臺灣博碩士論文加值系統

隨著網際網路(Internet)的蓬勃發展，許多傳統產業亦將其產品與服務轉為電子化形式。相關應用技術將可憑藉網路世界而實現，例如電子付款(Electronic Payment)、電子拍賣(Electronic Auction)、電子購物(Electronic Buy)等。網際網路促使以往商業行為不再侷限於時間與空間限制，加速電子商務(Electronic Commerce)盛行與新型態消費模式的產生。因此，制訂適應當前局勢的付款機制，將可促使網際網路應用服務付費機制的實施。然而網際應用則面臨安全性不足的窘境，導致電子商務窒礙難行，亦造成近年不少網路公司面臨泡沫化危機。因此，國內外各金融機構、學術研究機構、專家學者與政府機關對資訊安全相關領域研究投入極大的心力。此外立法院亦於民國九十年十月三十一日上午三讀通過『電子簽章法』，將促使電子商務相關金流和物流的正確性與安全性獲得保障，對電子商務的金流或是電子公文交換所面臨的身分鑑識、資料整合性等問題，將可提供完善解決方案。
本文提出一個適合本國環境發展的電子付款系統，所提出的可匿名之電子採購式付款系統，除了保有先前買方主控系統的高效率特性外，並強化顧客與銀行間的匿名性。買方可就其需求刊登廣告或條件採購單，商家則可評估這些需求訊息，並決定是否與該名客戶交易。時間戳記的運用解決不可爭論性的問題，使系統賦予更多彈性。例如：買方倘若於一段時間後仍未獲得完善的回應，則可藉由修改原先的條件採購單以尋找新的賣方。未來的方向則可朝向多個商家共同完成一份採購訂單的交易，此將可有效解決政府或民間企業招標過程繁雜與買賣雙方付出過多的交易成本等問題。

With the Internet rapid development, many conventional industries transform their products and services into the electronic-merchandise. New applied technique will rely on Internet to come true, for instance, electronic payment, electronic auction, and electronic buy, etc. Compared with the business model in the past, Internet accelerate e-commerce development without the restriction of time and space. For this reason, establishing a secure payment system appropriate for our country will help the charge for Internet service put into practice.
In this thesis, we propose an anonymous conditional purchase order payment system which not only keep high efficiency but also strengthen the anonymity between customers and banks. The customers consider their requirements and put conditional purchase order on the web, and then the merchants are going to find a conditional purchase order (CPO) appropriate for trade in the web site. Besides, timestamp will solve the problem or dispute in the trade and make our scheme more flexibly. For example, if the customer can’t find any merchant for trade, they will modify their CPO for the purpose of suitable merchant. In the future, we will address ourselves to design a payment system which enables multi-merchants to deal with one CPO and solve the problem of the high transaction cost and complex transaction process in the enterprise and government.

致謝 I
摘要 II
ABSTRACT III
目錄 IV
圖目錄 VIII
表目錄 IX
第一章 序論 1
1.1 研究背景 1
1.2 研究動機 2
1.3 研究目的 4
1.4 論文架構 4
第二章 文獻探討 5
2.1 付款系統簡介與分類 5
2.1.1 付款系統簡介 5
2.1.2 付款系統分類 6
2.2 電子付款系統需求 8
2.2.1 私密性(Confidentiality) 8
2.2.2 隱私性(Privacy) 9
2.2.3 不可分割性(Atomicity) 10
2.2.4 鑑別性(Authentication) 10
2.2.5 不可爭論性(Non-Dispute) 11
2.2.6 完整性(Integrity) 12
2.2.7 角色反轉性(Role Inversibility) 12
2.2.8 稽核性(Auditability) 13
2.2.9 擴充性(Scalability) 13
2.2.10 效率性(Efficiency) 13
2.2.11 相容性(Interoperability) 14
2.2.12 可用性(Availability) 15
2.2.13 可靠性(Reliability) 15
2.3 小額付款系統回顧 17
2.3.1 小額付款協定 17
2.3.2 其他小額付款系統 19
2.4 訂購單式付款系統回顧 20
2.4.1 Kelsey et al. 的條件採購單系統 21
