4 bit parts.
English language such as inflexion, fixed word order and use ƒ Meaningful sentence construction by using letters
of periphrases for hiding data rather than using properties of a obtained as the first letters of suitable words.
sentence as in [4], [8], [9]. This gives flexibility and freedom
from the point view of sentence construction but it increases ƒ Omission of articles, pronoun, preposition, adverb,
computational complexity. was/were, is/am/are, has/have/had, will/shall, and
would/should in coding process to give flexibility in
The steganography technique is based on Vedic Numeric sentence construction.
Code [17] in which coding is based on tongue position. For
applying the Vedic code to English alphabet, frequency of ƒ Encoding is not case sensitive.
letters in English vocabulary [18] is used as the basis for
assigning numbers to the letters in English alphabet. Number B. Decoding
assignments of letters are shown in table 1. No separate Steps:
importance is given for vowels and consonants as compared to
[19]. ƒ First letter in each word of cover message is taken and
represented by corresponding 4 bit number.
Each letter is assigned a number in the range of 0 to 15. For
different frequencies, different numbers are assigned to the ƒ 4 bit binary numbers of combined to obtain 8 bit
letters. Number assigned in range (N+0.99) % to (N+0.3) % number.
and (N+0.2) % to (N+0.01) % is same where N is any integer ƒ ASCII codes are obtained from 8 bit numbers.
from 0 to 11. It basically represents frequency of letters in
integer form. Above number assignment method is used to ƒ Finally secret message is recovered from ASCII codes.
maximize no of letters in a particular assigned number group
which in turn gives flexibility in word choosing and ultimately C. Result
results in suitable sentence construction. To implement the above text based steganography method,
a secret message is considered. Suppose it is “text”.
TABLE I. NUMBER ASSIGNMENT text = 01110100011001010111100001110100
Letter Number assigned Letter Number assigned Result of encoding is shown in Fig. 1.
E 15 M 7

A 14 H 7

R 13 G 6

I 13 B 5

O 12 F 4

T 11 Y 4

N 11 W 3

S 10 K 3
Fig. 1. Cover message.
L 10 V 3

C 9 X 2 D. Drawback
U 8 Z 2 In result to hide 4 letter word, 8 words are required
excluding the words that are added to provide flexibility in
D 8 J 1 sentence construction. So to hide a large message, this
P 7 Q 0 technique requires large no of words and creates a complexity
in sentence construction. Disadvantage of this technique can be
used in its advantage by applying it to online banking to create
spam mail to hide one’s banking information.
A. Encoding
Steps: V. TRANSACTION IN ONLINE SHOPPING
ƒ Representation of each letter in secret message by its In traditional online shopping as shown in Fig. 2 consumer
equivalent ASCII code. selects items from online shopping portal and then is directed
to the payment page. Online merchant may have its own
ƒ Conversion of ASCII code to equivalent 8 bit binary payment system or can take advantage of third party payment
number. systems such as PayPal, payonlinesystem, WebMoney and
ƒ Division of 8 bit binary number into two 4 bit parts. others. In the payment portal consumer submit his or her credit

SCEECS 2014
or debit card details such as credit or debit card number, name the snapshot image, two shares are generated using visual
on the card, expiry date of the card. cryptography.
SELECTION OF ITEM SUBMISSION OF PERSONAL
BY CUSTOMER AND DEBIT OR CREDIT CARD CUSTOMER’S
DETAILS IN SHOP’S SECURE SHARE CUSTOMER
SERVER +
CA’S SHARE

ACCOUNT INFORMATION CHECKING IN

VERIFICATION IN BANK PAYMENT GATEWAY CA MERCAHNT

ACCOUNT NO
ACCOUNT NO

TRANSFER OF FUND
TRANSFER
OF FUND
USER
AUTHENTICATION
Fig. 2. Transaction in online shopping. PASSWORD
USER
AUTHENTICATION
Details of information sought from shopper vary from one PASSWORD

