臺灣博碩士論文加值系統

隨著電腦網路的高度發展，電子資料交換（Electronic Data Interchange, EDI）已成為企業及政府提高效率的新利器。當EDI架構在一個開放式的網路上，如Internet，可以使得資料交換更為快速便捷，從而提昇產業整體的效能。但是架構在一個開放式網路上之EDI會面臨四面八方的威脅，譬如資料的竊取、竄改等。如何在Internet上確保EDI資訊的安全，是一個很重要的研究課題。本研究探討在網際網路上以電子郵件來傳遞EDI資料的方式，應用多用途網際網路信件延伸（Multipurpose Internet Mail Extensions, MIME）整合EDI與電子郵件安全機制，使EDI資料能在網際網路上安全的被傳遞。
本研究首先做可行性分析：綜覽EDI的格式；分析現有電子郵件的格式與相關安全機制，討論這些機制在安全性及實際建構上的優缺點；探討MIME Object Secure Service（MOSS）、Secure MIME（S/MIME）與MIME with Pretty Good Privacy（PGP/MIME）格式，研究如何將其與EDI做完美的整合。在可行性分析後，會以金融EDI系統為例，建立一個以PGP/MIME為基礎的雛形系統，並以此雛形系統實際評估金融EDI與電子郵件安全機制的整合結果。

As communication network been highly developed, the Electronic Data Exchange(EDI) has become essential to the success of the operation of governments and enterprises. When an EDI document is transferred on an open network, such as the Internet, it can be exchanged more rapidly and conveniently; thus, the performance of the enterprise is improved. However, an EDI document inevitably faces various threats; e.g., data stealing or manipulation, when electronic information is transmitted via open networks. Consequently, the security of EDI should be seriously concerned. This study will focus on applying Multipurpose Internet Mail Extensions (MIME) to integrate the EDI and the Internet e-mail security mechanisms.
First, we will conduct feasibility study; by reviewing MIME format, analyzing Internet e-mail security mechanisms, like MIME Object Secure Service (MOSS), Secure MIME (S/MIME) and MIME with Pretty Good Privacy (PGP/MIME), discussing advantages and disadvantages of these mechanisms. After feasibility study, we will take a financial EDI order system as an example to develop a prototype and evaluate the result of integrating the EDI with the Internet e-mail security mechanisms by using this prototype.

中文摘要i
英文摘要ii
誌謝 iii
目錄iv
表目錄vii
圖目錄viii
一、緒論1
1.1 研究動機1
1.2 研究目標2
1.3 章節簡介2
二、EDI之介紹3
2.1 EDI之格式標準與應用3
2.1.1 EDI的訊息格式3
2.1.2 UN/EDIFACT4
2.1.3 ANSI X.125
2.1.4 其他標準6
2.2 EDI的傳輸方式6
2.2.1 Multipurpose Internet Mail Extension (MIME)6
2.3 EDI的應用分類 - 以產業類別分類8
2.3.1 零售業8
2.3.2 醫療服務業10
2.3.3 金融業11
2.3.4 貿易與運輸業13
2.3.5 行政單位EDI14
三、網際網路電子郵件安全機制15
3.1 網際網路電子郵件安全機制15
3.1.1 Pretty Good Privacy (PGP)15
3.1.2 Privacy Enhanced Message (PEM)19
3.1.3 PGP與PEM的比較29
3.2 MIME安全機制30
3.2.1 MIME Object Security Service (MOSS)30
3.2.2 Secure MIME (S/MIME)34
3.2.3 MIME Security with Pretty good Privacy (PGP/MIME) 39
3.3 MOSS、S/MIME與PGP/MIME安全機制之比較與分析45
3.3.1 訊息加密方法46
3.3.2 訊息摘要及簽章46
3.3.3 認證與金匙管理46
四、系統架構與實作48
4.1 以MIME結合EDI與網際網路電子郵件安全機制的架構48
4.1.1 應用介面軟體 Mapper48
4.1.2 訊息轉換軟體 Translator49
4.1.3 安全控管軟體49
4.1.4 通訊傳輸軟體49
4.2 以PGP/MIME為基礎的系統實作探討49
4.2.1 系統實作環境49
4.2.2 實作系統規格選擇50
4.2.3 系統流程圖51
4.2.4 系統模組及功能說明54
4.3 實作系統展示57
4.3.1 RSA金匙對產生程式57
4.3.2 EDI發送端系統程式57
4.3.3 EDI接收端系統程式62
五、結論65
5.1 結論65
5.2 未來方向65
參考文獻66
附錄一、RSAEURO版權宣言68

[1] Andrew Fletcher, EDI-Electronic Commerce, EDI and the Internet, Reed Business Information, England 1997
[2] R. Power. R., "UN/EDIFACT Syntax Implementation Guideline", UNECE
[3] Paul Kimberley, Electronic Data interchange, McGRAW-HILL, 1991
[4] N. Borenstein, N. Freed., "MIME (Multipurpose Internet Mail Extensions): Mechanisms for Specifying and Describing the Format of Internet Message Bodies, RFC 1341", June 1992
[5] Valerie Leyland, Electronic Data Interchange, Prentice-Hall, 1993
[6] Martin parfett, What is EDI?, NCC Blackwell, 1992
[7] Phyllis K. Sokol, From EDI to Electronic Commerce, McGraw-Hill, 1995
[8] Zimmermann, p., "PGP User''s Guide, Vol.I Essential topics", 1994
[9] Zimmermann, p., "PGP User''s Guide, Vol.II Special topics", 1994
[10] D. Atkins, W. Stallings, P. Zimmermann, "PGP Message Exchange Formats, RFC 1991", August 1996
[11] Kaufman, Perlman, and Speciner, Network Security: Private Communication in a Public World, Prentice Hall, 1995
[12] J. Linn, "Privacy Enhancement for Internet Electronic Mail, Part I: Message Encryption and Authentication Procedures, RFC 1421", IAB 1993
[13] S Kent, "Privacy Enhancement for Internet Electronic Mail, Part II: Certificate -Based Key Management, RFC 1422", IAB 1993
[14] D. Balenson, "Privacy Enhancement for Internet Electronic Mail, Part III: Algorithms, Modes, and Identifiers, RFC 1423", IAB 1993
[15] B. Kaliski, "Privacy Enhancement for Internet Electronic Mail, Part IV: Key Certification and Related Services, RFC 1424", IAB 1993
[16] S. Crocker, "MIME Object Security Services, RFC 1848", October 1995
[17] J. Galvin , "Security Multiparts for MIME, RFC 1847", October 1995
[18] S. Dusse, "S/MIME Version 2 Message Specification, RFC 2311", March 1998
[19] B. Kaliski. "PKCS #1: RSA Encryption Version 1.5, RFC 2313", March 1998
[20] B. Kaliski, "PKCS #7: Cryptographic Message Syntax Version 1.5, RFC 2315", March 1998
[21] B. Kaliski. "PKCS 10: Certification Request Syntax Version 1.5, RFC 2314", March 1998
[22] M. Elkins, "MIME Security with Pretty Good Privacy, RFC 2015", October 1996
[23] Chuck Shih, "MIME-based Secure EDI, draft-ietf-ediint-as1-08", May 1998