2.4.2 Foo et al.的被動式實體付款系統 26
第三章 相關技術與理論 29
3.1 智慧卡(SMART CARD) 29
3.2 單向雜湊函數(ONE-WAY HASH FUNCTION) 30
3.3 公開金鑰基礎建設(PUBLIC KEY INFRASTRUCTURE) 31
第四章 新的付款方案 33
4.1 系統假設 33
4.2 符號表示 33
4.3 系統流程 34
4.3.1 準備階段 34
4.3.2 提款階段 35
4.3.3 訂單公佈階段 37
4.3.4 訂單撮合階段 38
4.3.5 客戶查詢階段 39
4.3.6 付款階段 40
4.3.7 衍生應用 41
第五章 分析與結論 43
5.1 私密性安全分析 43
5.2 隱私性安全分析 43
5.3 鑑別性安全分析 44
5.4 不可爭論性安全分析 44
5.5 完整性安全分析 45
5.6 稽核性需求分析 45
5.7 效率性需求分析 46
5.8 其餘的需求分析 46
5.9 結論 47
參考文獻 48

[1] 黃景彰、薛夙珍、李鐘斌、邱筱雅，“電子支付系統的分類與實例”，資訊安全通訊第五卷第二期，1999年3月。
[2] 余主浩，“植基於非平衡單向二元樹之另一種小額付款協定”，中興大學應用數學所碩士論文，2000年6月。
[3] 陳維魁，“單向雜湊函數在數位現金及電子選票上之運用”，交通大學資訊工程所博士論文，2001年3月。
[4] 范俊逸，“數位貨幣與電子投票上之用戶端高效率盲目簽章設計”，台灣大學電機工程研究所博士論文，1998年9月。
[5] M. Abe and E. Fujiski, “How to Date Blind Signatures,” Advances in Cryptology — Proceedings of ASIACRYPT ''96, Lecture Notes in Computer Science 1163, Springer-Verlag, pp. 244-251, Nov. 1996.
[6] N. Asokan, E. V. Herreweghen , and M. Steiner, “Towards A Framework for Handling Disputes in Payment Systems,” Proceedings of the 3rd USENIX Workshop on Electronic Commerce, pp.187-202, Sep. 1998.
[7] N. Asokan, P. A. Janson, Michael Steiner, and M. Waidner, "The State of the Art in Electronic Payment Systems," IEEE Computer, Vol. 30, pp. 28-35, Sep. 1997.
[8] H. Bürk, A. Pfitzmann: Digital Payment Systems Enabling Security and Unobservability; Computers & Security, Vol. 8, No.5, pp.399-416, 1989.
[9] D. Chaum, “Blind Signatures for Untraceable Payments,” Advances in Cryptology -CRYPTO ''82, Lecture Notes in Computer Science, Springer-Verlag, pp. 199-203,1983.
[10] B. Cox, D. Tygar, and M. Sirbu, “Netbill security and transaction protocol,” In Proceedings fo the 1st USENIX Workshop on Electronic Commerce, pp. 77-88, Jul. 1995.
[11] W. Diffie and M. Hellman "New directions in cryptography," IEEE Transactions on Information Theory, Vol. 22, No. 6, pp. 644-654, Nov. 1976.
[12] L. Ferreirra and R. Dahab, “A Scheme for Analyzing Electronic Payment System,” 14th Annual Coputer Security Application Conference, pp. 137-146, Dec. 1998.
[13] E. Foo and C. Boyd, “Passive Entities:A Strategy for Electronic Payment Design,” ACISP 2000, Lecture Notes in Computer Science 1841, Springer-Verlag, pp.134-148, Jul. 2000.
[14] R. Hauser, M. Steiner, and M. Waidner, “Micro-payments based on ikp,” Proceedings of the 14th Worldwide Congress on Computer and Communications Security Protection, pp. 67-82, Jun. 1996.
[15] N. M. Haller, “The S/Key One-Time PasswordSystem, ” Proceedings of the Internet Society Symposium on Network and Distributed System Security, pp. 151-157,San Diego, CA, Feb. 1994.
[16] P. Janson, M. Waidner, “Electronic Payment Systems,” Technischer Bericht SEMPER 211ZR018, IBM Research, T.J. Watson Research Center & Zurich Research Lab, May 1996.