payment gateway to another. For example, payment in IRCTC

website requires Personal Identification Number (PIN) when CA BANK
paying using debit card whereas shopping in Flipkart or
Snapdeal requires Visa or Master secure code. In addition to
that merchant may require a Card Verification Value code, Fig. 3. Proposed payment method
CVV (CVV2 for Visa, CVC2 for MasterCard), which is
basically an authorizing code in CNP transactions. According Now one share is kept by the customer and the other share
to the PCI Data Security Standard [20], merchants are is kept in the database of the certified authority. During
prohibited from storing CVV information or PIN data and if shopping online, after selection of desired item and adding it to
permitted card information such as name, card number and the cart, preferred payment system of the merchant directs the
expiration date is stored, certain security standards are customer to the Certified Authority portal. In the portal,
required. However recent high profile breaches such as in shopper submits its own share and merchant submits its own
Epsilon, Sony’s PlayStation Network and Heartland Payment account details. Now the CA combines its own share with
Systems show that card holders’ information is at risk both shopper’s share and obtains the original image. From CA now,
from outside and inside. A solution can be forcing merchant to merchant account details, cover text are sent to the bank where
be a PCI complaint but cost to be a PCI complaint is huge and customer authentication password is recovered from the cover
the process is complex and time consuming [21] and it will text. Customer authentication information is sent to the
solve part of the problem. One still has to trust the merchant merchant by CA. Upon receiving customer authentication
and its employees not to use card information for there own password, bank matches it with its own database and after
purposes. verifying legitimate customer, transfers fund from the customer
account to the submitted merchant account. After receiving the
fund, merchant’s payment system validates receipt of payment
VI. PROPOSED PAYMENT METHOD
using customer authentication information.
In the proposed solution, information submitted by the
customer to the online merchant is minimized by providing The problem is that CA does not know to which bank to
only minimum information that will only verify the payment forward the cover text obtained from combining two shares. It
made by the said customer from its bank account. This is can be solved by appending 9 digit routing or transit number of
achieved by the introduction of a central Certified Authority bank with customer authentication information.
(CA) and combined application of steganography and visual If “text” is customer unique authentication password and
cryptography. The information received by the merchant can account no of customer is 12345678910111, snapshot of cover
be in the form of account number related to the card used for text and account no is shown in Fig. 4 and resultant shares by
shopping. The information will only validate receipt of the application of visual cryptography on snapshot are Fig. 5
payment from authentic customer. The process is shown in Fig. and Fig. 6. Fig. 5 shows share 1 kept by customer and Fig. 6
3. shows share 2 kept by CA. Fig. 7 shows the result of combing
In the proposed method, customer unique authentication share 1 and share 2.
password in connection to the bank is hidden inside a cover
text using the text based steganography method as mentioned A. Advantage
in section IV. Customer authentication information (account ƒ Proposed method minimizes customer information sent
no) in connection with merchant is placed above the cover text to the online merchant. So in case of a breach in
in its original form. Now a snapshot of two texts is taken. From merchant’s database, customer doesn’t get affected. It