[17] S. Jarecki and A. Odlyzko, "An Efficient Micropayment System Based on Probabilistic Polling," Advances in Cryptology - Proceedings of Financial Cryptography ''97, pp. 173-191, Feb. 1997.
[18] B. S. Kaliski, “The MD2 Message Digest Algorithm,” RFC 1319, IETF, Apr. 1992.
[19] J. Kelsey and B. Schneier, “Conditional Purchase Orders”, Proceedings of the Fourth ACM Conference on Computer and Communications Security. ACM Press, pp. 117-124,1997.
[20] P. A. Lee and T. Anderson, "Fault Tolerance, Principles and Practice", Second Edition, Springer-Verlag, 1990.
[21] M. Manasse, "The Millicent Protocols for Electronic Commerce," Proceedings of the First USENIX Workshop on Electronic Commerce, pp. 117-123, Jul. 1995. 1997.
[22] R. Meier and P. Nixon, “Managing Fault Tolerance Transparently Using CORBA Services,” European Conference on Parallel Processing, pp. 519-522, Feb 1999.
[23] A. J. Menezes, P. C. van Oorschot, and S. Vanstone, “Handbook of applied cryptography,” CRC Press, 1996.
[24] A. Nash, W. Duane, C. Joseph, and D.Brink, “PKI:Implementing and Managing E-Security,” McGraw-Hill, 2001.
[25] National Institute of Standards and Technology, “Secure Hash Standard,” FIPS 186-1, US Department of Commerce, Apr. 1995
[26] B. C. Neuman, “Security, Payment, and Privacy for Network Commerce,” IEEE Journal on Selected Areas in Communications, Vol. 13, No. 8, pp. 1523-1531, Oct. 1995.
[27] T. Pedersen, "Electronic Payments of Small Amounts", Proceedings of Cambridge Workshop on Security Protocols, Lecture Notes in Computer Science 1189, Springer-Verlag, pp. 59-68, Apr. 1997.
[28] J. A. Peiro, N. Asokan, and M. Waidner, “Payment Manager — Overview,” Public SEMPER report 212ZR054, Mar. 1996.
[29] B. Ptzmann and M. Waidner, “Properties of Payment Systems:General Denition Sketch and Classification,” Research Report RZ 2823 (#90126), IBM Research, May 1996.
[30] R. L. Rivest, “The MD4 Message-Digest Algorithm,” RFC 1320, IETF, Apr. 1992.
[31] R. L. Rivest, “The MD5 Message-Digest Algorithm,” RFC 1321, IETF, Apr. 1992.
[32] R. L. Rivest, “Electronic Lottery Tickets as Micropayments,” Proceedings of Financial Cryptography Conference: FC '97, Lecture Notes in Computer Science 1318, Springer-Verlag, pp. 307-314, 1998.
[33] R. L. Rivest, A. Shamir, and L. Adleman, “A Method for Obtaining Digital Signatures and Public-Key Cryptosystems”, Communications of the ACM, Vol. 21, No. 2, pp. 120-126, Feb. 1978.
[34] R. L. Rivest, A. Shamir, “PayWord and MicroMint: Two Simple Micropayment Schemes,” MIT, Jan. 1996.
[35] J. Stern and S. Vaudenay, "SVP: a Flexible Micropayment Scheme," Advances in Cryptology - Proceedings of Financial Cryptography ''97, pp. 161-171, Feb. 1997.
[36] J. D. Tygar, “Atomicity in Electronic Commerce,” Proceedings of the Fifteenth Annual ACM Symposium on Principles of Distributed Computing, pp. 8-26, May 1996.
[37] S. M. Yen, L. T. Ho, and C. Y. Huang, “Internet Micropayment Based on Unbalanced One-way Binary Tree,” Proceedings of the 9th National Conference on Information Security, pp. 66-73, May 1999.
[38] S. M. Yen and Y. Zheng, “Weighted One-Way Hash Chain and Its Application,” Proceedings of ISW 2000, Lecture Notes in Computer Science 1975, Springer-Verlag, pp. 135-148, Dec. 2000.
[39] SET, http://www.setco.org/
[40] Mondex, http://www.mondex.com/。