SCEECS 2014
 also prevents unlawful use of customer information at
merchant’s side.
ƒ Presence of a fourth party, CA, enhances customer’s
satisfaction and security further as more number of
parties are involved in the process.
ƒ Usage of steganography ensures that the CA does not Fig. 7. Overlapping of share 1 and share 2.
know customer authentication password thus
maintaining customer privacy.
VII. CONCLUSIONS
ƒ Cover text can be sent in the form of email from CA to
bank to avoid rising suspicion. In this paper, a payment system for online shopping is
proposed by combining text based steganography and visual
ƒ Since customer data is distributed over 3 parties, a cryptography that provides customer data privacy and prevents
breach in single database can easily be contented. misuse of data at merchant’s side. The method is concerned
only with prevention of identify theft and customer data
B. Security Threat security. In comparison to other banking application which
ƒ During payment, merchant’s payment system requires uses steganography and visual cryptography [12, 13, and 14],
to direct the shopper to CA’s portal but fraudulent are basically applied for physical banking, the proposed
merchant may direct shopper to a portal similar to CA’s method can be applied for E-Commerce with focus area on
portal but of its own making and get hold of customer payment during online shopping as well as physical banking.
own share. To prevent this type of phishing attack, an
end-host based approach can be implemented for REFERENCES
detection and prevention of phishing attack as in [22].
[1] Jihui Chen, Xiaoyao Xie, and Fengxuan Jing, "The security of shopping
C. Method Extension online," Proceedings of 2011 International Conference on Electronic and
ƒ The payment system can also be extended to physical Mechanical Engineering and Information Technology (EMEIT), vol. 9,
pp. 4693-4696, 2011.
banking. Shares may contain customer image or
[2] Javelin Strategy & Research, “2013 Identify Fraud Report,”
signature in addition to customer authentication https://www.javelinstrategy.com/brochure/276.
password. In the bank, customer submits its own share
[3] Anti-Phishing Working Group (APWG), “Phishing Activity Trends
and customer physical signature is validated against the Report,2013,”http://docs.apwg.org/reports/apwg_trends_report_q2_2013
signature obtained by combining customer’s share and .pdf .
CA’s share along with validation of customer [4] Jack Brassil, Steven Low, Nicholas Maxemchuk, Larry O’Gorman,
authentication password. It prevents misuse of stolen “Hiding Information in Document Images,” Proceedings of the 1995
card and stops illegitimate customer. Conference on Information Sciences and Systems, Johns Hopkins
University, pp. 482-489, 1995.
[5] J. Chen, T. S. Chen, M. W. Cheng, “A New Data Hiding Scheme in
Binary Image,” Proceeding of Fifth International Symposium on
Multimedia Software Engineering, pp. 88-93, 2003.
[6] Hu ShengDun, U. KinTak, “A Novel Video Steganography Based on
Non-uniform Rectangular Partition,” Proceding of 14th International
Conference on Computational Science and Engineering, pp. 57-61,
Dalian, Liaoning, 2011.
Fig. 4. Snapshot account no and cover text. [7] Daniel Gruhl, Anthony Lu, Walter Bender, “Echo Hiding,” Proceedings
of the First International Workshop on Information Hidding, pp. 293-
315, Cambridge, UK, 1996.
[8] Walter Bender, Daniel Gruhl, Norishige Morimoto, A. Lu, “Techniques
for Data Hiding,” IBM Systems Journal, Vol. 35, Nos. 3 & 4, pp. 313-
336, 1996.
[9] K. Bennet, “Linguistic Steganography: Surevey, Analysis, and
Robustness Concerns for Hiding information in Text,” Purdue
University, Cerias Tech Report 2004—2013.
[10] J.C. Judge, “Steganography: Past, Present, Future,” SANS Institute,
Fig. 5. Share 1 kept by customer. November 30, 2001.
[11] M. Naor and A. Shamir, “Visual cryptography,” Advances in
Cryptograhy: EUROCRYPT’94, LNCS, vol. 950, pp. 1–12, 1995.
[12] Jaya, Siddharth Malik, Abhinav Aggarwal, Anjali Sardana, “Novel
Authentication System Using Visual Cryptography,” Proceedings of
2011 World Congress on Information and Communication
Technologies, pp. 1181-1186, Mumbai, India, 2011.
[13] Chetana Hegde, S. Manu, P. Deepa Shenoy, K. R. Venugopal, L M
Patnaik, “Secure Authentication using Image Processing and Visual
Fig. 6. Share 2 kept by CA. Cryptography for Banking Applications,” Proceedings of 16th
International Conference on Advanced Computing and
Communications, pp. 65-72, Chennai, India, 2008.

SCEECS 2014
[14] S.Premkumar, A.E.Narayanan, “New Visual Steganography Scheme for [18] http://oxforddictionaries.com/words/what-is-the-frequency-of-the-
Secure Banking Application,” Proceeding of 2012 International letters-of-the-alphabet-in-english.
Conference on Computing, Electronics and Electrical Technologies [19] Kalavathi Alla, Dr. R. Siva Rama Prasad, “An Evolution of Hindi Text
(ICCEET), pp. 1013 – 1016, Kumaracoil, India, 2012. Steganography,” Proceding of Sixth International Conference on
[15] K. Thamizhchelvy, G. Geetha, “E-Banking Security: Mitigating Online Information Technology, pp. 1577-1578, Las Vegas, NV, 2009.
Threats Using Message Authentication Image (MAI) Algorithm,” [20] PCI DSS Quick Reference Guide v2.0, pp 14-15.
Proceedings of 2012 International Conference on Computing Sciences
(ICCS), pp. 276 – 280, 2012. [21] https://www.braintreepayments.com/blog/pci-compliance-and-the-cost-
of-a-credit-card-breach.
[16] S. Suryadevara, R. Naaz, Shweta, S. Kapoor, “Visual cryptography
improvises the security of tongue as a biometric in banking system,” [22] Juan Chen, Chuanxiong Guo, “Online Detection and Prevention of
Proceedings of 2011 2nd International Conference on Computer and Phishing Attacks,” Proceedings of First International Conference on
Communication Technology (ICCCT), pp. 412 – 415, 2011. Communications and Networking in China (ChinaCom '06), pp. 1 - 7,
Beijing, China, 2006.
[17] Bharati Krishna Tirthaji, “Vedic Mathematics and its Spiritual
Dimension,” Motilal Bansari Publishers,1992.

SCEECS 2014